November 2002 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

Urgggggg!!! SuSEFirewall2 is getting on my nerves!!!!!
by Chris Bek 08 Jan '03

08 Jan '03

Hi there SuSErs... Well I must be doing something really wrong because everything that I do with SuSEFirewall2 is just not working! I have a small network with 5 PCs (all Win9X) and a Linux box (Currently SuSE 7.3) acting as a server. The server is a DHCP server and a Samba server for the entire network. So far everything is working perfect!!! Users log on the network, logon script executes etc.... Then a new task came up: let's input the internet into the network. Configured a 56Kbps modem on the server with YAST. Manged to get my account setup and running. Made a test connection and netscape works great on the server as well as e-mail (pop3). I tried configuring SuSEfirewall to manage all incoming requests from the PCs of the network. The firewall warned me about masquerading etc. so I downloaded the latest version of SuSEfirewall2 from the internet and installed it. Since I only need direct masquerading to be done (no proxies are currently working on the net) I made all the necessary changes as outlined in the examples supplied with the software. Since I needed to have Samba to keep working on the network, I opened (among others) 139 port for samba to work. Double checked all the changes that I have made and run rcSuSEfirewall2 to see what happens. Strange enough when wvdial executes it tells me that DNS is not functioning properly since www.suse.com cannot be found (or something like that please forgive me I am away from the Linux station now). Further on, when I open mIRC or other like programs (winmx etc) from a station, I look at the activity of IPtraf (I check this to see what happens) and I see no connections being created whatsoever.... mIRC prompts me that there was an error trying to find the host.... I have made no changes to the Win9X PCs. Is there something that I am forgeting to do?? I undestand that it is impossible for all of you to react to this since I have no output of the SuSEfirewall.conf file being published to this message.... I understand. Can someone please send me their configuration file so I can see what you have done, on a system that currently is working fine?? In addition, is there something that I have to do regarding route or routing?? What about the Win9X PCs?? Is there something that I have to do there?? I thank you so very much for all your help is advance!!!! I am killing myself trying to figure this one out for about 2 weeks now and managed nothing more than thin air!!!!! Chris

11 10

sendmails default-mailbox size?
by Guido Schiffer 30 Nov '02

30 Nov '02

Hi Folks, finally I managed to run a receiving sendmail with a dyndns-Domain (using defaults and webmin helps fine *g-*) No my prob: The last german LAN-Line contained a mailserver-test-suite, which i ran. While running the tests the suite sends tons of mails and my mailbox has been overflown (about 49 megs!). Fetching mails of the tested account wasn't possible anymore Server-answer: Unable to copy mail spool file to temp dropbox /var/mail/.gschiffer.pop: No space left on device (28) I killed all the files which are connencted with the account and touched /var/spool/mail/gschiffer. It works again samba:/var/spool/mail # df -h /var/ Filesystem Size Used Avail Use% Mounted on /dev/hdc2 164M 78M 86M 48% /var samba:/var/spool/mail # Has anyone of you an idea about the default mailbox-size and how I can fix to e.g. 10 megs and how I can prevent mailbombing on certain accounts? Thx for tipps CU Guido

3 2

mail script scanner
by Alex Levit 30 Nov '02

30 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- Somebody is exploiting a php mail script on my web-server and use it for sending spam. I dont't have any formmail.pl or any other perl based scripts. I host about 50 domains on this server with large amount of content. And can't seem to find that script. All the scanners I found only check for vulnerable perl scripts. If somebody knows of a good mail script scanner that checks php please let me know. -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQDVAwUBPeUOuOCcv2bLcfmfAQFLzwX9FQ33JltdGRfmzx/+P0Yojyc7lCaIWpG7 k3mVu/PohOV/CqWl95C+b83DUjqD5mIZ6ASrZ99hRDwfY0nBLDm8LiswO0l8ZVpZ 2ywtfdHsO+d9Y5D8fayMopJgdZa34shK8xBcCVeIyFDFHwNv2rFC9Gt79KIgiUT/ ppSYwKYsYVY4rEMmLzL2TI1o9LqJZKhdYeM4o7MupPUEhDQuzMvoUIS0MCjLYBGx UlsFQVySjhu15kngh0+0v1Qa/EQnF4jt =4Xyb -----END PGP SIGNATURE-----

4 4

Pix
by Grupo DIGNITAS 30 Nov '02

30 Nov '02

Hi list: Does somebody know where I can find documentation about as configuring a firewall PIX so that it allows traffic SSH? Sorry for the question, but I am half desperate. Ernesto

2 1

RE: SuSEfirewall2: external ip aliases with forward / masq?
by Howard, Neal 29 Nov '02

29 Nov '02

I tried these configs and having the aliases eth0:1 and eth0:2 only in FW_DEV_DMZ and all I got was SuSE-FW-UNAUTHORIZED-TARGET and by adding eth0 in there as well got me SuSE-FW-DROP-SPOOF messages in my logfile. By putting the aliases in FW_DEV_EXT, I obtained more progress in that I can now see SuSE-FW-ACCEPT-TRUST inbound messages from my test machine (emulated vendor) and destined for the ip address of the eth0:1 alias, but a complete lack of the FW_FORWARD_MASQ operation happening. According to all the examples I've looked at, it seems the first ip address in each line of FW_FORWARD_MASQ must be the outside address coming in (i.e. my vendor who wants to get to one of my my internal pcanywhere hosts), and the second address in each FW_FORWARD_MASQ line is the internal address of the destination internal host. I guess what I need is a was to specify three ip addresses for each forward_masq operation, first the originating source address, secondly the external ip alias on the firewall, and thirdly the interior ip address of the particular pcanywhere host something like: vendor's ip address = x.y.z.123 external ip of eth0 = a.b.c.100 external ip of eth0:1 = a.b.c.101 external ip of eth0:2 = a.b.c.102 interior pcanywhere host 1 = 192.168.1.10 interior pcanywhere host 2 = 192.168.1.11 interior pcanywhere host 3 = 192.168.1.12 If only the FW_FORWARD_MASQ supported the concept of three addresses such as: source_ip,firewalls_external_ip,interior_destination_ip,protocol,portnumber then I'd be really happy. FW_FORWARD_MASQ = "x.y.z.123,a.b.c.100,192.168.1.10,tcp,5631 \ x.y.z.123,a.b.c.100,192,168,1,10,udp,5632 \ x.y.z.123,a.b.c.101,192.168.1.11,tcp,5631 \ x.y.z.123,a.b.c.101,192.168.1.11,udp,5632 \ x.y.z.123,a.b.c.102,192.168.1.12,tcp,5631 \ x.y.z.123,a.b.c.102,192.168.1.12,udp,5632" but alas, it only supports two ip addresses of originating source and final internal destination like: FW_FORWARD_MASQ = "x.y.z.123,192.168.1.10,tcp,5631 \ x.y.z.123,192,168,1,10,udp,5632" and putting the external firewall address in the first part, doesn't work If anyone has any other ideas of making such a scenario work, I'd sure appreciate the help, otherwise I guess I'm going to go back to the single external ip on the firewall with alternate port numbers for my various interior pcanywhere hosts and just tell my vendor that his poor little childish support staff are just going to have to learn how to deal with using alternate ports in their pca remotes, that this is all I can support on my end and if he wants to continue to get my business he'll have to do things my way. -----Original Message----- From: Togan Muftuoglu Sent: Tuesday, November 26, 2002 5:37 PM To: Suse-Security Subject: Re: [suse-security] SuSEfirewall2: external ip aliases with forward / masq? * Howard, Neal; <nhoward(a)cwftx.net> on 26 Nov, 2002 wrote: >I'll try it out tomorrow, it's been a long day here in Texas too and my >brain hurts right now! I know the feeling :-) > >I'm guessing I should use the external ip aliases in the first part of >each stanza of FW_FORWARD_MASQ instead of putting the vendor's ip address >in that place like I was doing? Now although I said > >FW_DEV_EXT="eth0 eth0:1 eth0:2" It's better to have the aliases eth0:1 and eth0:2 in FW_DEV_DMZ and then FW_FORWARD_MASQ them for the vendor this way it should be both secure and doable (cross your fingers) -- Togan Muftuoglu -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

e2fsprogs-1.28 could corrupt directories
by Richard Ems 28 Nov '02

28 Nov '02

Hi list! This could be slightly off-topic, but isn't data corruption security related? SuSE 8.1 was delivered with e2fsprogs-1.28, which has a "fencepost error" (???) which could cause directory corruption. Please read the following mail extracted from linux-kernel mailing list: ====================================================================== On Tue, Nov 26, 2002 at 10:55:10AM -0500, Clemmitt Sigler wrote: > The e2fsck run seemed to me to go normally. It reported that it > optimized some directories, but this has happened on other auto-fscks > of my ext3 filesystems without corruption under earlier kernels. > (This > is the first corruption I've seen in many, many years.) But I didn't > capture the messages :^( and they don't get written into > /var/log/messages (that I could find). Ah, ha. I think I know what happened. What version of e2fsprogs were you using? If it was 1.28, that would explain what you saw. There was a fencepost error that could corrupt directories when it was optimizing/rehashing them. This bug was fixed in in the next version, which was rushed out the door as a result of this bug. Fortunately, 1.28 didn't get adopted by any distro's as far as I know, and not that many people downloaded and compiled e2fsprogs 1.28. If you're not using the latest version of e2fsprogs, which is e2fsprogs 1.32, I'd strongly suggest updating to it. Version 1.28 is just *so* three months ago. :-) - Ted P.S. If you do have a directory which is corrupted by e2fsck 1.28, no data is lost; it just created a directory entry which is too small, so it triggers the sanity checks in the kernel. Running e2fsck version 1.29 or later will unbork the directory. ====================================================================== -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Computer Science, University of Hamburg Unix IS user friendly. It's just selective about who its friends are.

2 1

Re: [suse-security] reject identd on firewall
by Ralf Ronneburger 28 Nov '02

28 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Andreas, hi Gert, now it works! I don't know exactly what was the problem, but I've now included only these rules für every mailserver: ~ $IPTABLES -I INPUT 1 -p TCP -s $ms --dport 113 -j REJECT - --reject-with tcp-reset ~ $IPTABLES -I FORWARD 1 -p TCP -s $ms --dport 113 -j REJECT - --reject-with tcp-reset and now I can send mail instantly, no DENYs any more. Without the --reject-with it did not work though, looks like Gert was right - packages without a reject-type seem to be just dropped, although iptables -L -v said something else. Thank you very much for your help! Best regards, Ralf Andreas Baetz wrote: | On Wednesday 27 November 2002 18:34, Ralf Ronneburger wrote: | |>Hi Andreas, |> |>Andreas Baetz wrote: |> |>>You could try more general rules like |>>iptables -I INPUT 1 -p TCP --dport 113 -j REJECT |>>iptables -I INPUT 1 -p TCP --dport 113 -j LOG --log-prefix " Input |>>identd" iptables -I FORWARD 1 -p TCP --dport 113 -j REJECT |>>iptables -I FORWARD 1 -p TCP --dport 113 -j LOG --log-prefix " Forward |>>identd" |>> |>>In this case the first 2 rules should be |>>1. Logging |>>2. Rejecting |>>anything that goes to port 113 |> |>Thanks for your help. But now it becomes even more strange: First I get |>two log-entries for droped packages, then I get two log-entries for |>rejected packages. But they look very much the same to me: |> |> |>Nov 27 18:25:29 internet kernel: DROP-TCP IN=ppp0 OUT= MAC= |>SRC=<Mailserver-IP> DST=<External-IP> LEN=44 TOS=0x00 PREC=0x00 TTL=52 |>ID=32011 PROTO=TCP SPT=1953 DPT=113 WINDOW=16384 RES=0x00 SYN URGP=0 |> |>Nov 27 18:28:15 internet kernel: Input identd IN=ppp0 OUT= MAC= |>SRC=<Mailserver-IP> DST=<External-IP> LEN=44 TOS=0x00 PREC=0x00 TTL=52 |>ID=36212 PROTO=TCP SPT=1991 DPT=113 WINDOW=16384 RES=0x00 SYN URGP=0 |> | | You could check the following: | What happens if you comment out the actual REJECT Rule, leaving only | the LOG Rule in place ? Does one packet get logged twice ? | Do you have the netfilter code compiled as modules or into the kernel ? Maybe | not all modules are loaded the first time ? | | Andreas | | - -- - ------------------------------------------------------------ Ralf Ronneburger ralf(a)ronneburger.de Prefers to receive encrypted Mail, download public-key from http://www.ronneburger.de/gpg/ralf_ronneburger.asc - ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE95oHTLbWu9MVtJiYRAiSTAJ9UvwXGWO0VP36eKL9Hud37nXSwRQCglEPR G4X4ytNvWof4V16/AVm4xHw= =WAZS -----END PGP SIGNATURE-----

1 0

reject identd on firewall
by Ralf Ronneburger 28 Nov '02

28 Nov '02

Hello, I'm having some trouble with a mailserver outside when I send mail through my firewall. The mailserver wants to connect to port 113 on my box, which is closed, so the connection times out and sending mail seems to last endlessly. That's why I've added these 2 rules to my firewall-script: $IPTABLES -A INPUT -i $EXT -p TCP -s $ms --dport 113 -j REJECT $IPTABLES -A FORWARD -i $EXT -p TCP -s $ms --dport 113 -j REJECT where $EXT is my external device and $ms is the mailserver. But still I get entries like these in my logs: Nov 26 20:26:52 internet kernel: DROP-TCP IN=ppp0 OUT= MAC= SRC=<Mailserver-IP> DST=<my external IP> LEN=44 TOS=0x00 PREC=0x00 TTL=52 ID=38856 PROTO=TCP SPT=3672 DPT=113 WINDOW=16384 RES=0x00 SYN URGP=0 wich means, that the last rule (reject everything) catches those requests. What do the rules have to look like to reject identd? Thanks in advance, Ralf Ronneburger

5 10

ipchains and Portscan
by Volker Spies 28 Nov '02

28 Nov '02

Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

4 7

RE: [suse-security] Security and Update
by Reckhard, Tobias 28 Nov '02

28 Nov '02

> On Wed, 27 Nov 2002, Alex Levit wrote: > > > On the subject of YOU, there are plenty of people using > SuSE's YOU on this > > list and we don't experience such problems. Look somewhere > else for possible > > problems. > > I'm using YOU and for single machine maintenance I've been quite happy > with it. Switching to fou4s now that I'm going large-scale with SuSE > 8.0, as 80 YOU windows is more than I want to handle. Note that SuSE has obviously been working heavily on YaST2 and YOU development from 7.3 to 8.1. In 7.3, the ncurses-based (i.e. ASCII) GUI was terrible, it's definitely better (more responsive) in 8.1. YOU was the pits in 7.3. I experienced the same problems as the original poster, probably, I've ignored some inbetween mails in this thread. After I'd installed 7.3, YOU worked. It got slower and slower with every time I used it after that, eating more and more memory. After a couple of weeks it would terminate without doing its job on the lower-end machine of the two I have, with 64 MB of physical RAM and a 128 MB swap. Note that it had been swap-thrashing for quite some time before that. YOU in 8.0 is a lot more conservative in memory use. I've switched to fou4s for its easier automated use and useful features over YOU, not planning to go back. Just wanted to say that you can't judge YOU on a 7.3 system when all you know is 8.0 or 8.1. They're very different in behaviour, believe me. Tobias

1 0

Re: [suse-security] Security and Update
by GarUlbricht7＠netscape.net 28 Nov '02

28 Nov '02

DJ: I am aware that your question got answered and this thread may be already "beat to death" but I thought I would add my 2 cents. I agree that the first time I used YOU (Yast Online Update", I didn't know what happened so I tried it again, and again.... However,alot of the documentation is right there in the window. I agree it only made sense to me after I had tried YOU several times to see what happened. You may enjoy "fou4s" more, but if you decided to use YOU, I suggest reading: <file:/usr/share/doc/packages/yast2-config-online-update/y2c_online_update.html> which should be on your system. In addition to "man pages" and "--help", I am finding the "read me files" in "usr/share/doc/packages/" very helpful. I access them via Konqueror. I have also found that in addition to SuSE, people like Togan <http://dinamizm.ath.cx/> and the LINUX Documentation Project <http://en.tldp.org/> have already answered many my questions. HTH Gar ********* DJ <linux_programmer(a)hotmail.com> wrote: >MG> I'd suggest you to try fou4s (http://fou4s.gaugusch.at/) it offers you >MG> the possibility to install security fixes only (fou4s -is) as well as >MG> automatic checking/downloading/updating. I think this functionality is in >MG> YOU of SuSE 8.1, too, but yast2 online_update --help doesn't give any >MG> information about it :( > >Thank you! I'm going to checkout fou4s. The documentation for SuSE is >extremely lacking. Lots of errors in the manuals and lots of missing >information. It seems like the documentation also has a hard time >keeping current with the SuSE version. > >I just ran YOU in manual mode and there is no help wants so ever, that >I could find. After the screen repainted with the downloaded >information, I didn't have a clue what to do next. I posted in the >suse-e list, so I don't want to take up any more of your time on YOU. > >I sure wish the SuSE specific documentation was better. > >I'm definitely going to look at fou4s. > >Thank you again. > >-- >__________________________ >DJ >mailto: linux_programmer(a)hotmail.com > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

6 5

Re: [suse-security] Security and Update
by Jim Westbrook 28 Nov '02

28 Nov '02

Markus, I downloaded the latest release of fou4s and tried it again. With the single exception of a library dependency for KDE, all updates were received and installed. Thank you for the time required to create/maintain your utility. JimW Markus Gaugusch wrote: > > > On the subject of YOU, I had to reinstall a SuSE 7.3 last week. When I > > attempted to grab the YOU updates, the system crashed (no kybd response, etc.) > > requiring a cold boot recover. Once back to running, I tried YOU again, from > > the cli, and it again performed the package check then crashed the system. > > > > I then tried YOU on another SuSE 7.3 box - and after the package check > > it crashed that system as well. I've given up on YOU, but the > > alternative app doesn't work for me either. > I guess, you mean my fou4s as "alternative app". If you have problems with > it, I'd appreciate to hear about them. > I just want to make it as powerful, easy and useful as possible (and last > but not least: working). > > kind regards, > Markus Gaugusch > > -- > __________________ /"\ > Markus Gaugusch \ / ASCII Ribbon Campaign > markus(a)gaugusch.at X Against HTML Mail > / \

1 0

Squirrelmail as shipped with SuSE 81..Was it fixed?
by Matthew Johnson 28 Nov '02

28 Nov '02

Just wondering if Squirrelmail as shipped with SuSE has this vulnerability: http://www.iss.net/security_center/static/10145.php Thanks :) -- Matthew Johnson <matthew(a)psychohorse.com>

1 0

IIS Worms
by Mario Ohnewald 27 Nov '02

27 Nov '02

Hello! What can i do against these worms? [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..Á^\../winnt/system32/cmd.exe [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:18:53 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..Á234../winnt/system32/cmd.exe [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..%5c../winnt/system32/cmd.exe [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..%2f../winnt/system32/cmd.exe [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/scripts/.%2e/.%2e/winnt/system32/cmd.ex [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] File does not exist: /usr/local/httpd/htdocs/scripts/..%5c%5c../winnt/system32/cmd. [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 07:59:16 2002] [error] [client 210.241.51.68] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): / [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/scripts/root.exe [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/MSADC/root.exe [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/scripts/root.exe [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/MSADC/root.exe [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/c/winnt/system32/cmd.exe [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/d/winnt/system32/cmd.exe [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html How can i reverse the ip to an address like whois does. What do u do against it? I am just bothered because of my mini bandwitdth. cheers, Mario

4 3

RE: [suse-security] RE: SuSEfirewall2: external ip aliases with forward / masq?
by Howard, Neal 27 Nov '02

27 Nov '02

>-----Original Message----- >From: Togan Muftuoglu >Sent: Wednesday, November 27, 2002 12:29 PM >To: 'suse-security(a)suse.com' >Subject: Re: [suse-security] RE: SuSEfirewall2: external ip aliases with >forward / masq? > > >* Howard, Neal; <nhoward(a)cwftx.net> on 27 Nov, 2002 wrote: >> >>but alas, it only supports two ip addresses of originating source and final >>internal destination like: >> >>FW_FORWARD_MASQ = "x.y.z.123,192.168.1.10,tcp,5631 \ >> x.y.z.123,192,168,1,10,udp,5632" > >Actually there is one more parameter that you can do which is the >destination port > > x.y.z.123,192.168.1.10,tcp,5631,5858 > >source_ip,destination_ip,protocol,destination_port,redirected_port Ah, I can see how this will surely come in handy for other things. > >This will mean you will be setting the pcanywhere ports on your machines Sure looks that way... Oh well, the vendor will just have to accept it. --neal

1 0

kernel question
by Piet Roorda 27 Nov '02

27 Nov '02

well if I mess up it is a security risk so: does kernel-source-2.4.19.SuSE-69.nosrc.rpm match with k_deflt.2.4.19-110.rpm? piet

1 0

problem with ICMP-Kernelparameter
by Torsten Pregel 27 Nov '02

27 Nov '02

hi list, i have linux kernel 2.4.18 and system suse 8 prof. the problem is, the kernel create not to follow files: ../ipv4/icmp_echorepley_rate ../ipv4/icmp_destunreach_rate ../ipv4/icmp_paramprobe_rate ../ipv4/icmp_timeexeed_rate thanks ps. sorry for my english --

1 0

RE: [suse-security] IIS Worms
by mailinglists＠belfin.ch 27 Nov '02

27 Nov '02

does such a thing also exist for a squid if you use it as a reverse proxy? > -----Original Message----- > From: studio3arc.com Admin [mailto:admin@studio3arc.com] > Sent: Wednesday, November 27, 2002 5:12 PM > To: mailinglists(a)belfin.ch; suse-security(a)suse.com > Subject: RE: [suse-security] IIS Worms > > > > > > > Hi > > > > to me this looks like some kind of nimda or code red. > > you can filter this using iptables string match. > > > > > > This can be done but you will also be placing reasonable overhead on > your system. There are plug-in for Apache that allows you to log these > separately. The best one I've seen and unfortunately I no longer have > the link used the hole created by nimda to place a courtesy file in a > autoexec start up script. Something to the tune of ' fix your damn > computer nimrod'. I have also seen others that e-mailed the > isp's admin. > In my experience though I never get a response. Placing a > courtesy note > in an autoexec file does work. Once I actually had a guy leave a > response on his drive asking me how to fix it. >

1 0

RE: [suse-security] IIS Worms
by mailinglists＠belfin.ch 27 Nov '02

27 Nov '02

Hi to me this looks like some kind of nimda or code red. you can filter this using iptables string match. Philipp > -----Original Message----- > From: Marcel Erkens [mailto:merkens@safenebraska.org] > Sent: Wednesday, November 27, 2002 9:30 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] IIS Worms > > > hehe.. good luck dealing with isp's on this... > > http://freebsdmatrix.net/iisworm/ > > A fun little script that'll automatically send out emails to > parent netblock > owners... > > Might be easier then doing all the work manually ;) > > On Wednesday 27 November 2002 11:41, Andreas Bittner wrote: > > nslookup/whois the ip (www.ripe.net (euro/africa/mid-east) > , www.arin.net > > (americas) or www.apnic.net (asia pacific), these are the > big three ip > > address maintainers worldwide, whois the ip addy there or > nslookup the > > ipadress and report to its owner/provider and so forth.... > > > > cheers, > > andy > > > > ----- Original Message ----- > > From: "Mario Ohnewald" <mario.ohnewald(a)gmx.de> > > To: <suse-security(a)suse.com> > > Sent: Wednesday, November 27, 2002 12:33 PM > > Subject: [suse-security] IIS Worms > > > > > > Hello! > > What can i do against these worms? > > > > [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..Á^\../winnt/system32/cmd.exe > > [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:18:53 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe > > [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..Á234../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%5c../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%2f../winnt/system32/cmd.exe > > [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe > > [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/.%2e/.%2e/winnt/system32/cmd.ex > > [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] > File does not > > exist: > /usr/local/httpd/htdocs/scripts/..%5c%5c../winnt/system32/cmd. > > [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Tue Nov 26 07:59:16 2002] [error] [client 210.241.51.68] > client sent > > HTTP/1.1 request without hostname (see RFC2616 section 14.23): / > > [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/scripts/root.exe > > [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/MSADC/root.exe > > [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/scripts/root.exe > > [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/MSADC/root.exe > > [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/c/winnt/system32/cmd.exe > > [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/d/winnt/system32/cmd.exe > > [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] > File does not > > exist: /usr/local/httpd/htdocs/error/error.html > > > > How can i reverse the ip to an address like whois does. > > What do u do against it? I am just bothered because of my > mini bandwitdth. > > > > cheers, Mario > > -- > "They that give up essential liberty to obtain a little > temporary safety... > deserve neither safety nor liberty." - Benjamin Franklin(1759) > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Kernel DoS
by Denis Hoffmann 27 Nov '02

27 Nov '02

Hi there! I just came across this article: http://www.securiteam.com/exploits/6E00F2060U.html Summary: A vulnerability in the Linux kernel allows local attackers to cause it to halt. The flaw seems to be related to the kernel's handling of the nested task (NT) flag inside an lcall7. What says SuSE about this topic? Do you advise a kernel update? Which SuSE-versions are affected? Have a nice day! Denis Hoffmann

6 8

Antwort: [suse-security] ipchains and Portscan ( another possibility )
by BLeonhardt＠analytek.de 27 Nov '02

27 Nov '02

check /etc/inetd.conf and disable all listed ports / services ! Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de Volker Spies <v.spies(a)ascaron.com> 27.11.02 10:58 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains and Portscan Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

1 0

Antwort: [suse-security] ipchains and Portscan
by BLeonhardt＠analytek.de 27 Nov '02

27 Nov '02

maybe you're not running the test from outside ??? setup a dedicated host with a isdn-card - inet-connection and then try again - be sure there is no networkconnection ! Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de Volker Spies <v.spies(a)ascaron.com> 27.11.02 10:58 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains and Portscan Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

1 0

Re: [suse-security] SuSEfirewall2: external ip aliases with forward / masq?
by Togan Muftuoglu 26 Nov '02

26 Nov '02

* Howard, Neal; <nhoward(a)cwftx.net> on 26 Nov, 2002 wrote: >I'll try it out tomorrow, it's been a long day here in Texas too and my >brain hurts right now! I know the feeling :-) > >I'm guessing I should use the external ip aliases in the first part of >each stanza of FW_FORWARD_MASQ instead of putting the vendor's ip address >in that place like I was doing? Now although I said > >FW_DEV_EXT="eth0 eth0:1 eth0:2" It's better to have the aliases eth0:1 and eth0:2 in FW_DEV_DMZ and then FW_FORWARD_MASQ them for the vendor this way it should be both secure and doable (cross your fingers) -- Togan Muftuoglu

1 0