September 2001 - openSUSE Security - openSUSE Mailing Lists

Getting hacked?
by Max Lindner 06 Sep '01

06 Sep '01

Hi out there... I've got a big problem... A few folders disappeared from my samba-dir (unfortunately they where the importantest i ever had :( ). Well that's not the real problem. After this I've checked /var/log/messages and got the following: Sep 5 22:18:21 monika sshd[2616]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:23 monika sshd[2623]: Did not receive ident string from 62.225.211.70. Sep 5 22:18:26 monika in.ftpd[2615]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.telnetd[2617]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika in.fingerd[2618]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:26 monika popper[2619]: error: cannot execute /usr/sbin/popper: No such file or directory Sep 5 22:18:26 monika fingerd[2618]: getpeername: Transport endpoint is not connected Sep 5 22:18:26 monika ftpd[2615]: getpeername (in.ftpd): Transport endpoint is not connected Sep 5 22:18:31 monika in.ftpd[2622]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:33 monika in.telnetd[2624]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:34 monika telnetd[2624]: ttloop: peer died: EOF Sep 5 22:18:36 monika in.fingerd[2625]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: connect from 62.225.211.70 (62.225.211.70) Sep 5 22:18:38 monika popper[2626]: error: cannot execute /usr/sbin/popper: No such file or directory When I'm not wrong, this says that someone was very interested about my router. Unfortunately there wasn't any firewall and no good protection (what was I stupid...) How can I see if he got in my system and deleted my folders? Can you say me, what signs indicate that he is already in my router. Is there a way to hide a programm from ps -axl? Thanks for any help! Max --- I'm securing my system now...

7 7

No reply since several days, need HELP!!!
by Stefan_Walther＠gehag-dsk.de 06 Sep '01

06 Sep '01

Hi folks, some days ago I wrote an email to these lists. I have a problem with getting some data through a FreeS/WAN tunnel. The first mail are coming back tells me something about strange routing. There was a fault at my side, because I had a double writing error in the IP's. I correct this in the mail from 1st september. As I wrote my first mail I get so much replies that I cannot solve them at one day, as I found time to do this. Now I cannot understand, why there is no reply anymore. I need HELP!!! A colleague of me wrote a mail yesterday to the suse-security-list. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

ssh and harden_suse
by Wagner, Uwe 06 Sep '01

06 Sep '01

Hi, I want to use OpenSSH to connect to a server on which the harden_suse script was installed. If I try 'ssh servername' the connection was refused by the server. The message is : ssh_exchange_identification. If I try to connect with ssh to another server with not installed the harden_suse script, it works. I'm using SuSE 7.1 with the OpenSSH patch. Any idea ? uwe <<Wagner, Uwe.vcf>>

2 1

RE: [suse-security] ssh and harden_suse
by Reckhard, Tobias 06 Sep '01

06 Sep '01

> Once a connection to a remote machine was established 1st time, the > identificantion > will be written to ~/.ssh/known_hosts. If the ID of a remote machine > changes, e.g. > cause someone installs it new, you'll get such messages while connecting. > > Simply remove the part in ~/.ssh/known_hosts that depends on this machine. > Note that this method of operation is less secure than if you have the option "StrictHostKeyChecking yes" set, which disables automatic addition of host keys to the known hosts files and will abort any connection attempt to a host whose key differs from the one in the known hosts files. Without StrictHostKeyChecking, you are prone to the man-in-the-middle attacks that Kurt made such a fuss about around a half a year ago. Cheers Tobias

1 0

security updates
by adm 06 Sep '01

06 Sep '01

I'm not sure if there was an announcement about this before, but do those of us using 6.2 and below no longer receive updated packages for items that are found faulty? -- aron

4 3

RE: [suse-security] ssh and harden_suse
by Appeldorn 06 Sep '01

06 Sep '01

-----Original Message----- From: Appeldorn [mailto:appeldorn@codixx.de] Sent: Thursday, September 06, 2001 9:57 AM To: Wagner, Uwe Subject: RE: [suse-security] ssh and harden_suse >I want to use OpenSSH to connect to a server on which the harden_suse script >was installed. >If I try 'ssh servername' the connection was refused by the server. The >message is : ssh_exchange_identification. >If I try to connect with ssh to another server with not installed the >harden_suse script, it works. Think not the harden script is the point, but your known_hosts file. Once a connection to a remote machine was established 1st time, the identificantion will be written to ~/.ssh/known_hosts. If the ID of a remote machine changes, e.g. cause someone installs it new, you'll get such messages while connecting. Simply remove the part in ~/.ssh/known_hosts that depends on this machine. Michael

1 0

secure-rsync-mirroring
by Daniel Quappe 06 Sep '01

06 Sep '01

hi list, today i wanted to mirror two hosts by using rsync with ssh. unfortunately this are a 6.4 and 7.1 suse-system with different rsync-version (6.4 => rsync-2.3.2-22, 7.1 => rsync-2.4.6-37). after the first mirroring (got a complete list of all relevant files, okay) the next time i executed my script i got the following error: ... receiving file list ... done unexpected EOF in read_timeout i tested some hints (--timeout=1000 etc.) but nothing has lead to success. does anyone out there know the solution? many thanks in advance, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

ssh problem
by Yuri Robbers 05 Sep '01

05 Sep '01

Hi all! I want to use OpenSSH 2.9 as shipped with SuSE 7.2 to transfer data between two servers. Such a setup has recently been discussed in this list, but in my particular situation a previously unmentioned problem arises. I have created DSA keys with ssh-keygen and copied the public keys of each machine to the other. So far, so good. But there is a complication: one of the machines is registered in my ISP's DNS records with two A records (once with a nasty name consisting of parts like the hexadecimal ip address, and once with an easier-to-remember name). So now the problem arises: I normally only use the easy-to-remember hostname: it's the one I named the machine with (not even telling it about the other one) and this is therefore also the one that ssh-keygen uses when generating the keys. Unfortunately ssh, scp and sftp resolve the IP-address to the other hostname, and fail to recognize the relevant key in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I assume there is an easy way to solve this, but I haven't found it. Can someone help me out? Kind regards, Yuri. -------------------------------------------------------------------------- Yuri Robbers phone : +31-71-527-4966 Leiden University fax : +31-71-527-4900 Institute for Theoretical Biology email : robbers(a)rulsfb.leidenuniv.nl Kaiserstraat 63 2311 GP Leiden PGP 5.0 public key available: the Netherlands Check your favourite hkp server. --------------------------------------------------------------------------

1 0

freeswan ???
by Dirk Ertl 05 Sep '01

05 Sep '01

Helo folks, some times ago a friend of my posted here a problem with freeswan what we have. In his first posting he made confound a network address and fixed it in last with petition for help. Is someone know about freeswan problems like this and give us an initial stage for a resulution? Thanks in advance Dirk >Hi folks, >I recognize a problem at my side. You meant "strange routing". Now I see >what you mean. >The IP's of the first GW on eth0 must be 192.168.200.1 and the IP on the >eth1 of the second GW must be 192.168.100.1. >Now I see my fault. The IP's on the boxes where set this way I told to you >in the sentence before. >By the way, I have a look at /var/log/messages and saw the message IPSec >SA established and tcpdump tells me that there are UDP:500-->500 packets >are going through the router (ip-proto-50). >I have an established IPSec-tunnel between 2 boxes. >I'm using SuSE7.1 Kern 2.4.7 and FreeS/WAN 1.91. The FreeS/WAN tells me that the >tunnel is established (last message in /var/log/messages). >My configuration is the following: >1st client-----1st-FreeS/WAN-gateway----ROUTER----2nd-FreeS/WAN-gateway------2nd-client > eth0--------------eth0------eth1----eth1-eth0----eth0--------eth1------eth0 > Virtuelles Internet between eth1 and eth0 ROUTER >Every box is a linux box! >The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 >The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading >The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading >The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading >The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 >Every netmask is 255.255.255.0; >If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. >Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. >After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? >THX -- Dirk Ertl networktechnican fon : +49 179/492 63 59 mailto : dirk(a)ertl-bln.de

1 0

[suse-security] Howto spread around the ext ip adress
by Stefan Knodt 05 Sep '01

05 Sep '01

Hi, since the external adress is assigned via dhcp and changes from time to time. What ist the most secure way to spread around the external ip adress to systems behind the firewall, e.g. in a masqueraded DMZ ? BTW the systems behind the firewall runs various OS. Thanks for your advice Stefan --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1