January 2002 - openSUSE Security - openSUSE Mailing Lists

lkm trojan...
by EXTERN Schumacher Markus (Intern; AB/EBE) 14 Jan '02

14 Jan '02

Hi I found a possible lkm - trojan on my system ! How can I get rid of this ? I detected it with chkrootkit. The infected file was ifconfig. I already replaced it and the file is no longer indicated as "INFECTED" But at the end of chkrootkit the lkm - warning still appears! Can anyone help me with this ? thankx Markus ________________________________________________________________________ Markus Schumacher BOSCH Intern 38000 Hills Tech Drive Farmington Hills, MI 48331 Department: AB/EBE2 Automotive Headquarter US Body Electronics Software *: markus.schumacher(a)us.bosch.com *: +1 (248) 848 2381 *: +1 (248) 553 1480 ______________________________________________________________

2 1

3x NIC
by Omppu 14 Jan '02

14 Jan '02

Hello I thought of inform/enquire on the following, i installed suse 7.3 with three network cards such as eth0 192.168.0.2 netmask 255.255.255.240 gateway 192.168.0.1 eth1 192.168.0.129 netmask 255.255.255.192 eth2 192.168.0.193 netmask 255.255.255.192 now after i installed the system i noticed that for some reason suse configures eth1 with a default route in /etc/route.conf ---snip-- FW:~ # route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.0.0 * 255.255.255.240 U 0 0 0 eth0 192.168.0.0 * 255.255.255.240 U 0 0 0 eth1 192.168.0.192 * 255.255.255.192 U 0 0 0 eth2 192.168.0.128 * 255.255.255.192 U 0 0 0 eth1 default 193.64.53.1 0.0.0.0 UG 0 0 0 eth0 ----snip--- so naturally first what i did to verify the case in added the following route, ----snip--- route add -net 192.168.0.0 netmask 255.255.255.240 dev eth0 ----snip--- and got the following ----snip--- FW:~ # route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.0.0 * 255.255.255.240 U 0 0 0 eth0 192.168.0.0 * 255.255.255.240 U 0 0 0 eth0 192.168.0.0 * 255.255.255.240 U 0 0 0 eth1 192.168.0.192 * 255.255.255.192 U 0 0 0 eth2 192.168.0.128 * 255.255.255.192 U 0 0 0 eth1 default 193.64.53.1 0.0.0.0 UG 0 0 0 eth0 ----snip--- after i added the route, i was able to access ip addresses that belong to the subnet which is in between my linux box and the router, when i noticed that for some reason eth1 was responding instead of my default eth0 to tracerouting and pinging, i looked int /etc/route.conf and found that the configuration reffered to eth1 instead of eth0, i corrected that rebooted the system (ok i could have done rcroute restart) and i didnt have that routing problem anymore, my question is, why does suse configure route.conf with eth1 instead of eth0 since its the default route with access to the gateway?? my second question is where and to which file can i add command syntaxes to be executed upon the startup of the system and before the firewall script is run? whats in question is if i decide to add virtual interfaces such as ifconfig eth2:0 172.16.0.1 netmask 255.255.0.0 up ifconfig eth2:1 10.0.0.1 netmask 255.0.0.0 up ifconfig eth2:2 192.168.1.0 netmask 255.255.255.0 up where do i add these syntaxes??(other than in rc.config?) eagerly waitting for enthusiastic replies ;) regards O.

1 0

seccheck question
by sigismund 14 Jan '02

14 Jan '02

Hi, last 12.01.02 at 4am someone was trying to activate the port 22 (sshd). the auth.log is not reporting any successfull login. today the seccheck script give me the same output on two different machines The following program executables are group/world writeable: - drwx------ 13 root root 748 Fri Jan 04 02:05:33 2002 . + drwx------ 13 root root 748 Mon Jan 07 20:31:38 2002 . The following devices were added: crw------- root root 12, 5 /dev/tpqic24 crw-rw-rw- root root 5, 0 /dev/tty crw--w--w- root root 4, 0 /dev/tty0 - crw--w---- root tty 4, 1 /dev/tty1 + crw-rw---- root tty 4, 1 /dev/tty1 crw--w---- root tty 4, 10 /dev/tty10 crw--w---- root tty 4, 11 /dev/tty11 crw--w---- root tty 4, 12 /dev/tty12 my question: is there a relation between this two events ? thank you

2 1

SuSEFirewall logs port 8 remote to port 0 local?
by Nick Webb 14 Jan '02

14 Jan '02

Hi, Just a stupid, quick question. I checked my firewall logs from the past few days, and all accepted traffic was familiar to me, accept for two IPs. The log says it came from port 8 on the remote machine to port 0 on mine, what kind of traffic is this? Anything to worry about? ==== Jan 12 00:50:44 gizmo kernel: Packet log: input ACCEPT eth0 PROTO=1 xx.xx.xx.xx:8 xx.xx.xx.xx:0 L=64 S=0x00 I=39662 F=0x0000 T=111 (#8) Jan 12 00:50:44 gizmo kernel: Packet log: input ACCEPT eth0 PROTO=1 xx.xx.xx.xx:8 xx.xx.xx.xx:0 L=64 S=0x00 I=39663 F=0x0000 T=111 (#9) Jan 13 22:05:34 gizmo kernel: Packet log: input ACCEPT eth0 PROTO=1 xx.xx.xx.xx:8 xx.xx.xx.xx:0 L=64 S=0x00 I=30563 F=0x0000 T=113 (#8) Jan 13 22:05:34 gizmo kernel: Packet log: input ACCEPT eth0 PROTO=1 xx.xx.xx.xx:8 xx.xx.xx.xx:0 L=64 S=0x00 I=30819 F=0x0000 T=114 (#9)i ==== Thanks for your help. -- Nick Webb http://www.uidaho.edu/~nickw/

2 1

RE: [suse-security] creating a normal user just for reboot
by Paxton, Michael 13 Jan '02

13 Jan '02

Isnt it better to NOT add a new user with a full interactive shell? It just seems better to have a user that can ONLY run reboot than a user that can log in, interact with the system AND run reboot. You also sort of add your shell, your .profile and sudo as points of failure (wonderful and bug free tho they all are). just a thought -----Original Message----- From: OKDesign oHG Security Administrator [mailto:security@okdesign.de] Sent: Sunday, January 13, 2002 3:56 AM To: Steffen Dettmer Cc: suse-security(a)suse.com Subject: AW: [suse-security] creating a normal user just for reboot -----Ursprüngliche Nachricht----- Von: Steffen Dettmer [mailto:steffen@dett.de] Gesendet: Samstag, 12. Januar 2002 17:02 An: suse-security(a)suse.com Betreff: Re: [suse-security] creating a normal user just for reboot >* Kai-H. Weutzing wrote on Sat, Jan 12, 2002 at 07:56 +0100: >> useradd -u 0 -o -g 0 -d $HOMEDIR -s /sbin/reboot -c "Reboot User" reboot > >I guess this will fail with "UID 0 is not unique". > >BTW, I would prefere sudo a lot! Me too ! That's why I put this user in the sudoers, but it won't work (this was my original question *g*). How do I have to do this / what did I do wrong ? Stephan -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

snmp tool for remote querying of rpm versions
by Peter Nixon 13 Jan '02

13 Jan '02

Hi guys Using ucdsnmpd on linux it is possible to do the following: > snmpwalk hostname comunitystring \ host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName Which returns: host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.1 = "cpio-2.4.2-487" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.2 = "aaa_dir-2001.9.22-0" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.3 = "ash-0.2-395" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.4 = "base-2001.8.30-8" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.5 = "bash-2.05-82" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.6 = "ziptool-1.3-91" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.7 = "cracklib-2.7-391" host.hrSWInstalled.hrSWInstalledTable.hrSWInstalledEntry.hrSWInstalledName.8 = "less-358-159" --The rest snipped for brevity-- As you can see this is a list of all rpms installed on the system. This information would be very useful on a large network if you could pull all this info into a database, and do a quick search for rpm version numbers when a Security Update comes out. Does such a tool exist in the gpl world that will do this and spit out a list of machines in need of a security update? Or am I going to have to do this myself? I understand it's not particularly difficult, but I always try to use someone else's code rather than my own (poor) attempt.. -- Viel Spaß Peter Nixon - nix(a)susesecurity.com SuSE Security FAQ Maintainer http://www.susesecurity.com/faq/ "If you think cryptography will solve the problem, then you don't understand cryptography and you don't understand your problem."

2 1

creating a normal user just for reboot
by OKDesign oHG Security Administrator 13 Jan '02

13 Jan '02

Hi folks. I want to enable a user to login, and after succesful login the system reboots. I tried out the following: - creating an user - in ~/.profile I put "sudo /sbin/reboot" - with visudo I defined "<username> ALL: NOPASSWD: /sbin/reboot" but this won't work. Am I missing something or am I totally on the wrong way ? thx. Stephan

6 9

hack?
by test＠cyclops.eahd.or.ug 12 Jan '02

12 Jan '02

i patched my kernel last nte via ftp.suse.com this evening it is calling my hostname www.dutchnews.com. ii have not changed the host and rc.config still has the old variable could thisbe some sort of trojan? kenneth

2 1

remote admin: su vs login as root
by Matt Hubbard 12 Jan '02

12 Jan '02

List, If I su to root after logging in via ssh then I am still transmitting my root password (although it is encrypted). From a security standpoint, what's the difference in exposure? Matt Hubbard PS - Thanks for the great feedback!

8 9

reaching, servers
by Omppu 11 Jan '02

11 Jan '02

hello i have a problem to which i know what needs to be done but i dont know the syntax i have a public c-class which i have devided as the following 192.168.0.0/28 192.168.0.128/26 192.168.0.192/26 the 16 ip subnet is in between the router and the suse box the other subnets are on separate interface on the linux box when i attempt to access the internet everything works fine, but when i attempt to reach any ip address on the 16 subnet which is between the router and the suse box, i cant reach any of them what routting syntax should i add for this to work? /O

1 0