January 2002 - openSUSE Security - openSUSE Mailing Lists

Sorry...
by EXTERN Schumacher Markus (Intern; AB/EBE) 10 Jan '02

10 Jan '02

I apologize. I didn't know this is a English list. Promise to do better next time :) best regards Markus ________________________________________________________________________ Markus Schumacher BOSCH Intern 38000 Hills Tech Drive Farmington Hills, MI 48331 Department: AB/EBE2 Automotive Headquarter US Body Electronics Software *: markus.schumacher(a)us.bosch.com *: +1 (248) 848 2381 *: +1 (248) 553 1480 ______________________________________________________________

1 0

Antwort: [suse-security] root passwd .. unbekannt
by Michael.Heiming＠eplus.de 10 Jan '02

10 Jan '02

Hallo, in der /etc/passwd steht kein Passwort, schon mal reingeschaut? Lösch aus der /etc/shadow. root:Hier_stehen_SALT+Passwd_löschen:4562546:0:::::: Dann rebooten und login als root ohne Passwort, dann ein neues setzen und merken.... Viel Glück Michael Heiming Tel : unbekannt / Fax : unbekannt |--------+--------------------------------> | | "EXTERN Schumacher | | | Markus (Intern; | | | AB/EBE)" | | | <Markus.Schumacher(a)us.| | | bosch.com> | | | | | | 10.01.2002 17:04 | | | | |--------+--------------------------------> >----------------------------------------------------------------------------| | | | An: "Suse-Security (E-mail)" <suse-security(a)suse.com> | | Kopie: (Blindkopie: Michael Heiming/OAO HVD/EPLUS/DE) | | Thema: [suse-security] root passwd .. unbekannt | >----------------------------------------------------------------------------| Hi ich hab auf meine server ein problem. Irgendwie ist mein root passwort geaendert worden :( gibt es einen weg es ohne neu installation wieder zuaendern ? es gibt keinen zweiten user mit root rechten auf diesem server Ich hab mir folgendes gedacht: 1. booten von disk 2. root partition mounten 3. /etc/passwd den eintrag fuer root aendern in .. ja weiss auch nicht vielleicht in den root-eintrag von meiner anderen linuxkiste ? 4. reboot Hat das schon mal jemand probiert ? Gibt es vielleicht besser moeglichkeiten? bin fuer jede Hilfe dankbar gruss Markus -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] remote admin: ssh vs. webmin
by Jörg Kütemeier 10 Jan '02

10 Jan '02

[... snip ...] > Not neccesarily true. Remember that your usename is still an unknown = and as > such brute force/dictionary type attacks for access are likely to = succeed > quite quickly direct to superuser status, whereas if you have zero = root > access via ssh and use sudo or allow su to root you will still have a = number > of pitfalls for the would be attacker. > eg. > SSH login: user1 > user1 has rights to su user2 but no admin rights or access to sudo > user2 has rights to use sudo but also no admin rights > sudo can be configured to allow for specific command sets only. I think it's to complicated in real-world for daily use... and for most = cracks you can be very lucky if you have captured one local user = account. Then you can use e.g. local buffer overflows etc. > If you are local, then you have a user. Since access to such a user > account implies that it's equivalent to root, these user accounts have = to > be protected just the same way as root. I don't see any reason why to > handle the level of protection differently Think so, too. Protect every user at all costs... My solution would be: - use MD5 password's (good and long ones, so BruteForce would be = useless), use Kerberos or even better disable passwords - use only SSH protocoll type 2 (don't use type 1!!!) - create a DSA-Key (choose good passphrase) - put your public key on the server to the desired account - if you wish to... activate SSH-Agent (type your passphrase ones, be = happy for the day, even on X-Servers) - log in with your Key (password's will never pass the network) - if you wish to... activate Agent Forwarding and hop on different = servers without ever prompted for a password (so never transfered over = the network) Regards Jörg -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

starnge behaviour after power-break
by OKDesign oHG Security Administrator 10 Jan '02

10 Jan '02

Hi folks, I recently had a power-break (my USP was in maintenance this day and whupps - there was a breakdown *grmbl*) and now my linux-system behaves really strange. It seems as everything is working fine (I couldn't find any service not running correctly) but at bootup and nearly every time I enter a command, I get this message "#o: command not found". Bootup looks really nice *sigh* I get lots of lines more that normal and every line looks like "<name of script>#0: command not found". I guess some parser or system-procedure was modified with this "#0" but couldn't find out which one. I already replaced nearly every packet with the one from the CD (via YaST - - Installation - Replace with the original one from CD) but without effort. Does someone has an idea what to do ? I don't want to install from the crab as I already made lots of configurations and changes in the system and, whats more, this server runs samba and the data samba provides is used the whole day. Any way to prevent complete reinstallation ? thx. Stephan

2 4

compartment(chroot), capabilities and user on kernel 2.4
by Dietrich Meyer 10 Jan '02

10 Jan '02

Hi all, in the documentation ot the compartment script (of SUSE 7.3), I found a note that under kernel 2.4, it would be possible to use capabilities together with a non-root user, which was impossible for kernels 2.2.x. I tried to get it to work (in my case, BIND8 using the init_bind8 script from the compartment-documentation). I modified the script so that a minimal /etc/passwd and /etc/group was put into the chroot-dir,and "chowned" /var/named to the new user. Finally, I changed the call to compartment, added '--user newuser' and changed '--group newgroup'. But wouldn't start :-( So my question: Is it in principle possible to use different users (non-root) together with capabilities? If yes, I will try a bit more..... Or maybe if anybody sees something obvious missing in my procedure, please tell me. Thanks!!!! Dietrich -- Dr. Dietrich Meyer Domain Names Worldwide SunnyNames llp www.sunnynames.com email: info(a)sunnynames.com -- -- This message may contain privileged and/or confidential information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information therein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. SunnyNames llp thanks you for your cooperation.

2 1

RE: [suse-security] remote admin: ssh vs. webmin
by Barry Gill 10 Jan '02

10 Jan '02

::If you have a good password its no less safe to log in with ssh ::than it is to su after login. The password is sent encrytped. Not neccesarily true. Remember that your usename is still an unknown and as such brute force/dictionary type attacks for access are likely to succeed quite quickly direct to superuser status, whereas if you have zero root access via ssh and use sudo or allow su to root you will still have a number of pitfalls for the would be attacker. eg. SSH login: user1 user1 has rights to su user2 but no admin rights or access to sudo user2 has rights to use sudo but also no admin rights sudo can be configured to allow for specific command sets only. This means attacker needs to crack two usename password sets before getting any admin type access, but still no access to superuser. How secure do you want your host to be?

1 0

AW: [suse-security] starnge behaviour after power-break
by Peer Stefan 10 Jan '02

10 Jan '02

have a look at /etc/rc.d/squid whether there is a 'o' in front of a '#' happens sometimes by using vi :-) regards, stefan -----Ursprüngliche Nachricht----- Von: OKDesign oHG Security Administrator [mailto:security@okdesign.de] Gesendet: Donnerstag, 10. Jänner 2002 11:56 An: Peter Wiersig Cc: suse-security(a)suse.com Betreff: AW: [suse-security] starnge behaviour after power-break Okay, no problem. For the first I just do some little diagnostics: linux-gw:~ # rcsquid status /usr/sbin/rcsquid: o#: command not found Checking for WWW-proxy squid running linux-gw:~ # rcsendmail status /usr/sbin/rcsendmail: o#: command not found Checking for service sendmail: unused linux-gw:~ # But when I do it the other way it works fine: linux-gw:~ # squid status 2002/01/10 11:49:54| Squid is already running! Process ID 1219 linux-gw:~ # But one thing is strange: linux-gw:~ # man squid SQUID(1) mrtg SQUID(1) 2001-06-05 2.9.17 SQUID(1) lines 1-5/5 (END) What does this mean ? thx. Stephan P.S.: I just saw that I told you wrong in my posting: It is not "#o", but "o#". Sorry. -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig@glamus.de] Gesendet: Donnerstag, 10. Januar 2002 11:32 An: OKDesign oHG Security Administrator; suse-security(a)suse.com Betreff: Re: [suse-security] starnge behaviour after power-break Am Donnerstag, 10. Januar 2002 10:56 schrieb Stephan: > It seems as everything is working fine (I couldn't find any service not > running correctly) but at bootup and nearly every time I enter a command, I > get this message "#o: command not found". Give an example command. > I already replaced nearly every packet with the one from the CD (via > YaST - - Installation - Replace with the original one from CD) but without > effort. If you get this error-message from the startup-scripts, maybe your problem lies in /etc/rc.config or similar configuration files. They are also not overwritten when you reinstall your packages. Peter -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

user ***** - am I hacked?
by Marc Wiesenhütter 10 Jan '02

10 Jan '02

Hi, wenn i just checked users login with last, i found this entry ***** p*******p*** Thu Jan 1 01:00 still logged in and user ***** is not known to me. the prozess table didn't show any strange thing so am I hacked or what does it mean? Any ideas welcome! bye Marc

8 9

Iptsbles Nat Problems
by abaesche＠worklab.de 10 Jan '02

10 Jan '02

Hi, I have a problem with my NAT. I use this script die hidde my Intranet. I only could do passive ftp, but I need aktive. Anyone a idear to fix this ? iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE Thanks!! ------------------------------------------------------------ worklab technologies GmbH http://www.worklab.de Armin Bäsche Phone: 089 / 890 569 65 Technik / Administration Fax: 089 / 890 569 79 Motorstr.56 eMail: abaesche(a)worklab.de 80809 München http://www.eatndrink-guide.com ------------------------------------------------------------

3 2

Iptables
by stuart.lamble＠batepro.co.za 10 Jan '02

10 Jan '02

Hello Needed - Iptables tutorial - manual Tks S

2 1