January 2002 - openSUSE Security - openSUSE Mailing Lists

2nd loopback interface for security testing on isolated systems?
by Paul Elliott 27 Jan '02

27 Jan '02

I have a single computer which I connect to the internet via dialup. I use SuSEfirewall2. I would like to test my security with nmap, satan, cops ect. The problem is it is not realistic to do the test using the loopback interface because I have decided the localhost is safe. There are a number of programs that I have told to bind there open ports to the loopback interface. This means the program allow connections from the localhost but not from the outside world. Sendmail for one: If you turn sendmail entirely off then fetchmail does not work because it delivers mail by dumping it into port 25. But I do not need sendmail to listen to the outside world because I recieve mail via fetchmail, and I do not want to worry about sendmail exploits. Same with appache SuSE's info servers work by running appache. I want to review documention but see not reason to serve the outside world or worry about new appache exploits. So I have told appache to listen by binding to the loopback interface. Also I have told SuSE firewall not to protect from the internal network, and made the loopback interface my connection to the internal network. (I told it to trust itself.) Because of all this the results of an attack thru the loopback interface would not be realistic. I have an idea! Create a 2nd loopback interface, and treat it as an untrusted interface similarly to ppp0! Then I could tell nmap, satan, ect to run its simulated attack thru this new interface! Questions: Is this a good idea? (I only have 1 computer, and cannot run a test from the outside.) How would I implement it? What would be the proper ifconfig, route commands to setup such a test interface? Would there be a large penalty for setting up such an interface and letting it run all the time, so I could do testing any time after installing any new software perhaps? -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

3 2

MD5 passwords again
by Boris Kimel 27 Jan '02

27 Jan '02

Hello All, Sorry to annoy you, but POP3 doesn't recognize MD5 passwords. All other services are ok. POP3 works perfect for the users whose passwords were not changed yet (i.e. were not converted to MD5). Why should I want MD5 passwords? That's simple: we had a RedHat system using MD5 passwords and (i) we'd like to transfer all the users with their passwords to SuSE; (ii) the existing passwords are longer than 8 characters. Looks like I need further reading on the PAM, but maybe there's a proven approach? Thanks, -- Boris Kimel Webmaster and Network Administrator The Moscow Chemical Lyceum 4 Tamozhennyi Proezd Moscow, Russia. Phone: +7 095 1358941 Fax: +7 095 1355328 Email: kimel(a)1303.ru

6 8

Re: [suse-security] apache under inetd/tcpd: it's dead, isn't it?
by JW 27 Jan '02

27 Jan '02

At 08:39 PM 1/26/2002 -0600, you wrote: >Good point, but actually he needs to hange "htppd" to "http" for standard /etc/services. That might be why his way isn't working. err, s/hange "htppd"/change "httpd"/g Sorry ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

bug in SuSE Security Announcement: rsync (SuSE-SA:2002:004)???
by Carsten Mueller 27 Jan '02

27 Jan '02

hello! i´ve just installed the rsync update on a i386 suse 7.0 box. now i get the following error while using rsync: rsync -az -e ssh data.cdb 10.0.0.5:/service/tinydns/root/data.cdb Segmentation fault server-6:/service/tinydns/root # unexpected EOF in read_timeout unexpected EOF in read_timeout when i use rsync without the z flag i get the following error: rsync -a -e ssh data.cdb 10.0.0.5:/service/tinydns/root/data.cdb Warning: unexpected read size of 0 in map_ptr Warning: unexpected read size of 0 in map_ptr i think it is not an ssh-error, cause normal ssh connection to the remote box works fine: ssh 10.0.0.5 Last login: Tue Jan 8 21:14:16 2002 from xxxxxxxxxxxxxx Have a lot of fun... ssh-version local: OpenSSH_3.0.2p1, SSH protocols 1.5/2.0, OpenSSL 0x0090581f rsync-version local: rsync version 2.3.2 protocol version 21 rsync-version remote: rsync version 2.4.6 protocol version 24 what´s the problem? regards Carsten Mueller At 17:04 25.01.2002, Sebastian Krahmer wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >______________________________________________________________________________ > > SuSE Security Announcement > > Package: rsync > Announcement-ID: SuSE-SA:2002:004 > Date: Fri Jan 25 17:00:00 CET 2002 > Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 > Vulnerability Type: remote command executionn > Severity (1-10): 7 > SuSE default package: no > Other affected systems: All systems with vulnerable rsync. > > Content of this advisory: > 1) security vulnerability resolved: rsync negative array indexing > problem description, discussion, solution and upgrade information > 2) pending vulnerabilities, solutions, workarounds > 3) standard appendix (further information) > >______________________________________________________________________________ > >1) problem description, brief discussion, solution, upgrade information > > The rsync program allows users and administrators to synchronize > files and > whole directory structures on different machines. It is common practise > to allow remote users to mirror ftp servers via anonymous rsync access. > There exist several signedness bugs within the rsync program which allow > remote attackers to write 0-bytes to almost arbitrary stack-locations, > therefore being able to control the programflow and obtaining a shell > remotely. These bugs have been fixed. > > It is recommended (also stated in the rsync documentation) to use the > "use chroot" option in rsyncd's configuration file (/etc/rsyncd.conf) > to limit the impact of a possible attack. Since this workaround does > not completely solve the security problem, we recommend to update the > package as described below. > > We want to express our gratitude to Andrew Tridgell and Martin Pool, > the rsync authors and maintainers, for their excellent cooperation in > this matter. > > Please download the update package for your distribution and verify its > integrity by the methods listed in section 3) of this announcement. > Then, install the package using the command "rpm -Fhv file.rpm" to apply > the update. > > To be sure that the update takes effect, kill any existing instances of > the rsync-program. > In case you run rsync via the inetd superserver, you do not need to > restart any of your services. Inetd will automatically use the new > binary. > If you used run your rsync-service with the "rsync --daemon" command, > restart your rsync with "rync --daemon" again, this time using the new > binary. > > > i386 Intel Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/i386/update/7.3/n2/rsync-2.4.6-288.i386.rpm > ce6d9226a8a9a5644ece29926c1f51d7 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/rsync-2.4.6-288.src.rpm > 0e354408f232b25fe0089b97073009a3 > > SuSE-7.2 > ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/rsync-2.4.6-289.i386.rpm > 1ff42b8149e21644d23fe71c40a3ec5a > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/rsync-2.4.6-289.src.rpm > 83407b4dfad94d21af60ba3e8025e6cd > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/rsync-2.4.6-288.i386.rpm > 26533f97af4474b450ad43a171c5571f > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/rsync-2.4.6-288.src.rpm > dcd1345446871320962e91d979ddb25b > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/rsync-2.3.2-124.i386.rpm > f16f81e5a0a11ba951b6f923cbae2abd > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/rsync-2.3.2-124.src.rpm > cd36ce735b4ca91f92fc2f3c7603037f > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/rsync-2.3.2-123.i386.rpm > c9330c9123757f89ed94382874122c82 > source rpm: > ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/rsync-2.3.2-123.src.rpm > d97478d6fe9f2419b8700c52be4d888a > > > Sparc Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n2/rsync-2.4.6-135.sparc.rpm > 669f52233aed0766dd72788741691558 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/rsync-2.4.6-135.src.rpm > 85ddaa9518d19f6341a68ce254668f0b > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/rsync-2.4.6-135.sparc.rpm > d68ebcdba8caa16360e225fc9d28dc54 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/rsync-2.4.6-135.src.rpm > b9f1f43d0248b763aef46bd610233285 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/rsync-2.3.2-5.sparc.rpm > 50b9cefa5f4bf86fc1e20184c15fb542 > source rpm: > ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/rsync-2.3.2-5.src.rpm > ffbc3ff43c339cbbe12317bb98587df3 > > > AXP Alpha Platform: > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/rsync-2.4.6-123.alpha.rpm > 3b602bd23179a7b6ce162d2d377394af > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/rsync-2.4.6-123.src.rpm > 65f9d53cb48b8456466a27d9cde04339 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/rsync-2.3.2-30.alpha.rpm > 2056422feb3b2b53285413ca746f2f4e > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/rsync-2.3.2-30.src.rpm > 88c3a630df0e3073a8be55b0008371a0 > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/rsync-2.3.2-31.alpha.rpm > 18ea59b5c4d4641b62cef9c11f535ae8 > source rpm: > ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/rsync-2.3.2-31.src.rpm > 091659d90d3e079c0f8d4518c2c42f9f > > Power PC Platform: > > SuSE-7.3 > ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n2/rsync-2.4.6-150.ppc.rpm > f5576fca06f5d22b1410aaba399e0791 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/rsync-2.4.6-150.src.rpm > 1baeeffafe1c7dd75189cbfe704bddf0 > > SuSE-7.1 > ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/rsync-2.4.6-151.ppc.rpm > 04102efb5a83b5190fe6b02146ec522b > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/rsync-2.4.6-151.src.rpm > 4a21e9f5b36f6767436c6ea92f5d17e7 > > SuSE-7.0 > ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/rsync-2.3.2-133.ppc.rpm > 897e0010ccf09c85a8c8797dc77394e1 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/rsync-2.3.2-133.src.rpm > 7ff150ba5f39ab527aa67308154273e2 > > SuSE-6.4 > ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/rsync-2.3.2-133.ppc.rpm > 65ac31f12bacb9284fd2286aec7beab0 > source rpm: > ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/rsync-2.3.2-133.src.rpm > 4b43552a939f080a3e93fe65a88bd139 > > > >______________________________________________________________________________ > >2) Pending vulnerabilities in SuSE Distributions and Workarounds: > > - pine > The popular mail client "pine" was found vulnerable to an attack where > shell metacharacters inside an URL could be used to execute arbitrary > commands if pine passes the URL to an external viewer on the > commandline. The pine packages on SuSE products are not vulnerable to > this weakness because they contain a patch that works around this > problem since it is not new. > > > - xchat > We are working on updates for the xchat packages in the SuSE Linux > 7.0 and 7.1 distributions that are vulnerable to an encoding bug > while receiving and decoding ctcp datagrams. This bug can lead > an xchat IRC client to execute IRC protocol specific commands to an > IRC server such as channel mode changes. > >______________________________________________________________________________ > >3) standard appendix: authenticity verification, additional information > > - Package authenticity verification: > > SuSE update packages are available on many mirror ftp servers all over > the world. While this service is being considered valuable and important > to the free and open source software community, many users wish to be > sure about the origin of the package and its content before installing > the package. There are two verification methods that can be used > independently from each other to prove the authenticity of a downloaded > file or rpm package: > 1) md5sums as provided in the (cryptographically signed) announcement. > 2) using the internal gpg signatures of the rpm package. > > 1) execute the command > md5sum <name-of-the-file.rpm> > after you downloaded the file from a SuSE ftp server or its mirrors. > Then, compare the resulting md5sum with the one that is listed in the > announcement. Since the announcement containing the checksums is > cryptographically signed (usually using the key security(a)suse.de) > the checksums show proof of the authenticity of the package. > We disrecommend to subscribe to security lists which cause the > email message containing the announcement to be modified so that > the signature does not match after transport through the mailing > list software. > Downsides: You must be able to verify the authenticity of the > announcement in the first place. If RPM packages are being rebuilt > and a new version of a package is published on the ftp server, all > md5 sums for the files are useless. > > 2) rpm package signatures provide an easy way to verify the authenticity > of an rpm package. Use the command > rpm -v --checksig <file.rpm> > to verify the signature of the package, where <file.rpm> is the > filename of the rpm package that you have downloaded. Of course, > package authenticity verification can only target an uninstalled rpm > package file. > Prerequisites: > a) gpg is installed > b) The package is signed using a certain key. The public part of this > key must be installed by the gpg program in the directory > ~/.gnupg/ under the user's home directory who performs the > signature verification (usually root). You can import the key > that is used by SuSE in rpm packages for SuSE Linux by saving > this announcement to a file ("announcement.txt") and > running the command (do "su -" to be root): > gpg --batch; gpg < announcement.txt | gpg --import > SuSE Linux distributions version 7.1 and thereafter install the > key "build(a)suse.de" upon installation or upgrade, provided that > the package gpg is installed. The file containing the public key > is placed at the toplevel directory of the first CD (pubring.gpg) > and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . > > > - SuSE runs two security mailing lists to which any interested party may > subscribe: > > suse-security(a)suse.com > - general/linux/SuSE security discussion. > All SuSE security announcements are sent to this list. > To subscribe, send an email to > <suse-security-subscribe(a)suse.com>. > > suse-security-announce(a)suse.com > - SuSE's announce-only mailing list. > Only SuSE's security annoucements are sent to this list. > To subscribe, send an email to > <suse-security-announce-subscribe(a)suse.com>. > > For general information or the frequently asked questions (faq) > send mail to: > <suse-security-info(a)suse.com> or > <suse-security-faq(a)suse.com> respectively. > > ===================================================================== > SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. > The <security(a)suse.de> public key is listed below. > ===================================================================== >______________________________________________________________________________ > > The information in this advisory may be distributed or reproduced, > provided that the advisory is not modified in any way. In particular, > it is desired that the cleartext signature shows proof of the > authenticity of the text. > SuSE GmbH makes no warranties of any kind whatsoever with respect > to the information contained in this security advisory. > >Type Bits/KeyID Date User ID >pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> >pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> > >- -----BEGIN PGP PUBLIC KEY BLOCK----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: For info see http://www.gnupg.org > >mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA >BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz >JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh >1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U >P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ >cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg >VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b >yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 >tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ >xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 >Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo >choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI >BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u >v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ >x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 >Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq >MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 >saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o >L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU >F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS >FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW >tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It >Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF >AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ >3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk >YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP >+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR >8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U >8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S >cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh >ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB >UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo >AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n >KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc >BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s >AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ >EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe >OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf >iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI >SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g >TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p >QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y >PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX >SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT >mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ >EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD >qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe >RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst >Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 >ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp >C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq >UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG >x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M >9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq >PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb >BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 >=ojbD >- -----END PGP PUBLIC KEY BLOCK----- > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3i >Charset: noconv > >iQEVAwUBPFF+6ney5gA9JdPZAQEjBwf7B2B8w1lFpiL8bgy3ttUzNRTFIRnre7yq >QLcn8XdhF1iSvtDpgiajVsutYrRbEeVImcAWmXeLOIZMY/qwc4uLBwxrF2ng0Uph >QhAebyewpFtMmIQrb/7AAOcudpgbHWsSRJYacbqYutQvJJ73vuFh+HOjErFoFx8p >ZqtVC5IvOuE+HomaS/WBPjBdvIDrHSUaJq+fFFTYKozAEg/PpM++vePI5xauaEoP >t6Wvazswwe1Qlx2rV2NvE/4TLFyxL2fHEQTtEIdSsa6za7WXmC2QqIhv4Y5zdckA >8CpPFJ0M/nTzmEf40i67myIGtOVgjb5MWaOv2ybya9ORPIHScdZxSQ== >=8z44 >-----END PGP SIGNATURE----- > >-- >~ >~ perl self.pl >~ $_='print"\$_=\47$_\47;eval"';eval >~ krahmer(a)suse.de - SuSE Security Team >~ > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

3 6

apache under inetd/tcpd: it's dead, isn't it?
by m3047＠inwa.net 27 Jan '02

27 Jan '02

Not looking for a list of reasons why this isn't a good idea, just simply: is anybody out there successfully running apache httpd 1.3.12 or later under SuSE linux 6.4 or later inetd/tcdp? Being a troglodyte, I had to try it; I couldn't get it to work (nobody home on port 80), and didn't spot anything in various logs. The things I set were: /etc/rc.config: START_HTTPD=no httpd.config: ServerType inetd /etc/inetd.conf: httpd stream tcp nowait root <path to tcpd> (continued line) <path to apache> -f <path to httpd.conf> (continued line) <standard modules> (I also tried wwwrun instead of user root, and without tcpd.) Oh well, on to more productive things. -- Fred Morris m3047(a)inwa.net

3 3

Re: [suse-security] PHP-Majordomo to execute commands on demand?
by Leonel Rivas 27 Jan '02

27 Jan '02

Whoa Greg, that sounds very interesting, can you give ,me some more details? Thanks Leo --- Gregor Bruhin <gregor.bruhin(a)bluewin.ch> wrote: > Hi, > > Know I know a bit more, I can give you other ideas > perhaps :-) > > 1) > > I did the following thing @home for my "intranet" & > linux-internet-gateway > > I setup a tiny webserver which runs as root :-( ( I > know very bad idea but > there is no other solution i think ! ) > With a few scripts it will do all I want (lanch > internet connection, map > drives, launch services, etc.) > > -> know you can secure this > add a script to you main server which will put a > "1" in a file somewhere > when it is launched and replace the 1 with a 0 after > 5 sec > in the tiny webserver you just add acheck, check > if the 1 is present in > the file otherwise you don't reply > the tiny server must be run on a strange port > and REALY do nothing if > there is not a 1 in the file > (result, many conditions must be met, difficult > for a hacker, but also > for you because you have many chances to make > mistakes. Summary: you have to > access first you normal webserver and execute your > special script, then you > have 5 secs to connect to your tiny root webserver > and autentificate) > > > > 2) > > - setup a new special user with complicated name & > password > - setup a chrooted env. for this user > - setup ssh access on a very special port (high > port, unused by trojans, and > not scanned by default by nmap etc.) limit login to > the created user (be > sure to check all sshd security options) > - do not use a normal shell for this user but rather > a home-made interpreter > which will only write a few things in a text file in > a chrooted jail > - write a script which will get data from this text > file and do some actions > (this script will be executed every 5 min. by cron > for ex.) > > it's just an idea like an other ... > > > OTHERS) > > This won't sove all your problems but can help. > > I don'tknow which services you plan to use but try > to limit allowed IP's, > limit allowed users, use unusual ports. > Disable icmp replys, configure a local firewall to > slow down scanners. > Hide or fake the banners of the daemons if possible. > Update your system as often as possible. > Install tripwire, scanlogd, chkrootkit etc. > Make Ba ba backups :-) ... > > have fun :-) > > Greg > > > ----- Original Message ----- > From: "Leonel Rivas" <leorivas(a)yahoo.com> > To: <suse-security(a)suse.com> > Sent: Saturday, January 26, 2002 7:24 PM > Subject: Re: [suse-security] PHP-Majordomo to > execute commands on demand? > > > > I've done so: leave ssh running , and after > logging, > > run the inetd to have other services, then, i stop > it > > before leaving. BUT, checking the messages file, a > > have already found some ssh scans (it tells DONT > > PANIC, and dunno what it means), so i decided to > close > > the most srevices and run them as needed... is ssh > (on > > suse 7.2) safe enough? > > Thanks for the help, im not so new on linux, but > new > > on security issues. > > Leo > > > > > > --- Andrea Naggi <mailing-lists(a)naggi.it> wrote: > > > You could actually leave SSH running all the > > time > > > and from there you can > > > start or stop services as needed... SSH should > > be > > > safe enough... > > > Anyway the idea is good and should be possible > > to > > > realize it with ssl and an > > > apposite php/perl page on your webserver. > > ENGARDE > > > linux uses a page like > > > that written in perl and running under ssl > > > encryption to control all the > > > system services and even the shutdown or rebbot > > of > > > the server. > > > Regards > > > Andrea Naggi > > > > > > ----- Original Message ----- > > > From: "Leonel Rivas" <leorivas(a)yahoo.com> > > > To: <suse-security(a)suse.com> > > > Sent: Saturday, January 26, 2002 4:19 PM > > > Subject: [suse-security] PHP-Majordomo to > > execute > > > commands on demand? > > > > > > > > > > Hi everybody > > > > > > > > Im trying to improve security by making the > > > minimal > > > > services to run on a 7.2 server, now, my > > question > > > is > > > > how to make services run and stop on demand, > > like > > > ssh > > > > or inetd. Is possible to make.. say a web page > > > under > > > > ssl to launch and stop such services? or maybe > > a > > > > majordomo mail with the apropriate password? > > the > > > idea > > > > is to have ONLY apache and sendmail running > > all > > > the > > > > time, nothing more, then, run ftpd or ssh as > > > needed, > > > > then stop it. > > > > Thanks > > > > > > > > > > __________________________________________________ > > > > Do You Yahoo!? > > > > Great stuff seeking new owners in Yahoo! > > Auctions! > > > > http://auctions.yahoo.com > > > > > > > > -- > > > > To unsubscribe, e-mail: > > > suse-security-unsubscribe(a)suse.com > > > > For additional commands, e-mail: > > > suse-security-help(a)suse.com > > > > > > > > > > > > > > > > > > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Great stuff seeking new owners in Yahoo! Auctions! > > http://auctions.yahoo.com > > > > -- > > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > suse-security-help(a)suse.com > > > > > __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

1 0

Re: Fwd: Can I create/activate a 2nd loopback device?
by Paul Elliott 26 Jan '02

26 Jan '02

> > How do I -- is it possible to create or activate a second loop device? > > What would be the commands do do this? > I have done some research, and I believe I have the answer to my own question. First I do not want to use IP aliasesing. That means more than one IP number for the same loop back 'device'. I believe data going into one alias would be available to be read at both on the other 'end'. Programs bound to one alias would recieve connections from both. Clearly that is not what I want. However I believe it is possible to patch the kernel to create more that one actual loopback 'device'. I believe a patch has already been published to do this: http://www.uwsg.iu.edu/hypermail/linux/kernel/9509/0204.html I believe that if I install this patch I will get 2 seperate loopback 'devices' one of which can be used for security testing. Please tell me if I have gotten all this correctly? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

1 0

Re: [suse-security] PHP-Majordomo to execute commands on demand?
by Leonel Rivas 26 Jan '02

26 Jan '02

I've done so: leave ssh running , and after logging, run the inetd to have other services, then, i stop it before leaving. BUT, checking the messages file, a have already found some ssh scans (it tells DONT PANIC, and dunno what it means), so i decided to close the most srevices and run them as needed... is ssh (on suse 7.2) safe enough? Thanks for the help, im not so new on linux, but new on security issues. Leo --- Andrea Naggi <mailing-lists(a)naggi.it> wrote: > You could actually leave SSH running all the time > and from there you can > start or stop services as needed... SSH should be > safe enough... > Anyway the idea is good and should be possible to > realize it with ssl and an > apposite php/perl page on your webserver. ENGARDE > linux uses a page like > that written in perl and running under ssl > encryption to control all the > system services and even the shutdown or rebbot of > the server. > Regards > Andrea Naggi > > ----- Original Message ----- > From: "Leonel Rivas" <leorivas(a)yahoo.com> > To: <suse-security(a)suse.com> > Sent: Saturday, January 26, 2002 4:19 PM > Subject: [suse-security] PHP-Majordomo to execute > commands on demand? > > > > Hi everybody > > > > Im trying to improve security by making the > minimal > > services to run on a 7.2 server, now, my question > is > > how to make services run and stop on demand, like > ssh > > or inetd. Is possible to make.. say a web page > under > > ssl to launch and stop such services? or maybe a > > majordomo mail with the apropriate password? the > idea > > is to have ONLY apache and sendmail running all > the > > time, nothing more, then, run ftpd or ssh as > needed, > > then stop it. > > Thanks > > > > __________________________________________________ > > Do You Yahoo!? > > Great stuff seeking new owners in Yahoo! Auctions! > > http://auctions.yahoo.com > > > > -- > > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > suse-security-help(a)suse.com > > > > > > > > __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

1 0

shaping problem
by Jochen Vogel 26 Jan '02

26 Jan '02

hi, i would try to limit my upload queue and get the following error: tc qdisc add dev ppp0 root tbf rate 100kbit latency 50ms burst 1500 RTNETLINK answers: Invalid argument what´s wrong?? thanx for help

1 0

Re: [suse-security] Which ISP owns some IP?
by Shirley Louise Coffie 26 Jan '02

26 Jan '02

SamSpade is good, but I'd go straight to http://www.arin.net/ myself. ShirZ >From: John Andersen <jsa(a)pen.homeip.net> >Reply-To: jsa(a)pen.homeip.net >To: "Juan Carlos S.C" <juancarlos.silla(a)dyr.es>, lista seguridad suse ><suse-security(a)suse.com> >Subject: Re: [suse-security] Which ISP owns some IP? >Date: Fri, 25 Jan 2002 01:18:04 -0900 > >On Friday 25 January 2002 02:04 am, Juan Carlos S.C wrote: > > Hello * : > > > > How can i know the owner of an IP address. There is no reverse mapping > > for dial-up address but each ISP has his own range of IP's. > > > > Could I know from where connecctions come, far away from traceroute? > > Yes, it could be IP spoofing but ... > >Quick and easy: http://www.samspade.org/ > >I'm sure there are more high-tec ways but it works and does a lot >with one click. >-- >_________________________________ >John Andersen / Juneau Alaska > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > "And the day came when the risk to remain in the bud was more painful than the risk it took to bloom." - Anaïs Nin _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

2 1