January 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Which ISP owns some IP?
by Barry Gill 25 Jan '02

25 Jan '02

:: How can i know the owner of an IP address. There is no ::reverse mapping ::for dial-up address but each ISP has his own range of IP's. :: :: Could I know from where connecctions come, far away from ::traceroute? ::Yes, it could be IP spoofing but ... Depending on which country it originates form you can use whois available on ARIN www.arin.net This is for the american registrar, there is RIPE www.ripe.net for european addresses

1 0

Which ISP owns some IP?
by Juan Carlos S.C 25 Jan '02

25 Jan '02

Hello * : How can i know the owner of an IP address. There is no reverse mapping for dial-up address but each ISP has his own range of IP's. Could I know from where connecctions come, far away from traceroute? Yes, it could be IP spoofing but ... Thanks.

3 2

sysadmin ethics after security breach
by Matt Hubbard 25 Jan '02

25 Jan '02

List, Assuming you can positively identify the origin of a successful crack (and that's a big assumption considering drones, spoofing, etc.) what does the community of sysadmins think about vigilante justice? Should we just counter-strike if there is no legal recourse? As a young sysadmin, I am looking for a moral principle. Responding in a legal manner is what distinguishes us from the cracker, right? Still, I get very angry just thinking about the possibility of a successful attack on one of my systems. Any thoughts? Apologies if this seems off topic - but I am studying many of the popular attacks and as a result I am in the difficult position of knowing how to use them (as well as defend against them). Matt Hubbard

4 3

postfix content filtering
by Dirk Borchers 25 Jan '02

25 Jan '02

hi to all, i configured postfix to check header and body for special filenames. but the emails are not rejected. in main.cf are the following lines: header_checks = pcre:/etc/postfix/pseudo_content_filter body_checks = pcre:/etc/postfix/pseudo_content_filter in /etc/postfix/pseudo_content_filter are lines like /^.*filename=.*\.jpg.*$/ REJECT if something like filename="Winter.jpg" is in the body or in the subject, the message is rejected. but mails with headers like Content-Disposition: attachment; filename="Winter.jpg" Content-Transfer-Encoding: base64 Content-Type: image/jpeg; name="Winter.jpg" Date: Fri, 25 Jan 2002 10:00:03 +0100 still get delivered. what am i missing? thanks in advance, dirk

1 0

RE: [suse-security] which cipher for ssh2
by Reckhard, Tobias 25 Jan '02

25 Jan '02

> 112 bit key = 164 years. > 160 bit key = 46,343,912,903,694,283 years. > 1024 = > 57004475357125694689539104223396268823502567825415606695024759 > 37269554661513 > 85601004275993538836681954338260654082297557264046704764131857 > 21983584043465 > 91970375694235948296717285077993443876652697015567988489528438 > 55120124119935 > 5703764368040995282761394929943067804992387977103 years > > As you can unless NP=P, or barring some breakthrough in > quantum computing > key lengths should stay well ahead of brute force key > factoring for some > time. I'm not out for an argument and, as I said, the 80/90 bits figure isn't from me and it's from memory. If you want, I can forward your mail to my colleague as a question. Don't confuse asymettric and symmetric key lengths, though. The latter are currently no higher than 320 bits, while those of the main proponents of the former, namely RSA or DH/DSA, aren't lower than 512 bits and should be 1024+. RSA is worthless unless the primes are large enough. Cheers Tobias

2 1

/var/log/wtmp hacked or not?
by Karsten Schell 25 Jan '02

25 Jan '02

here is excerpt of a last-output on one of my servers, running suse 7.3, kernel 2.4.10 at that time, iptables: (only suspicious entries listed) ****0*** 0*******0*** ****0*******0*** Sun Apr 7 02:39 - down (10116+22:01 ****0*** 0*******0*** ****0*******0*** Sun Apr 7 02:39 - down (10110+13:22 ****0*** 0*******0*** Thu Jan 1 01:00 - 02:39 (1557+01:39) ****0*** 0*******0*** ***** Thu Jan 1 01:00 - 01:00 (00:00) ****0*** 0*******0*** ****0*******0*** Sun Apr 7 02:39 - 01:00 (-1557+-1:-3 ****0*** 0*******0*** ****0*******0*** Thu Jan 1 01:00 - 02:39 (1557+01:39) ****0*** 0*******0*** ****0*******0*** Thu Jan 1 01:00 - 01:00 (00:00) ./chkrootkit 0.35 says deletion(s) between Mon Nov 26 20:12:47 2001 and Mon Nov 26 21:37:23 2001 3 deletion(s) between Mon Nov 26 22:33:28 2001 and Mon Nov 26 23:36:26 2001 36 deletion(s) between Mon Nov 26 23:56:41 2001 and Tue Nov 27 04:52:53 2001 8 deletion(s) between Tue Nov 27 21:51:09 2001 and Wed Nov 28 00:43:39 2001 1 deletion(s) between Wed Nov 28 21:32:43 2001 and Thu Nov 29 00:53:53 2001 13 deletion(s) between Thu Nov 29 00:53:53 2001 and Thu Nov 29 05:11:14 2001 10 deletion(s) between Thu Nov 29 05:11:19 2001 and Sun Apr 7 02:39:04 1974 1 deletion(s) between Sun Apr 7 02:39:04 1974 and Mon Dec 3 00:13:33 2001 1 deletion(s) between Wed Dec 5 14:35:24 2001 and Thu Dec 6 00:13:11 2001 7 deletion(s) between Thu Dec 6 00:19:44 2001 and Thu Dec 6 02:27:55 2001 8 deletion(s) between Thu Dec 6 02:28:00 2001 and Fri Dec 7 08:52:34 2001 2 deletion(s) between Sun Apr 7 02:39:04 1974 and Tue Dec 11 15:09:46 2001 Well chkrootkit is of course mixed up by the wrong dates (1974). Besides the tempered wtmp there seems to be nothing wrong. Could this be caused by some bug ? I dont find anything suspicious in the logs. the faulty wtmp entries are within 14 days, after that no more faulty ones. What else could I do to check the system ? Since there is nothing else wrong I don't want to install everything from scatch when I am not sure its hacked!? thank you

5 6

RE: [suse-security] which cipher for ssh2
by Reckhard, Tobias 25 Jan '02

25 Jan '02

> Which cipher would be safest for ssh v2 ? > I have to choose from AES 128-256 ,RC4,Twofish ,3DES,Blowfish? Disclaimer note: This is all in some people's opinions. No liability is accepted whatsoever. And it's from the back of my head, so take it with a grain of salt. First, a bit on *symmetric* key lengths, though. A cryptographer colleague of mine says that nowadays, keys of 80 or 90 bits length (I forget which of the two, it's less than 112 bits and that's the point) are considered practically unbreakable by brute-force methods. This is a statistical fact, because *on average* you need to test half of the keyspace to find the correct key. Of course, you can be lucky in one attempt and find the key at the first (or the first 10^x, x < e.g. 10) attempts, or be unlucky and have to search the entire keyspace, which amounts to never being able to find the key. It makes good sense to change symmetric keys regularly (SSH does this). However, as long as the cipher algorithm is sound, currently 112 bits and higher can be considered safe. On a sidenote, it is also perfectly safe today to use 1024 bit RSA keypairs. 4096, 8192 or even more bits currently merely serve to induce a performance penalty. 2048 bits are OK, too. * AES (aka Rijndael): Is fast and should be pretty secure, has undergone quite a bit of public verification in a good process (NIST AES challenge). Some people have reservations about its security because it uses a relatively new technique and IIRC doesn't use as many 'cycles' as they'd like. * RC4: Don't know much about it. It's used extensively on the Web. * Twofish: Schneier's AES candidate made it into the final round and can therefore be considered secure and fast. IIRC, it's slower than Rijndael, though, inducing more of a performance hit. Whether that matters in your case is a different matter. The choice between Twofish and Rijndael is probably more of a matter of personal taste. * 3DES: The classic. Safe and well tested, but real slow. * Blowfish: Fast. Should be secure, but probably hasn't been cryptanalysed as much as 3DES, Twofish and Rijndael, so there might be undiscovered problems. I wouldn't sweat that personally, though, and use Blowfish or Rijndael on old hardware. Another note: All of the ciphers above are so hard to break that attackers typically won't bother with them. Instead, they'll attack the endpoints, i.e. SSH client and server. Remember the apache.org breakin. A legit user had a trojaned, password-sniffing SSH client, which transmitted the passwords to the attackers. The connection wasn't attacked, the endpoint was. Similar as in Web attacks. Hackers currently don't often attack the connection, be it SSL-encrypted or not. They attack the servers, it's still so much easier. Cheers Tobias

2 1

RE: [suse-security] secure way of rsyncing ?
by Reckhard, Tobias 25 Jan '02

25 Jan '02

Sven Michels wrote: > Jens Georg wrote: > > i have to keep three servers uptodate and i would like to > do this using > > rsync. as far as i know there are several security concerns > about rsync, so > > is there another tool available that can do this for me ? > btw ... i am using > > sftp to encrypt my ftp-session ? maybe there's a similiar > tool for rsync > > available, too ? > > use rsync over ssh (-e ssh) and all will be fine ;) > you can use dsa/rsa keys for authentification like sftp/ssh > does and that should solve your problem You may find it a bit of a problem that to use SSH, the user account you're connecting to on the SSH server needs a shell to be able to execute the rsync command. You can take most of the risk out of this by specifying the command to be called in the SSH public key used for authentication, though. Use the following option in the public key: command="[<PATH>]rsync --server --sender -vlogDtpr <source path>" This pulls data from the server, if you with to 'push' data to the server, you'll probably need to replace the '--sender' option with something else or remove it alltogether -- I'm not looking at the man-page right now but quoting from a personal implementation reference. Cheers Tobias

1 0

Security issues...
by Mike Garabedian 24 Jan '02

24 Jan '02

... I am building a box for a firm that wants IMAP, POP3, Apache, SQwebmail, VPN. I am working on the documentation and setting up the components. Are there any hints and ideas you gurus may have that may point me in a good direction so that I may build this correctly. Security is a big concern. I would like to shut down everything that is not needed, and maybe use a piece of software to make the rules for which ports are allowed and whatnot. I am a newbie to this and have learned quite a bit up until now, but am entering unfamiliar territory. Any help is greatly appreciated.

1 0

which cipher for ssh2
by Karsten Schell 24 Jan '02

24 Jan '02

Hi there! Which cipher would be safest for ssh v2 ? I have to choose from AES 128-256 ,RC4,Twofish ,3DES,Blowfish? -- Best regards, Karsten mailto:efbiei@gmx.de

1 0