January 2002 - openSUSE Security - openSUSE Mailing Lists

What should i expect from this messages?
by Leo Rivas 30 Jan '02

30 Jan '02

Hi all This is the first time i put a suse server to the internet and it is beginning to scare me the the lot of logs and http requests (being not a public server), from unknown ip's, following an advice from John Andersen (thanks!), i have updated ssh to OpenSSH_2.9.9p2 (downloaded the rom from the ftp update for suse 7.2), then, but still have many logs like this: Jan 30 03:46:54 linux sshd[24339]: Did not receive identification string from ::ffff:200.68.47.114. Jan 30 04:22:22 linux sshd[24400]: Bad protocol version identification '.' from ::ffff:200.68.47.114 It is obvious that someone scanned the net and found my ssh running, and is trying something, obviously he taken note of my ip and may try and try to hack me isnt he? How do I secure this? , ssh is on its defaults yet cause i dont understand many of the options in /etc/ssh/ssh.conf and im afraid 'he' may find a hole in there, i have read some docs, but found more about login methodes than securing the server itself, give me clues, please. Thanks in advance Leo _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

3 2

SuSEfirewall5.1
by Togan Muftuoglu 30 Jan '02

30 Jan '02

Hi, I have a setup as follows Internet =pppoe fixed ip LAN= eth0 192.168.1.0/24 DMZ= eth2 192.168.2.0/29 I have set SuSE firewall 5.1 on the Firewall/router box and on the DMZ box. Evertyhing works fine until LAN starts a rsync or an ftp request. Then the commnication to LAN drops down I need to bring eth0 down and up again. If it's mail or web traffic everything works fine. Below is my setup for the main firewall. What do I need to stop the LAN from droping FW_DEV_WORLD="ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.1.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" FW_SERVICES_EXTERNAL_TCP="22 25 80 443" FW_SERVICES_EXTERNAL_UDP="" FW_SERVICES_DMZ_TCP="domain ssh 80 443" FW_SERVICES_DMZ_UDP="domain" FW_SERVICES_INTERNAL_TCP="21 22 25 53 110 119 161 162 873 6667" FW_SERVICES_INTERNAL_UDP="domain 161 162" FW_SERVICES_INTERNAL_IP="" FW_TRUSTED_NETS="192.168.1.3" FW_SERVICES_TRUSTED_TCP="ssh 161:162" FW_SERVICES_TRUSTED_UDP="ssh 161:162" FW_SERVICES_TRUSTED_IP="" FW_SERVICES_TRUSTED_ACL="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD_TCP="192.168.1.3,192.168.2.2,22 \ 192.168.1.3,192.168.2.2,161:162" FW_FORWARD_UDP="192.168.1.3,192.168.2.2,161:162" FW_FORWARD_IP="" FW_FORWARD_MASQ_TCP="0/0,192.168.2.2,80 0/0,192.168.2.2,443\ 216.200.145.35,192.168.1.3,25 216.200.145.36,192.168.1.3,25\ 216.200.145.37,192.168.1.3,25 216.200.145.38,192.168.1.3,25 " FW_FORWARD_MASQ_UDP="" # Redirect TCP connections FW_REDIRECT_TCP="192.168.1.0/24,0/0,21,21 192.168.1.0/24,0/0,6667,7666" # Redirect UDP connections FW_REDIRECT_UDP="" # Log critical denied network packets FW_LOG_DENY_CRIT="yes" # Log all denied packets FW_LOG_DENY_ALL="no" # Log critical accepted packets FW_LOG_ACCEPT_CRIT="yes" # Log all accepted packets FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" # Allow ping on firewall FW_ALLOW_PING_FW="yes" # Allow ping on DMZ targets FW_ALLOW_PING_DMZ="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" #using ftp-proxy so redirect 21 -> #using tircproxy so redirect 6667 ->7666 FW_MASQ_MODULES="autofw cuseeme mfw portfw h323 quake raudio user vdolive" FW_CUSTOMRULES="/etc/rc.config.d/firewall-custom.rc.config"

1 0

Re: [suse-security] Root access via ssh??
by michael.ryan＠storm.ie 30 Jan '02

30 Jan '02

Edit your /etc/ssh/sshd_config file and change the line PermitRootLogin from yes to no Regards, Michael Praise <praisetazio@tisc To: suse-security(a)suse.com alinet.it> cc: Subject: [suse-security] Root access via ssh?? 01/30/2002 10:55 AM Hi all, After a fresh install of Suse 7.1 I have noticed that ssh allows root remote access. I have tried to disable it via pam /etc/security/access.conf but it does not work. How do I do it? Praise -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Online Update
by Bitzer,Gerd 30 Jan '02

30 Jan '02

Hello Members, just my 2 Eurocents, but .. I do not understand why Suse doesn't actively (sup)port autorpm (http://www.kaybee.org/~kirk/html/linux.html) The limitations which seem to be in YOU (no proxy support, the need for http, support for mirrorsites) are not in autorpm. But autorpm is/was developed for using with and on Redhat. I'm running an older, patched release of autorpm (which has no probs with the directory structures of Suse's ftp servers), it works with proxies, it works with mirrors, it even seems to support signatures, it also supports getting RPM Updates from Non-Suse RPM's, and it has no performance probs, even over slow modem uplinks. It's a nice little app, even with a text based UI, it doesn't depend on Yast, it works manually, it works with cron. Maybe Suse should incorporate it in it's own Dist.

2 1

Re: [suse-security] Online Update
by JW 30 Jan '02

30 Jan '02

Well, I'm doing a really bad job of it today. This is my first reply, unfortunately I sent it to the wrong list the first time :-/ Here it is.... ------------------------------------------------------------ Ok, First I want to apologize: I've had a rough day including one crashed server. I wrote the previous messages in a rush while feeling somewhat worked up about the issues. Add the to the fact that I'm already unhappy with SuSE on a couple of counts related to YOU and it all came out onto my keyboard with a worse altitude then it should have. At 08:12 PM 1/29/2002 +0100, you wrote: >No comment to the clearly non-technical claims. No comment was desired. It was a snide remark that probably shouldn't have been made to begin with. >There is no such thing as an "internal patch manager". I did not mean that in the sense of it's own package manager e.g. rpm or dkpg. What I meant was that it uses it's own system for determining what packages are/are not installed and does not query rpm for that info. Querying rpm would be much more reliable and would solve the some of the issues I mentioned. >YOU sees a file >"openssh-3", has one called "openssh-2" and concludes that the "-3" >version is newer. Yeah, and that's exactly what causes it to be wrong about what is/is not currently installed. Also note that I have never seen any documentation or warnings "If you suspect a package is not really installed, please remove /var/lib/YaST/<snip> and try again". How are people supposed to know to do that? I simply worked it out on my own out of desperation, but not everyone can/would/should. And even that system could have been done better - quite apparently it writes those files out before it's truly finished, which is a (fairly serious ) design flaw. There used to be one problem with the naming of the openssh-2 patch >description: We manually ++'ed the number to -3 b/c the mechanism to do >this was a bit glitchy. Ok, but in case you are suggesting that maybe that had something to do with the experience I spoke of in my previous post, it does not. We have seen problems with corrupt packages on our mirrors lately, we >don't know how this can happen. Me neither. It happens ever over T1 and it's random - I can update several servers at the same time or nearly the same time, and one will find it corrupt while another one downloads it just fine. I have to remove the corrupted rpm file out of /var/lib/YaST/patches/<arch>/update/<version>/<series> before you can download a good file too - otherwise YOU just keeps trying to "finish downloading" the corrupted package (which doesn't work). >You have seen autogenerated mails from feedback(a)suse.com (and probably >from bugs(a)suse.de as well). As I attempted to state, an auto-generated "hello, our computer has received your email" is not sufficient for security issues. And I did say that I do understand SuSE can't reply to all emails. They actually did get back with me concerning the much-less-important corrupted netscape package (thus showing that humans at SuSE do read the messages and do reply at least sometimes.). Knowing that people who take security seriously often go to BugTraq with their info when the notified vendor does not respond, I would think SuSE would want to notify me personally for that reason alone. Apparently not. > You also seem to be aware of security announcements, are you? At least, >you are reading this list. But then, you should be aware of the primary >security contact of SuSE: <security(a)suse.de>. Ok, well quite frankly I was not. Also, I viewed it as a bug report with security implications, not a security problem per se. >You will get answers usually >in less than 24 hours if you write to this list. That's true, this is a good list (was till I got here anyway ;-) ). >This issue is clearly >security related, and it needs an urgent fix. It's just that we don't know >of it. Interesting that you see it that way, I simply didn't - to me it was more of a bug (for a software company, a somewhat naive bug at that) then a security issues. I simply noted that it could have security implications as a way of making it seem more urgent (quite frankly, it seems to me that vendors rarely pay attention to bug reports except when they are security related.) >As a SuSE employee responsible for the security field, I am not in the >position to rant at customers, and I don't want to do this here either. Again, sorry to upset you or anyone else. >So please take this as a suggestion: What happens here is a communication >problem. The information is valuable, but that is not everything that >matters. Sir, if your feedback@ and bugs@ have no way to communicate with the security crew, then SuSE has a serious problem. I'm not saying I didn't need to send in a report to security@, but I would think the feedback and bug people would forward anything that mentions security to the security department to be analyzed. If not, I feel more worried then ever to think that security reports that only go to feedback@ or bugs@ doesn't ever get reviewed by the SuSE security team :-[ >Valuable information can be stored on some diskette in my mom's >old computer, and it doesn't change anything in this world. To me that statement is implying that I have the information but did not give it to SuSE. While I did not send it to the _best_ address, nonetheless I did indeed send it to 2 addresses at SuSE. >What also >counts are: I'm having a hard time following you here: > 1) time The time I discovered the problem > 2) origin Origin of what? The bug? YOU is the origin. And SuSE is the origin of YOU :-) That's kind obvious - are you saying something else that I'm missing? > 3) destination This one totally escapes me. Destination is my computers hard drive. Where I live is irreverent. Again, am I misunderstanding you? > 4) medium ??? > 5) mode (language-wise) and language English. I'm surprised I'd need to say that but ok, I will. > 6) the history of the information > 7) related information i.e. the body of the bug report. FYI I gave all pertinent details (except for lang=en_US) when I submitted my bug reports. >The thing with 3) and maybe 5) can be improved on your side in this case. 5, yes, I cannot grasp the meaning of 3. >Now we will go ahead and see if we can fix this as soon as possible and >provide the update package/patch as people expect it. Should I go ahead and submit a whole new report to security(a)suse.de or are you simply going to handle it now? > Then we can be happy >again. That would be nice :-) >> I've never done anything like that before - do you think I should? It's >> really quite important and SuSE _need_ to fix it. I'm not sure if it's >> serious enough for BugTraq though. > >For sure it's serious enough for security(a)suse.de. >Thanks for the effort of writing to this list, at least. If I hadn't gotten all worked up by that one guy's post (I don't even remember what it was now) I never would have. Again, sorry for any strife I've caused. I didn't mean to be a pain - it just all got too me at once. ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

Re: [suse-security] Online Update
by JW 30 Jan '02

30 Jan '02

At 10:33 AM 1/29/2002 +0100, you wrote: >Does/will Yast online update support HTTP (or at least http proxy)? yes, they added http support with one of the latest YOU updates, however you cant' choose it - it only ususes it when it wants to. SuSE doesn't have HTTPD running on any of their FTP servers either (wish they did) >As ftp is a weird protocol anyway, I don't think it should be used so >much, especially for important things like updates. They should use scp :-) > I have some servers >behind an MS Proxy Server and can't use online update, because yast >doesn't support any proxy, and socksify + bouncer on a machine with MS >Proxy client installed doesn't work, too (http/ssh works thoug). >And once again, why is YOU not half as cool as apt-get ?? Because the people who are working on it don't seem to care enough. It's slowly getting better but I really don't understand why a little more effort isn't put into it, since it's a highly sought-after feature. Anyway, that's not the worst of YOU's problems - it uses it's own internal patch manager and never consults rpm. Due to this, a patch is always marked as "installed" unless you do some hacking. For instance the other day I fried my MySQL installation while testing and had to do an ftp reinstall from yast1. It installed the old original versions of MySQL & Co., and when I opened YOU the mysql updates that I _knew_ where there where not available to be selected. I had to hack some things to get YOU to wake up. This is very bad. Also if you download, say 5 updates (this actually happened to me) and during the install part rpm gives an error, say on the second package, the installation ceases (i.e. the remaining packages do _not_ get installed) yet YOU marks them as successfully installed anyway. This actually happened to me when I way trying up update at, netscape, openssh and w3m at the same time. The NS package was corrupt, and YOU just skipped over sshd and w3m without mentioning it. I only realized what was happening because YOU "finished" the installation too fast. If I had not been paying attention I would have _thought_ I'd upgraded sshd and would in fact have still been using the old version. This is very bad. I have submitted several bug reports to feedback(a)suse.com and bugs(a)suse.de and not heard back from them. I have a serious mind to submit this to BugTraq in the hope of forcing SuSE to do something about it. I've never done anything like that before - do you think I should? It's really quite important and SuSE _need_ to fix it. I'm not sure if it's serious enough for BugTraq though. JW ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

7 11

Securing sendmail
by Richard Ems 29 Jan '02

29 Jan '02

Hi all! I'm trying to secure sendmail's configuration a bit. I'm running SuSE's sendmail-8.11.6-29 package on SuSE Linux 7.3. Here my two questions: 1) Should I change the Greeting string (SmtpGreetingMessage) ? Per default it will return lots of information such as "real" hostname and sendmail's version. Is this info needed by some other mail program? 2) And what about the help file (helpfile) ? This is also some information which is probably not needed! So cat /dev/null > helpfile or rm helpfile ? Where do I found some info about securing sendmail? Many thanks, Richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Computer Science, University of Hamburg Unix IS user friendly. It's just selective about who its friends are.

2 1

Re: [suse-security] Online Update
by JW 29 Jan '02

29 Jan '02

At 01:51 PM 1/29/2002 +0100, you wrote: >> And once again, why is YOU not half as cool as apt-get ?? because it's not as sloick to use ;-) >Perhaps you want to set up your own apt server for your favourite RPMs? Dude, if I have the time and money I _promise_you I'd port Conectiva's rpm-apt get to SuSE and get a mirror going. I've been hoping someone would do this for a _long_ time. >As you said apt-get supports http (with/without proxy) and was ported to >support RPM packages by conectiva. > >There is a project at sf, that makes setup of an apt server quite easy. >Feel free to have a look at: > > apt4rpm.sf.net > >... and join the apt4rpm club. It really rocks :-) Joining! >> thanks >> Markus > >Ciao, > Marcel ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

RE: [suse-security] Online Update
by Richard Clyne 29 Jan '02

29 Jan '02

Why not use wget to create a mirror of the updates on your local machine and point YOU to a directory? > -----Original Message----- > From: Roman Drahtmueller [SMTP:draht@suse.de] > Sent: 29 January 2002 13:02 > To: Markus Gaugusch > Cc: SuSE-Security > Subject: Re: [suse-security] Online Update > > > Does/will Yast online update support HTTP (or at least http proxy)? > > > > We are working on http support. > > > > As ftp is a weird protocol anyway, I don't think it should be used > so > > much, especially for important things like updates. I have some > servers > > behind an MS Proxy Server and can't use online update, because yast > > doesn't support any proxy, and socksify + bouncer on a machine with > MS > > Proxy client installed doesn't work, too (http/ssh works thoug). > > And once again, why is YOU not half as cool as apt-get ?? > > > > Feel free to use it. > > > thanks > > Markus > > > Thanks, > Roman. > -- > - > - > | Roman Drahtmuller <draht(a)suse.de> // "You don't need eyes to > see, | > SuSE GmbH - Security Phone: // you need > vision!" > | Nurnberg, Germany +49-911-740530 // Maxi Jazz, > Faithless | > - > - > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

3 2

Kernel-Version
by Hirsch Wolfgang 29 Jan '02

29 Jan '02

Hi all, which kernel-version should I take for my firewall box? greetings Wolfgang

3 2