January 2002 - openSUSE Security - openSUSE Mailing Lists

Nachgefragt
by Nils Wunsch 07 Jan '02

07 Jan '02

hello Due to little to no assistance for iptable beginners like me as well as there the mailing list only professionals for professionals is probable. Have I only one question gives it except of SUSE a Firewall book which to help can. Yours sincerely Nile Wunsch

5 4

Strange Chars in my apache log
by Michelangelo van Dam 06 Jan '02

06 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, This is what I saw in my http-accept_log: 172.189.9.27 - - [05/Jan/2002:16:52:02 +0100] "^E^A^B" 200 0 The result of host: user@host:~ > host 172.189.9.27 27.9.189.172.IN-ADDR.ARPA domain name pointer ACBD091B.ipt.aol.com Is this the result of a new virus? Or is someone trying to break my webserver? Anyway, it only appears once in my logs, so I don't make a big fuss out of it. I just want to understand what's happening :) Yours sincerely, Michelangelo van Dam -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1e-SuSE (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8N7T9cExHpthAaugRApAXAKCjJ2Grcd7ZGDE0lB/J7eF+DqPiBACg2PRj 7kWDqwv+Baf9yECIm6FDOt4= =ww4A -----END PGP SIGNATURE-----

1 0

Need some help!
by Jochen Kaechelin 05 Jan '02

05 Jan '02

Can someone analyse this for me: Jan 5 17:48:16 jochen kernel: Firewall:IN=ppp0 OUT= MAC= SRC=131.188.3.220 DST=217.230.13.128 LEN=76 TOS=0x00 PREC=0x00 TTL=245 ID=31737 DF PROTO=UDP SPT=123 DPT=123 LEN=56 I'am a newbie and I don't know exactly what it means! Is it a attack? -- Jochen

2 1

Somebody has tried to break in. What to do with him?
by alexeys＠inventigo.com 05 Jan '02

05 Jan '02

Hello, look at the log. Is the a way to report on that guy? - Alexey. 139.130.148.203 - - [03/Jan/2002:11:45:17 -0800] "HEAD /....../etc/hosts HTTP/1.1" 404 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:45:16 -0800] "HEAD /../../../../etc/hosts HTTP/1.1" 400 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:36:02 -0800] "HEAD /cgi-bin/shop.cgi/page=../../../../etc/passwd HTTP/1.1" 404 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:30:22 -0800] "HEAD /../../passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:30:19 -0800] "HEAD /../../passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:30:16 -0800] "HEAD /../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:30:13 -0800] "HEAD /../../../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" 139.130.148.203 - - [03/Jan/2002:11:30:10 -0800] "HEAD /../../etc/passwd HTTP/1.1" 400 0 "-" "Mozilla/5.0" { http://trelony.cjb.net/ } Alexey N. Solofnenko { http://www.inventigo.com/ } Inventigo LLC Pleasant Hill, CA (GMT-8 usually) ------------------------------------------------- This mail sent through IMP: https://mail.inventigo.com/horde/imp/

7 10

Re: [suse-security] Nachgefragt
by Mauricio Latorre 05 Jan '02

05 Jan '02

Maybe U doesn't know, buy nobody have a "obligation" in order to answer a question Anyway, the best place to found information about iptables, it's http://netfilter.samba.org/. You can review http://www.linuxguruz.org/iptables/ too. Ch. ----- Original Message ----- From: Nils Wunsch <nils.wunsch(a)gmx.net> Date: Friday, January 4, 2002 10:46 am Subject: [suse-security] Nachgefragt

1 0

YOU does not preselect openssh patches (suse 7.3)
by Thomas Werschlein 04 Jan '02

04 Jan '02

I just noticed that YOU does not preselect the openssh patches although the openssh RPM is installed. If you rely on the preselection (which would be nice) this is dangerous because you won't get any openssh patches installed even though they are available. The reason for this behaviour seems to be the version of the RPM I have got on my 7.3 CD: openssh-2.9p2-39.i386.rpm The patches on the other hand have versions openssh-2.9.9p2-[38|74].i386.rpm ^^ !! so original RPM and patches do not match and yast does not preselect it. I think it would be nice if SuSE would point to this version mismatch in an upcoming security posting (apologies if there was one and I missed it). Thomas -- Thomas Werschlein, Interlace AG, CH-8005 Zurich werschlein(a)interlace.ch Tel +41 1 440 53 33 Fax +41 1 440 53 36 http://www.interlace.ch

2 2

FTP
by Mike H. 04 Jan '02

04 Jan '02

I assume that, as a part of the security, FTPD writes all files as 740 permissions. How do I change the umask for FTP? The .profile umask is set to 022 but has no effect. I want to do this without messing up any security that is being provided. Thanks Mike --- Outgoing mail has been certified as virus free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.311 / Virus Database: 172 - Release Date: 12/27/2001

2 1

chroot/quota
by JohnvD 04 Jan '02

04 Jan '02

All, Happy newyear first of all. I have a problem : I have a user I want to end up in a chroot'ed environment after login. (same environment as anonymous ftp user) I am planning to use him to be able to write stuff to my ftp server remotely. However, I do not want this user to be able to roam the filesystem. (other people will use him as well) This is where chroot comes in. Furthermore I want to enable quota support for this user. I am running suse6.4 with kernel 2.2.16. No quota software is currently installed. I have set his homedir to /usr/local/ftp/pub, his shell is /bin/false. Also, to allow anonymous downloads, this user is member of "daemon" group. So that when you upload something as this user, anonymous ftp users can immediately download it. At this point in time it was the best compromise between ease of use and security I could come up with. My questions are : >> how do I set up the chrooted env for this user ? >> quota , help !! >> Is this OK, or does anybody have better ideas to achieve the same goals ?? Thanks for any help and/or suggestions, JohnvD.

1 0

Filtering Software
by OKDesign oHG Security Administrator 04 Jan '02

04 Jan '02

Hi folks, is there any working filtering-software for Squid, which stops the LAN from fetching URLs with pornographic and/or securityrisk-relevant sites (maybe Warez and especially virus-containing sites) ? If not, maybe there is any good filtering-software for the clients (running W2k). The problem is, that I have no budget for this :-( God damn the ignorant bosses... So I need a free software. Is there any ? thx. Crest

7 7

kernel panic under high load
by Christoph Egger 04 Jan '02

04 Jan '02

Hello! I use SuSE 7.3 on a file server with Samba 2.2.1a (shipped with SuSE 7.3). But under high load, the SuSE Kernel panics. I am now downloading kernel 2.4.17 to compile and install myself. And I want to update Samba to 2.2.2, because of some oplock fixes. Is a ready SuSE rpm somewhere available? If not, which configure options have I to use in order to overwrite the old binaries and that the binaries searches smb.conf in /etc/samba? -- CU, Christoph

6 10