October 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSE Security Announcement: postgresql (SuSE-SA:2002:038)
by Joerg Henner 23 Oct '02

23 Oct '02

On Mit, 23 Okt 2002, Armin Schöch wrote: >Usually these things are fixed and there are updates on the FTP >servers but the bugs are not considered very serious so no Security >Announcement is released by SuSE. If you use YOU frequently (I do it >about once every 1 or 2 weeks), you will notice many packages that are >updated without special Security Announcement. Hi, It makes no sense to me, to list "Pending vulnerabilities" within security announcements, but dont list then later anymore.... Greetings, -- Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 90 83 - 50 Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de ______________________________________ Inflex - eMail Scanning and Protection Queries to: postmaster(a)etes.de

1 0

AW: [suse-security] ssh exchange_identification fails
by Ulrich Roth 23 Oct '02

23 Oct '02

> -----Ursprüngliche Nachricht----- > Von: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] > Gesendet: Dienstag, 22. Oktober 2002 17:46 > An: suse-security(a)suse.com > Betreff: [suse-security] ssh exchange_identification fails > > > Hi, > > I try to ssh on my own box (local) and I got this: > ssh_exchange_identification: Connection closed by remote host... > > What's wrong? > > I haven't touched the conf files, the service is enabled SuSEFW2: > FW_SERVICES_EXT_TCP="pop3 smtp ssh" > > Any ideas? Do you try to login with an account that has a null password? Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

ssh exchange_identification fails
by Miguel Albuquerque 22 Oct '02

22 Oct '02

Hi, I try to ssh on my own box (local) and I got this: ssh_exchange_identification: Connection closed by remote host... What's wrong? I haven't touched the conf files, the service is enabled SuSEFW2: FW_SERVICES_EXT_TCP="pop3 smtp ssh" Any ideas? Thnx -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch

4 4

AmaVis or InterScan VirusWall
by Manuel Peña 22 Oct '02

22 Oct '02

Hello guys, I have a big doubt, When should I use AmaVis or InterScan VirusWall ? What are the differents between both? What is the better? Thanks, Manuel Peña Product Manager Softland Peru S.A. Telefono 471-2444 / Fax 471-2444 Movil 810-7988 mpena(a)softlandperu.com www.softlandperu.com

2 1

MS Messanger voice thru SuSEfirewall
by suse-sec＠orcaoffice.com 22 Oct '02

22 Oct '02

Hi all, Thanks for the answers to the previous question - my internal samba now works. My next problem is that I'd like to use MS Messenger voice thru my firewall. I've seen projects such as upnp and Linux UPnP Internet Gateway Device project, do I need to use them ? As you can guess I'm a very inexperienced iptables/firewall user, so I'd really appreciate any help you can give. Thanks CPH

2 1

Re: [suse-security] blowfish for hashing algorithm
by c v 21 Oct '02

21 Oct '02

wow fast reply... thanks for your help _________________________________________________________________ Get a speedy connection with MSN Broadband. Join now! http://resourcecenter.msn.com/access/plans/freeactivation.asp

1 0

blowfish for hashing algorithm
by c v 21 Oct '02

21 Oct '02

anyway..i was going through the pam documentation and i came accross something. I changed the default hashing algorithm from md5 to blowfish I did this by editing the files pam_unix2.conf and pam_pwcheck.conf in /etc/security it seems that it worked...once i changed my password using the passwd command the appropriate field in /etc/shadow became $2a$ instead of $1$ which signifies md5 . Has anyone else tried that?Any similar experiences? thanks in advance .......... _________________________________________________________________ Unlimited Internet access -- and 2 months free! Try MSN. http://resourcecenter.msn.com/access/plans/2monthsfree.asp

2 1

Firewall and samba
by suse-sec＠orcaoffice.com 21 Oct '02

21 Oct '02

Hi all, I have a fairly standard SuSEfirewall2 setup. However when I boot my machine I get the following when the firewall is started: "Warning detected activated samba, enabling FW_SERVICE_SMB! You still have to allow port tcp 139 on internal dmz and/or external." However it is not clear to me how I do this! Thanks for your help, CPH

2 1

Re: [suse-security] Firewall and samba
by GentooRulez 21 Oct '02

21 Oct '02

>Hi all, > I have a fairly standard SuSEfirewall2 setup. >However when I boot my machine I get the following when the firewall >is started: >"Warning detected activated samba, enabling FW_SERVICE_SMB! > You still have to allow port tcp 139 on internal dmz and/or external." > >However it is not clear to me how I do this! Stop samba with "etc/init.d/smb stop"or typing "rcsmb stop" edit "rc.config" and set "start_smb" to "no" regardz Michael

1 0

Tool to analyze firewall messages
by Al Bogner 21 Oct '02

21 Oct '02

In /var/log/messages I see messages like Oct 20 11:00:43 firewall kernel: SuSE-FW-DROP-DEFAULT IN=ippp0 OUT= MAC= SRC=61.0.114.198 DST=62.46.154.154 LEN=78 TOS=0x00 PREC=0x00 TTL=101 ID=3969 PROTO=UDP SPT=62302 DPT=137 LEN=58 I would like to see some whois data of the source IP in clear text and the destination port in clear text too. (Of course I know that 137 is the netbios-port) Is there an analyzing tool for these messages? Maybe like webalizer? Where can I define the log-file in FW2? I would like to have an own fw-logfile to have a better overview of the other messages Albert

7 8

SuSEFirewall2, IPSec -> SuSE-FW-UNALLOWED-TARGETIN
by Maik Ellinger 20 Oct '02

20 Oct '02

Hello, I've a little problem with denied packets if I use SuSEfirewall2 for protecting the VPN-Gateway. I get messages like this if I ping (or try to get a other connection like ssh) to a System in the internal Network through the ipsec tunnel: Oct 20 20:13:16 gigant kernel: SuSE-FW-UNALLOWED-TARGETIN=ipsec0 OUT= MAC=00:05:5d:0a:93:00:00:09:5b:24:3e:67:08:00 SRC=192.168.2.2 DST=192.168.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=25665 SEQ=1280 192.168.1.0/24 is the internal network which should be accessed from the Roadwarriors through ipsec from all other networks (in this test-case the roadwarrior is 192.168.2.2). My SuSEfirewall2 setup : FW_DEV_INT="eth0" # 192.168.1.0/24 FW_DEV_DMZ="eth1 ipsec0" # 192.168.2.0/24 FW_ROUTE="yes" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="500" FW_SERVICES_DMZ_IP="50 51" FW_FORWARD="192.168.1.0/24,192.168.2.0/24 192.168.2.0/24,192.168.1.0/24" Without the firewall all works fine. Can someone see my mistakes ? With the iptables-rules I can start the ipsec-tunnel and I can ping the IP (192.168.2.1) of the ipsec-Gateway. And all what I see are ESP-packets on the wire .. so I think the tunnel is ok. thanks a lot, -mael -- email: mael(a)m-ellinger.de -> www: http://www.m-ellinger.de GPG-Key: http://www.m-ellinger.de/output/mael.gpg Mitglied der Zwickau Linux User Group zLUG e.V. http://www.zlug.org

1 0

h232 over FW?
by Pep Serrano 20 Oct '02

20 Oct '02

Hi, Anybody using any h323 client over firewall? What ports do you need to open?

1 0

Online Test to check Suse-Firewall
by Al Bogner 20 Oct '02

20 Oct '02

Are tests at http://grc.com/ or at http://scan.sygatetech.com/ reliable to check the configuration of the Suse-firewall? Can you recommend other online-tests? Albert

3 2

harden_suse not maintained anymore?
by Richard Ems 19 Oct '02

19 Oct '02

Hi list! Is harden_suse not maintained anymore? >From the SuSE Linux 8.1 distro: # head /usr/share/doc/packages/harden_suse/CHANGES v3.5 12.06.01 (gamma release) * f*ck, I missed a / ... thanks to matthew(a)psychohorse.com for reporting v3.4 10.06.01 (gamma release) * wont disable some special SuSE 7.2 stuff: CRYPTO_FILESYSTEMS IDLED, POWERTWEAKD, PPTPD, IJB, IPPL, ARGUS, etc. v3.3 06.05.01 (gamma release) * wont disable SNORT, ADSL, NESSUSD and many many other things now which either do not affect security or are security daemons AND from /usr/lib/harden_suse/harden_suse-3.5.pl line 4: # Harden SuSE Linux 6.0 - 7.2, Perl Script by Marc Heuse <marc(a)suse.de> # line 38: $MAX_SUSE_VERSION="7.2"; lines 67-73: if ($suse_version > $MAX_SUSE_VERSION) { print STDERR "\007 WARNING: You seemed to have installed a SuSE version which is not yet supported by this hardening script! (Verified to work with 5.3 up to $MAX_SUSE_VERSION) Try to get an update from ftp://ftp.suse.com or http://www.suse.de/~marc ... Use at own risk!\n" } >From all this I conclude that it is not maintained anymore? I used it to build a firewall and would like to use it again when reinstalling it, but ... Is Marc Heuse not working anymore at SuSE? Is anyone maintaining his scripts? At http://www.suse.de/~marc/SuSE.html the last updated script is from the 8th January 2002! No errors/corrections/todo's anymore? Thanks for any info's, Richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Computer Science, University of Hamburg Unix IS user friendly. It's just selective about who its friends are.

2 1

New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

What do you think about the new tcp-stack exploit abfrag.c. Just true or only a hoax ?? best regards Michael

4 3

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>> Thats not what a asked. Assuming conn-track works fine and my >> ip-filter decides to drop the package. When will this take place ? >> Before defragmenting packet or with defragmented packets,. The >> last case means such an exploit would work. >Thats more than theoretical. If you do not know where the >bug is (if there is one) then why making the assumption >that part X is safe? Simply because not the netfilter code was adressed to be buggy, but the tcp "stack" implementaion. >It will probably only put you into wrong feeling of security if such a >bug really exists. No, dont think so. That is why i asked that theoretical question which is not answered until know. Will netfilter block such kind of packets when a attacker tries to root my box ??? Or is a malicious packets handled by the kernel before netfilter comes to inspect them ??? >Who tells that such a fragmented packet does not belong to a connection >at all? :) If you have a public webserver I guess its easy to have fragmented >packets for a tracked connection. This is another possibility to get infected, but it doesnt affect e.g. vpn router. >Anyway, its probably not necessary to discuss that if noone >knows any details. Dont think so. Its always good to talk about. GTIF Michael

1 0

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>> BTW. If i've a stateful inspection of my ip-packets and drop >> all packets not related to a connection i established such fragmented >> packets mentioned should not care me ?!? OR am i FALSE ?? >Why? Connection-tracking could be buggy too? ;-) Thats not what a asked. Assuming conn-track works fine and my ip-filter decides to drop the package. When will this take place ? Before defragmenting packet or with defragmented packets,. The last case means such an exploit would work. greetingz Michael

2 1

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>currently i belive its just a hoax, if you see the discussion >on bugtraq, the exploit shows that it works until kernel 2.4.20pre2x >which is far away from the actually relased develkernel (2.4.20pre11). >If not we've maybe a big problem ;) That can be a typo. BTW. If i've a stateful inspection of my ip-packets and drop all packets not related to a connection i established such fragmented packets mentioned should not care me ?!? OR am i FALSE ?? Michael

2 1

Sec. Update of KDE
by matthias-wieser＠t-online.de 17 Oct '02

17 Oct '02

Hi, are there any Suse advisories for KPF (part of KDE3) and kghostview? KDE recommends an update to KDE 3.0.4. At http://www.suse.de/de/private/download/updates/81_i386.html (I use Suse 8.1) and within YOU I could not find an update of KDE. Any advice? Matthias

11 16

RE: [suse-security] public key encryption
by Reckhard, Tobias 17 Oct '02

17 Oct '02

> I am wondering if people would comment on a security > configuration where a > PGP public key and private key are both well known, but the > private key is > protected with a very strong passphrase. Let's assume that > in this case, > that is the only security I can guarantee. How safe would messages > encrypted with the public key be? The maximum strength is determined by the passphrase. Weaknesses in the private key file format or other things could well lower the strength of the private key's secrecy. For a provocative question, define "a very strong passphrase". Why is the secret key in the hands of someone who mustn't have it? Is this party the root user? Tobias

6 5

compile freeswan on suse 8.1
by Andreas Marbet 17 Oct '02

17 Oct '02

Hello list, I know compiling questions are OT here but its about freeswan so you are the ones who perhaps had the same problem. I simply can't compile freeswan 1.98b (patched with x509 0.9.15) on a freshly installed suse 8.1 box. same thing worked well on several installations of suse 8.0. of course I could just take the rpm suse shipped on CD, but I really wonder what is going wrong. after submitting 'make menugo' or make 'xgo' it starts with kernelconfiguration then begins to compile and after about one hour (PIII 500MHz) it stops with an error. the last lines of out.kbuild are as follows: gcc -D__KERNEL__ -I/usr/src/linux-2.4.19.SuSE/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i586 -DMODULE -Ilibfreeswan -Ilibdes -Wall -Wpointer-arith -Wstrict-prototypes -DKBUILD_BASENAME=ipsec_tunnel -c -o ipsec_tunnel.o ipsec_tunnel.c In file included from /usr/src/linux-2.4.19.SuSE/include/linux/skbuff.h:27, from /usr/src/linux-2.4.19.SuSE/include/linux/netdevice.h:147, from ipsec_tunnel.c:38: /usr/src/linux-2.4.19.SuSE/include/linux/highmem.h: In function `bh_kmap': /usr/src/linux-2.4.19.SuSE/include/linux/highmem.h:22: warning: pointer of type `void *' used in arithmetic ipsec_tunnel.c: In function `ipsec_tunnel_start_xmit': ipsec_tunnel.c:995: warning: deprecated use of label at end of compound statement ipsec_tunnel.c:1728: warning: deprecated use of label at end of compound statement ipsec_tunnel.c:1748: too many arguments to function `ip_select_ident' make[3]: *** [ipsec_tunnel.o] Error 1 make[3]: Leaving directory `/usr/src/linux-2.4.19.SuSE/net/ipsec' make[2]: *** [_modsubdir_ipsec] Error 2 make[2]: Leaving directory `/usr/src/linux-2.4.19.SuSE/net' make[1]: *** [_mod_net] Error 2 make[1]: Leaving directory `/usr/src/linux-2.4.19.SuSE' anybody have an idea or successfully compiled it himself? Andreas

1 0

Re: [suse-security] /var/log/warn messages
by Thomas Lamy 17 Oct '02

17 Oct '02

No need to worry, it's just some kazaa client trying to connect to your ip. If you have no static ip, it maybe somebody who got your current ip before used kazaa Thomas Piet Roorda [mailto:prooroa@wanadoo.nl] wrote: > > is tyhis healthy or to worry? > piet > > Oct 17 12:20:13 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 > ID=65004 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 > SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:20:14 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=120 ID=749 > DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:06 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=23468 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=28588 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=32428 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > Oct 17 12:36:08 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= > SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 > TTL=118 ID=36012 > DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT > (0204058401010402) > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

/var/log/warn messages
by Piet Roorda 17 Oct '02

17 Oct '02

is tyhis healthy or to worry? piet Oct 17 12:20:13 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=65004 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:20:14 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.73.226.105 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=120 ID=749 DF PROTO=TCP SPT=1238 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:06 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=23468 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=28588 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:07 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=32428 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Oct 17 12:36:08 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=213.51.24.214 DST=213.17.32.99 LEN=48 TOS=0x00 PREC=0x00 TTL=118 ID=36012 DF PROTO=TCP SPT=1527 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402)

1 0

Updated packages and ghostview/ghostscript flaws
by Bonemach 17 Oct '02

17 Oct '02

Hi I recently visited the update-pages of suse and noticed a lot of security-related packages that are related to flaws in Ghostview and ghostscript. Some of these packages I have never heard of (like cmap-adobe or CID-keyed-fonts). What are these packages and what is wrong with it? The descriptions on the site are not very detailled. Why should I update this stuff ? I know of two vulnerabilities that are related to malicious pdf or ps documents. One is in ghostscript (CAN-2002-0363). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363 and another is in ghostview (CAN-2001-0832). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0832 How do I know what packages fix one of these vulnerabilities (if they indeed do so)? Greetings Bone Machine (in despair) --- "Somebody got hurt" - The Pixies ---

4 3

public key encryption
by Dale Johnson 17 Oct '02

17 Oct '02

I am wondering if people would comment on a security configuration where a PGP public key and private key are both well known, but the private key is protected with a very strong passphrase. Let's assume that in this case, that is the only security I can guarantee. How safe would messages encrypted with the public key be? comments? Dale Johnson.

1 0