January 2002 - openSUSE Security - openSUSE Mailing Lists

httpd.log-entries now clear
by OKDesign oHG Security Administrator 04 Jan '02

04 Jan '02

Okay, thank you for the information. It is NIMBDA scanning for code red II infected and other vulnerable hosts. As I'm running Linux, there seems to be no risk for my system. Thank you again. Stephan

1 0

building boot cd
by Gunther Stammwitz 04 Jan '02

04 Jan '02

Hello List, I'd like to create a boot-cd that contains the three suse boot-disks: bootdisk,modules and modules2. What's necessary in order to do that ? Thanks a lot, Gunther

5 6

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 04 Jan '02

04 Jan '02

hi again, ...and now the output of # rcsendmail status works right: Checking for service sendmail: No process on the 7.2-host. as i told you, the old machine could be a little bit creppy...;-) have a nice day, daniel p.s. sorry for posting so much %( -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3

httpd.log-entries
by OKDesign oHG Security Administrator 03 Jan '02

03 Jan '02

Hi folks, sorry if this was already discussed. In my httpd.error_log I can find hundreds of entries which show that I get permanently scanned for "root.exe" and "cmd.exe". Okay cmd.exe is of course the command interpreter of Windows-Systems. This interpreter is being searched in lots of locations (winnt/system32 and different other locations; of course without affort as I'm runnign a linux-System). But I've never heard of root.exe. What is this ? root sounds familiar *sigh* but I've never heard of a root.EXE... As this scans also take place on my Dial-In-machine, there seems to be a scanprogram which scans the range(s). Does anybody know of such a scanprogram ? Is there any danger for my linux-system ? thx. Stephan

2 1

SuSEfirewall2 and adsl pptp connection
by Alberto Cordone 03 Jan '02

03 Jan '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear friends, I have a problem with the configuration of SuSEfirewall2 on my server with SuSE 7.3. The scenario: Internal Lan (192.168.1.1)eth1 | | - --------------------------- SuSE server FW2 ___________________________ 10.0.0.1 eth0 | | |ppp0 (with fixed ip) | | | 10.0.0.138 | - ------------------------ | Alcatel Speed Touch | ________________________ | | | Tiscali ISP Could you show me a correct configuration with FW2. I tried with my old configuration but I hadn't luck. I read all the documentation and the discussions's groups but I haven't understood the problem with tuneling (pptp) between eth0 and SpeedTouch. Perhaps I have to put 10.0.0.138/32 in FW_TRUSTED_NETS ? My apologies if the scenario isn't so beautiful. Best regards - -... -.-- . -... -.-- . Alberto Cordone Cascina Triulzina, 4 26834 Corte Palasio Lo Home +39 371 472029 Cell +39 3287443985 FaxH +39 1782274985 FaxO +39 2700528231 Email: acordone(a)tiscalinet.it, alberto.cordone(a)mi.unicatt.it - -.-. .. .- --- -.-. .. .- --- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8NMdK2F48h2Y4fkwRAu+qAKCJ3uLXmXSvJhSCDbEto2BSaiK9IACfTIW3 SryLJ/un7JdEtXtdFFgQb1s= =NKt5 -----END PGP SIGNATURE-----

1 0

SuSEFirewall2 and IPTABLES Question
by Robert Rottscholl 03 Jan '02

03 Jan '02

Dear List, I built an own Firewall with IPTABLES (I inserted every Rule myself) and I want now change to SuSEFirewall2. My Questions are, 1. Would you change to SuSEFirewall2 or would you act like the slogan says "Never touch a running System!"? 2. I've inserted a rule to only let connections into my network if they belong to a parent connection like: <!--snap iptables -A FORWARD -d $LOCAL_NET -i $WORLD_DEV -o $LOCAL_DEV -m state --state RELATED,ESTABLISHED -j ACCEPT snap--!> Now my Question: Does SuSEFIREWALL2 offer this Feature and how can it be activated? What do you think about this rule? Is it usefull or garbish? Sysinfo: kernel: 2.4.17 SuSE: 7.2 iptables: 1.2.2 Ciao ;-) Robert - DE

2 1

YOU
by OKDesign oHG Security Administrator 03 Jan '02

03 Jan '02

Hi folks, simple question: Is it possible to run YOU (YaST Online Update) from the shell or must it be done from within YaST2 ? For any reasons I cannot run YaST2, no idea why. But I'd like to update my system regularly with YOU to be up to date with bugfixes and patches. A simple "you" on the shell doesn't work. What do I have to do ? thx. Stephan

4 3

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi nicola, i just tried to install sendmail and deinstalled postfix for test-reasons. now it works...;-( ;-) ... no idee! just for your info, best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi nicola, this machine should not be a mail-server, indeed ;-) is it possible that an old installation (6.4) on another intranet-host works properly by using sendmail which does not need to be setup explizit for local- mail-delivery? this old machine does not run sendmail as a daemon (see "netstat -an" and "grep" ): tcp 0 0 192.168.0.100:22 192.168.0.13:1535 ESTABLISHED tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN raw 0 0 0.0.0.0:1 0.0.0.0:* 7 raw 0 0 0.0.0.0:6 0.0.0.0:* 7 dbs:~ # grep SMTP /etc/rc.config # have mail daemon on SMTP port? ("yes" or "no") # As uucp site, you can get along with "SMTP=no", if you make SMTP="no" but checking sendmail with # rcsendmail status gives the follwing response: # Checking for service sendmail: OK but maybe this machine is a little bit greppy... does anyone know about the relations? ;-) best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Aktive FTP wit Iptables
by mk＠hitchhiker.com 02 Jan '02

02 Jan '02

Hello List, I'm trying to connect to any outside FTP with a aktive ftp conx type from a client behind the supposed firwall but that doesnt work, only passive is allowed. I understand the basics with in/output and forwarding, all my supposed sercies are working in and outgoing, from my firewall i can connect aktiv or passive ftp out and vice versa but not from the client behind. It doesnt matter if I allow all new connections to input or forward, the only difference is that ftp_data is not appearing in the log anymore ????, the ip_conntrack_ftp module is loaded. Does anybody discover the same problem or has a fix/sample for this case ??? Many thx i adv Matthias Krauss

2 1