January 2002 - openSUSE Security - openSUSE Mailing Lists

Tripwire setup confusion
by Togan Muftuoglu 28 Jan '02

28 Jan '02

Hi, I am in the process of using tripwire before I put the machine on the net. Iam following Marc's article on securing websserver which is at the SuSE website. However couple of things are not clear. This is on SuSE 7.3. So what is the actual thing rpm -q tripwire tripwire-1.2-357 According to rpm -qi Location of the binary is /var/adm/tripwire/bin/tripwire. Tripwire wants its configuration files /var/adm/tripwire/tw.config The database has to be saved at /var/adm/tripwire/db when I do rpm -ql tripwire ... /usr/sbin/tripwire ... /usr/share/lib/tripwire/db So do I create the /var/adm/tripwire directory and it's contents or ? -- Togan Muftuoglu

1 0

RE: [suse-security] mirkforce
by christian.burri＠synecta.ch 28 Jan '02

28 Jan '02

Mirkforce is **NOT** a virus, ie, it doesnt replicate itself, it does not "propagate". Rather than that, mirkforce is a "clone flooder" type IRC client that will load heaps of virtual interfaces on youre box and make clones join IRC thru them (it will typically try to load as much interfaces as possible in your local class C subnet.) I repeat: Mirkforce is NOT a virus Dont spread false and inaccurate info, please. Mirkforce may however be part of or contained in <insert your favorite rootkit name here> Cheers Chris .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ Delia Wakelin <d.wakelin@un An: suse-security(a)suse.com n.ac.uk> Kopie: Thema: [suse-security] mirkforce 28.01.2002 09:18 recently received the message below. Is mirkforce a problem for suse ? --> We are currently dealing with an outbreak of hacked Linux boxes running "Mirkforce". Mirkforce is an IRC virus, which is spreading rapidly. We are unsure as to how it propagates, but essentially once a hacked linux box launches the software, it will fill all the ips not used of the network where the computer is located (the /24) by creating virtual aliases on the main interface. After it will just simulate x connections from each ip, and will target one or more irc servers and probably be used in some action against some users/channels. Computer examined were root kitted and some DDOS tools were installed and activated on it. **PLEASE** search the linux servers on your network, and if you have some machines logging arp changes or else, try to find the server which suddenly stole ips from others servers. This software is probably running only on Linux (all the versions found were for Linux). Search the linux running recently reported holed daemons (named, rpc, ftpd, etc..) and try to find suspicious accesses and to reinstall/remove useless daemons. Usually the server hacked will be one of the not listed ones, it seems that the mirkforce is not using the primary IP of the server hacked. Output from the help of the software ./mIRKfORCE -h mIRKfORCE 2.o [+0wnz] by ipLord, this copy is registred to haschmannen usage: mIRKfORCE [options] flag <arg> : explanation [default] -------------------------------------------- -i <interface> : Interface [eth0] -t <secs> : h0st check timeout [7] -h : This help (also try /help once inside) -r : Remove all IPaliases created by mIRKfORCE -v : Verbose mode, print common irceventz fer the klonez -d : Debug mode (lotsa raw ircprintouts) As always, these problems can be avoided by running properly patched and secured machines. Regards, -- Dr. Delia Wakelin Tel: 44 (0) 191 227 4958 Division of Psychology email mailto:d.wakelin@unn.ac.uk University of Northumbria www http://www.unn.ac.uk/~evdw3 Newcastle upon Tyne NE1 8ST -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

mirkforce
by Delia Wakelin 28 Jan '02

28 Jan '02

recently received the message below. Is mirkforce a problem for suse ? --> We are currently dealing with an outbreak of hacked Linux boxes running "Mirkforce". Mirkforce is an IRC virus, which is spreading rapidly. We are unsure as to how it propagates, but essentially once a hacked linux box launches the software, it will fill all the ips not used of the network where the computer is located (the /24) by creating virtual aliases on the main interface. After it will just simulate x connections from each ip, and will target one or more irc servers and probably be used in some action against some users/channels. Computer examined were root kitted and some DDOS tools were installed and activated on it. **PLEASE** search the linux servers on your network, and if you have some machines logging arp changes or else, try to find the server which suddenly stole ips from others servers. This software is probably running only on Linux (all the versions found were for Linux). Search the linux running recently reported holed daemons (named, rpc, ftpd, etc..) and try to find suspicious accesses and to reinstall/remove useless daemons. Usually the server hacked will be one of the not listed ones, it seems that the mirkforce is not using the primary IP of the server hacked. Output from the help of the software ./mIRKfORCE -h mIRKfORCE 2.o [+0wnz] by ipLord, this copy is registred to haschmannen usage: mIRKfORCE [options] flag <arg> : explanation [default] -------------------------------------------- -i <interface> : Interface [eth0] -t <secs> : h0st check timeout [7] -h : This help (also try /help once inside) -r : Remove all IPaliases created by mIRKfORCE -v : Verbose mode, print common irceventz fer the klonez -d : Debug mode (lotsa raw ircprintouts) As always, these problems can be avoided by running properly patched and secured machines. Regards, -- Dr. Delia Wakelin Tel: 44 (0) 191 227 4958 Division of Psychology email mailto:d.wakelin@unn.ac.uk University of Northumbria www http://www.unn.ac.uk/~evdw3 Newcastle upon Tyne NE1 8ST

1 0

Re: [suse-security] openssl directory in suse 7.3
by Negrisan Laurentiu 28 Jan '02

28 Jan '02

You have instaled openssl and openssl-devel ? +++ SuSE73:~ # rpm -qa |grep ssl openssl-0.9.6b-34 mod_ssl-2.8.4-29 openssl-devel-0.9.6b-34 +++ If you want to compile some with ssl suport try with prefix for ssl /usr On Mon, 28 Jan 2002, Philipp Snizek wrote: > Hi all > > Just a dumb question: > How can I found out where openssl is installed? > whereis command sais /usr/bin/openssl, but this is not sufficient for squid > 2.5 ssl support enabled. I'm looking for the headers and/or development > directory. > > thanx > Philipp > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > ++++++++++++++++++->>>>>NetRaptores.com<<<<<-++++++++++++++++++ Laurentiu Negrisan * Network System Engineer * Linux Registered User #191866 * CCNA +++++++++++++++-<<<<<Cellular:+40 90011477>>>>>-+++++++++++++++

1 0

RE: SuSEfirewall2 blocks all external network traffic to or from any computer on my network, including the firewall-machine itself
by Sebastian J. Bronner 28 Jan '02

28 Jan '02

For every connection attempt, there is a log entry like the following: Jan 27 20:57:47 brose kernel: SuSE-FW-ACCESS_DENIED_FOR_INTIN=eth0 OUT= MAC=00:20:78:10:a2:db:00:00:0c:8c:56:54:08:00 SRC=206.126.0.13 DST=206.126.5.12 LEN=40 TOS=0x00 PREC=0x00 TTL=63 ID=56009 DF PROTO=TCP SPT=110 DPT=1026 WINDOW=17520 RES=0x00 ACK URGP=0 -- Sebastian J. Bronner waschtl(a)sbronner.com

1 0

harden_suse-3.5 and SuSE 7.3
by Togan Muftuoglu 28 Jan '02

28 Jan '02

Hi, harden_suse version 3.5 looks like max_version supported is 7.2. What are the problem possiblities when I run this with a 7.3 machine

1 0

ssh upgrade
by Webmaster 28 Jan '02

28 Jan '02

Hi List, It may sound silly, but reading so many ssh threads, I ask your advice (since being fairly busy I would like to save myself from hassle) on upgrading or not a running ssh-1.2.27-239 to SuSe openssh-2.9.9p.2-73.i386.rpm? Please, do not mock me, but if it would go smooth, I do it, but delay it if needs extra efforts. Antal ++++++++++++++++++ Kreorg Oktatóközpont http://www.kreorg.hu kreorg(a)kreorg.hu Tel:+36-1-321-00-31 Fax:+36-1-397-27-80 GRID Erő a változáshoz.

1 0

Re: [hangout] OPENSSH trouble
by Ruben Safir 28 Jan '02

28 Jan '02

OK Problem fixed. It's 2.9 going to 2.3 I needed to create the proper authorized_keys2 with proper permissions on the server AND I needed to recreate proper ./id_dsa.pub and ./id_rsa.pub files on the the client and include them, especially the DSA, into the server authorized_keys2. Of course, all fo this is well documented. I needed to walk through Dejanews to put all the peices together. That's why sysadmins get the big bucks... Now the problem is that SUSe doesn't have a openssh 3.0 RPM The source RPM on openssh.org's sites seems, to my eyes, to be asking for Redhat specific RPM dependencies. Should I just roll my own with openssl and openssh? Ruben On 2002.01.25 17:33:49 -0500 Michael Osten wrote: >>Are you using 2.9x on one machine and 3.0.x on the other? >> >> >> >>--------- >>------------- >>Michael Osten >>Reefedge Inc. >> >> >> >> >> >> -- __________________________ Brooklyn Linux Solutions __________________________ http://www.mrbrklyn.com - Consulting http://www.brooklynonline.com - For the love of Brooklyn http://www.nylxs.com - Leadership Development in Free Software http://www.nyfairuse.org - The foundation of Democracy http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net http://www2.mrbrklyn.com/mp3/hooked.mp3 - Spring is coming.... http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn.... 1-718-382-5752

2 1

Logs on /var/log/messages
by Leonel Rivas 28 Jan '02

28 Jan '02

Hello all I appreciate very much the answers to my question about launching-stopping services on demand, i was asking because of logs like this: sshd[5052]: Did not recieve identification string from ::ffff:66.92.175.131 or sshd[5054]: scanned from ::ffff:130.149.50.221 with ssh-1.0-SSH_Version_Mapper. Don't panic. (Both ip's are unknown to me) What should i do? What is the best way to secure (or trust in) SSH? Im using a Suse7.2 box (installed some days ago, so almost everithing is on defaults yet) Thanks __________________________________________________ Do You Yahoo!? Great stuff seeking new owners in Yahoo! Auctions! http://auctions.yahoo.com

2 1

Syslog and Chrooted application's logs
by Togan Muftuoglu 27 Jan '02

27 Jan '02

Hi, I have to chrooted services bind8 and apache. They are chrooted via compartment and I have a parameter which is identical in both of the init files init_bind8 (from the README of compartment) and init_apache DEV_LOG="/jail/dev/log" and in the /etc/rc.config file in SYSLOGD_PARAMS="-a /jail/dev/log" I have Chrooted bind loging properly to the main system log while chrooted apache persists to log "/jail/apache/var/log/httpd" What is the silly mistake I am doing here ? -- Togan Muftuoglu

4 3