January 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 & mysql
by Karsten Schell 24 Jan '02

24 Jan '02

and now in English, sorry! Since I am running mysqld on my server the port 3306 is open though its not inlcuded in EXTERNAL_TCP services services I allow: FW_SERVICES_EXT_TCP="ssh smtp www pop3 https domain" any clue why this port is open ?

3 2

secure way of rsyncing ?
by Jens Georg 24 Jan '02

24 Jan '02

hello, i have to keep three servers uptodate and i would like to do this using rsync. as far as i know there are several security concerns about rsync, so is there another tool available that can do this for me ? btw ... i am using sftp to encrypt my ftp-session ? maybe there's a similiar tool for rsync available, too ? regards, jens --------------------------------------------------------------------------- instant networks - netzwerkmanagment & internetfullservices

3 2

iptables-save bug with tcp-reset ?
by Karsten Schell 24 Jan '02

24 Jan '02

Hi people! I am using Susefirewall2. In the customary rules I added the 2 lines iptables -A input_ext -j LOG -p tcp --dport 113 iptables -A input_ext -j REJECT -p tcp --reject-with tcp-reset --dport 113 to secure the identd port. When I check the rules with SuSEfirewall2 status i looks alright: 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02 reject-with tcp-reset but with iptables-save|more I find -A input_dmz -p tcp -m tcp --dport 113 --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with reject-with ^^^^^^^^^^^^^^^^^^^^^^here You see that tcp-reset is replaced by reject-with Since this rule seems to be working alright ,is this a bug in iptables-save ??? here the interesting part. fw_custom_before_port_handling() { # could also be named "after_antispoofing()" # these rules will be loaded after the anti-spoofing and icmp handling # but before any IP protocol or TCP/UDP port allow/protection rules # will be set. # You can use this hook to allow/deny certain IP protocols or TCP/UDP # ports before the SuSEfirewall2 generated rules are hit. #example: always filter backorifice/netbus trojan connect requests and log them. iptables -A input_ext -j LOG -p tcp --dport 113 iptables -A input_ext -j REJECT -p tcp --reject-with tcp-reset --dport 113 for target in LOG DROP; do for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do iptables -A $chain -j $target -p tcp --dport 31337 iptables -A $chain -j $target -p udp --dport 31337 iptables -A $chain -j $target -p tcp --dport 12345:12346 iptables -A $chain -j $target -p udp --dport 12345:12346 done done true }

1 0

SuSEfirewall 5.1 and open ports
by Togan Muftuoglu 24 Jan '02

24 Jan '02

Hi, While going over the last things for the DMZ server I found a part which I do not understand there copule of hardcoded areas like line 841 in SuSEFirewall 5.1 I have only enabled www and https and allowed ping for external and for trusted IP I have enbaled ssh. Why these hardcoded line are necessary I do not understand. if it was 1024:65535 it would have made more sense to me, as these are safer (relative to 600:65534). # This sucks, we need this rule so we can receive data ... hello stealth scan for i in $DEV_INT $DEV_DMZ $DEV_WORLD; do $IPCHAINS -A input -j "$ACCEPT" -p tcp -d $i 600:65535 '!' -y $LAA done and here why ftp-data port is hard coded for i in $DEV_INT $DEV_DMZ $DEV_WORLD; do $IPCHAINS -A input -j "$ACCEPT" -p tcp -d $i 20 '!' -y $LAA done I know I can change these entries but rather then doing them blindly I would like understand the reasoning Thanks -- Togan Muftuoglu

1 0

spam - acting as a relay
by Delia Wakelin 24 Jan '02

24 Jan '02

I have recently been informed that my machine is relaying spam.Need some help to identify the problem. I have had sendmail switched off on a suse 7.3 machine. here is the gist of the problem - my machine aaa.bbb.cc.dd. It seems they are using wwwrun - does that mean it is via php? Where and how should I block this ---> *******************************************************Since your system relays/originates SPAM, we are blocking all mail from it. (wwwrun(a)psych.unn.ac.uk [aaa.bbb.cc.dd]) When appropriate measures are implemented please inform postmaster(a)uottawa.ca and the block will be removed. Postmaster ******************************************************* Return-Path: <424848(a)bn.com.br> Received: from bn.com.br (wwwrun(a)zzz.yyy.ac.uk [aaa.bbb.cc.dd]) by UOttawa.CA (8.9.1/8.9.1) with SMTP id NAA192930 for Tue, 22 Jan 2002 13:13:31 -0500 Date: Tue, 22 Jan 2002 13:13:31 -0500 From: 424848(a)bn.com.br Reply-To: <424848(a)bn.com.br> Message-ID: <002a84a53bee$8847c4d2$7dc15ac6@mhrsyg> To: Smart.Investors Subject: What's next for the stock market? MiME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 =============================================================== '''''' ==================== This email advertisement is sent out to those who subscribed on our web site or one of our many affiliated web sites. If you received this email in error or you would like to opt-out from our database, please go to the following: mailto:mayblater@ozemail.com.au [2669gYQK6-198CUmg0349yrLD6-700VpH@31] -------< -- Dr. Delia Wakelin Tel: 44 (0) 191 227 4958 Division of Psychology email mailto:d.wakelin@unn.ac.uk University of Northumbria www http://www.unn.ac.uk/~evdw3 Newcastle upon Tyne NE1 8ST

6 5

does it mean my system was hacked
by sambit 24 Jan '02

24 Jan '02

Hi my system is connected to network by DSL i do not know some time i found lot of activity in my system and when i checked the system each time i found this process sambit@linux:~ > ps -ef | grep find nobody 6612 6610 0 00:15 ? 00:00:00 su nobody -c /usr/bin/find / $ -fstype nfs -o -fstype NFS -o -fstype proc -o -fstype afs -o -fstype smbfs -o -fstype autofs -o -type d -regex '\(^/S.u.S.E.$$\|$^/mnt$$\|$^/cdrom$$\|$^/tmp$$\|$^/usr/tmp$$\|$^/var/tmp$$\|$^/var/spool$$\|$^/proc$$' \) -prune -o -print root 6613 6590 0 00:15 ? 00:00:00 /usr/lib/find/frcode nobody 6614 6612 7 00:15 ? 00:00:09 /usr/bin/find / ( -fstype nfs -o -fstype NFS -o -fstype proc -o -fstype afs -o -fstype smbfs -o -fstype autofs -o -type d -regex $^/S.u.S.E.$$\|$^/mnt$$\|$^/cdrom$$\|$^/tmp$$\|$^/usr/tmp$$\|$^/var/tmp$$\|$^/var/spool$$\|$^/proc$$ ) -prune -o -pri i checked my DSL Router log files also i found some information like this 01/23/2002 08:20:52 Unrecognized access from 211.219.231.67:2016 to TCP port 27374 01/23/2002 08:44:12 Unrecognized access from 64.231.9.185:3683 to TCP port 1080 01/23/2002 08:44:14 Unrecognized access from 64.231.9.185:3683 to TCP port 1080 01/23/2002 11:07:09 Unrecognized access from 61.79.232.158:3119 to TCP port 27374 01/23/2002 11:07:12 Unrecognized access from 61.79.232.158:3119 to TCP port 27374 01/23/2002 11:07:18 Unrecognized access from 61.79.232.158:3119 to TCP port 27374 What does it mean , each some one hackingmy system, if yes to what should i do. ..

3 2

RE: [suse-security] was: spam - acting as a relay
by Yarrel 24 Jan '02

24 Jan '02

-----Original Message----- From: Thorsten Marquardt [mailto:thom@kaupp.chemie.uni-oldenburg.de] Sent: 24. januar 2002 13:58 To: suse-security(a)suse.com Subject: [suse-security] was: spam - acting as a relay [snipped] I know of systems (like ordb) which helps to block mail from open relays. Are there a similar systems to block mail from spam-sources? Thanks Thom Hi Thom! Quite a few DNSBLs are available. As I don´t have any links here at work. I suggest you goto: http://relays.osirusoft.com they sport an exccelnt blocklist, with pickups from various other lists. Furthermore, if you go here: http://relays.osirusoft.com/cgi-bin/rbcheck.cgi tst an IP..you´ll get a rather list of dufferent BL´s. Hope that helps. /Yarrel -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 1

was: spam - acting as a relay
by Thorsten Marquardt 24 Jan '02

24 Jan '02

Hi, Delia wrote: > *******************************************************Since your system > relays/originates SPAM, we are > blocking all mail from it. (wwwrun(a)psych.unn.ac.uk [aaa.bbb.cc.dd]) > When appropriate measures are implemented please > inform postmaster(a)uottawa.ca and the block > will be removed. > Postmaster > ******************************************************* I know of systems (like ordb) which helps to block mail from open relays. Are there a similar systems to block mail from spam-sources? Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

RE: [suse-security] Restricting rsync to ssh only
by Reckhard, Tobias 24 Jan '02

24 Jan '02

> rsync will launch ssh and execute rsync --server on the remote side. Is it just me or is that option undocumented in the man page (package: SuSE 7.3, rsync-2.4.6-153)? Cheers Tobias

2 1

AW: [suse-security] probs with ftp-masquerading
by OKDesign oHG Security Administrator 23 Jan '02

23 Jan '02

Hi, does someone know how this redirecting is done ? I tried out with iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 20:21 -j REDIRECT --to-post 3128 but this doesn't work. Since that I can't even connect to a ftp-server anymore :-( How exactly must this be done ? Thanks in advance Stephan -----Ursprüngliche Nachricht----- Von: Alberto Tarantino [mailto:alberto.tarantino@archidata.it] Gesendet: Dienstag, 22. Januar 2002 09:18 An: OKDesign oHG Security Administrator Betreff: Re: [suse-security] probs with ftp-masquerading Hi there, I know it might sound like a "dirty trick".. but.. why don't you use port redirection and Squid as FTP proxy? That might improve security as well as be a very easy ti implement solution. Bye A.T. ----- Original Message ----- From: "OKDesign oHG Security Administrator" <security(a)okdesign.de> To: <suse-security(a)suse.com> Sent: Tuesday, January 22, 2002 8:24 AM Subject: RE: [suse-security] probs with ftp-masquerading > Okay, > > I've now learned a lot of security-wisdom and that the SuSE-firewall 2 is a > damned good tool (something I already knew). > But my problem is still unsolved. For any reasons ftp-masquerading doesn't > work. > I tried what Ralf recommended, but the two iptables-commands didn't have any > result (okay, maybe they had, but they didn't enable ftp-masquerading). > I also looked for the modules ip_conntrack_ftp and ip_nat_ftp as GertJan > told me. I had no luck to find the first one anywhere on my system although > the FW-Packe is installed. The second one is there and I did an insmod, but > this also didn't solve the problem. > Ah yes, Lars pointed me to an error I made. Of course I didn't install my > system from the crab, but from the scratch. Funny to image a crab with > SuSE-Linux tied on the back :-) > To Roman: Of course you are right, but as I already mentioned, I have to > live with DAUs in my LAN, and it's hard enough to have my phone actually > ringing like hell because this damn ftp doesn't work. By now I only answer > "I'm working on it and I'll send a message to all users when it's working > again..."; but to imagine to have to explain all users what FTP-passive-mode > is and how and why it must be used, is as hard as to imagine that my > mother-in-law is going to stay for more than one week (one week is bad > enough, but more will ruin my nerves *sigh*). I really don't know which one > I would prefer if I had only these two choices... > > Anyway, could someone help me in solving my problem ? I'm sure out there on > this list are lots of iptables-freaks knowing nearly all tricks one can do > with it and it should be no big problem for them to find out how to enable > this ftp-masquerading. > > Thanks in advance > > Stephan > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

3 4