November 2002 - openSUSE Security - openSUSE Mailing Lists

Antivir and Spamassassin set-up
by Andrew Bennett 05 Nov '02

05 Nov '02

Hi, I have installed Antivir to catch viruses for my Win'98 users on the network, altering the /etc/sendmail.cf file accordingly, i.e. #Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, # T=DNS/RFC822/X-Unix, # A=procmail -Y -a $h -d $u is changed to:- Mlocal, P=/usr/sbin/scanmails, F=lsDFMAw5:/|@SPfhn, S=10/30, R=20/40, T=DNS/RFC822/X-Unix, A=scanmails -Y -a $h -d $u having first looked at this I thought that, because it uses scanmail instead of procmail, the entries in my .procmailrc file which are necessary for spamassassin wouldn't be read - but they are!!! I know this is what I wanted but I was still a bit surprised. I will probably have a closer look at this issue over the next day or so and will provide any further info. I can. The info with Spamassassin said that the set-up with antivirus software involved several steps but that doesn't seem to be the case. Just thought I'd mention it in case anyone else is thinking of doing the same thing to avoid viruses and spam. Andy

1 0

identd
by fin 05 Nov '02

05 Nov '02

Could someone tell me how to switch off identd in 8.1? I tested my firewall at www.grc.com and all of my ports are in stealth mode except identd, which is closed but still visible. As it is a potential source of information and only used for irc, which I don't need, I'd like to get rid of it. I found several articles on the web concerning this problem, but they are all for earlier versions and suggest shutting the service in etc/rc.config or etc/services, none of which exist in 8.1. I can't find anything in the new etc/sysconfig. How can I shut identd down? Fiona

13 19

starting firewall
by Dirk Borchers 05 Nov '02

05 Nov '02

hi to all! when starting SuSEfirewall2 (with the latest update) manually on SuSE 8.1 after booting I have a lot of time to wait - nearly 15 minutes. Even after all ist loaded, some rules do not work. I have to type in "rcSuSEfirewall2 reload", and wait another 15 minutes. This happened from one day to another without changing any configuration file. Another point is, that the rules do not seem to be reloaded when a new pppoe connection is made. Any hints? I still have another device to the internet (ippp0), which seems to work (because I have a static ip adress for this device...). Dirk

1 0

SuSE Security Announcement: perl-MailTools (SuSE-SA:2002:041)
by Sebastian Krahmer 05 Nov '02

05 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: perl-MailTools Announcement-ID: SuSE-SA:2002:041 Date: Tue Nov 5 11:30:00 CET 2002 Affected products: 7.1, 7.2, 7.3, 8.0, 8.1 SuSE eMail Server III, 3.1 Vulnerability Type: remote command execution Severity (1-10): 6 SuSE default package: no Cross References: - Content of this advisory: 1) security vulnerability resolved: Remote command execution via Mail::Mailer package. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Vulnerable to this attack are custom auto reply programs or spam filters which use Mail::Mailer directly or indirectly. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.1 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/perl-MailTools-1.47-29… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/perl-MailTools-1.47-29.… d41d8cd98f00b204e9800998ecf8427e SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/perl3/perl-MailTools-1.42-120.i… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/perl-MailTools-1.42-120.src… d41d8cd98f00b204e9800998ecf8427e SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/perl2/perl-MailTools-1.1401-187… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/perl-MailTools-1.1401-187.s… d41d8cd98f00b204e9800998ecf8427e SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/perl2/perl-MailTools-1.1401-187… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/perl-MailTools-1.1401-187.s… d41d8cd98f00b204e9800998ecf8427e SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/perl2/perl-MailTools-1.1401-188… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/perl-MailTools-1.1401-188.s… d41d8cd98f00b204e9800998ecf8427e Sparc Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/perl2/perl-MailTools-1.1401-65… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/perl-MailTools-1.1401-65.s… d41d8cd98f00b204e9800998ecf8427e AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/perl2/perl-MailTools-1.1401-69.a… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/perl-MailTools-1.1401-69.src… d41d8cd98f00b204e9800998ecf8427e PPC Power PC Platform: SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/perl2/perl-MailTools-1.1401-110.… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/perl-MailTools-1.1401-110.sr… d41d8cd98f00b204e9800998ecf8427e SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/perl2/perl-MailTools-1.1401-111.… d41d8cd98f00b204e9800998ecf8427e source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/perl-MailTools-1.1401-111.sr… d41d8cd98f00b204e9800998ecf8427e ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: There is no additional information this time. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPcelXXey5gA9JdPZAQGIhAf/ZouJs+LaHJo3nAU9BvnwHAWbY4vdbDqO Il9fPVu9UGaH03nnZdR/IxkBJHtvoUE33aBpWqW2q704h1o9p1jmxe6Us7AGSEq8 27MUPAodZMWzqVV1VrzcLzvRPU+/Ve8wfNhfzSx6/Jt0FF3syrxZ5P1NKtq3sJVj ZObi5tp+UPdpNxXx85vrk4kpBc8MaO5zJ6ugpwNBfK2sUpJx2R/jqYXYjGlDEiBN eRF/e+fHlVN2Tm2pAsg3tiuEEikKCP+3A5bDgX6705SGlu20T9VjfDCxN9VLzrwN coULhgDqNh3Qhr+F9xfLKT42ZysEeysLDXj0TCfvGQoWQUntgOtO0w== =Pwj8 -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Re: Re: [suse-security] DOS on sendmail daemon
by K.Hoelzer 05 Nov '02

05 Nov '02

Lars Ellenberg <l.g.e(a)web.de> wrote (Mon, 4 Nov 2002 19:36:32 +0100): > > be careful here! > > you should *not* kill your output twin, just because no more input is > available and vice versa. see, for SMTP this might work. but think of on > line > coming/going out in, requesting huge amount of data. you end up killing > your > twin whilst it is still processing the request. > > thats why sockets are not files, and should not be close'd but > shutdown'ed. > > Lars > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > Lars, I have only picked up something out of my "shelf" an adapted it a little bit to gave Evert a quick - and maybe sticky (but not dirty) - solution for his problem ..... (Source: (like stated in the first email): Perl Cookbook (O'Reilly)) Kristofer

1 0

Re: RE: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 04 Nov '02

04 Nov '02

Hope you "see" it now. I HAVE SIMPLY ATTACHED IT INLINE ! If not, don't hesitate to contact me again ... Kristofer "Evert Smit" <admin(a)sidhe.net> wrote (Sun, 3 Nov 2002 12:04:27 +0100): > Hi kristofer, did not see you script :) possible for you to mail it > again? > #!/usr/bin/perl -w # fwdport -- act as proxy forwarder for dedicated services use strict; # require declarations use Getopt::Long; # for option processing use Net::hostent; # by-name interface for host info use IO::Socket; # for creating server and client sockets use POSIX ":sys_wait_h"; # for reaping our dead children my ( %Children, # hash of outstanding child processes $REMOTE, # whom we connect to on the outside $LOCAL, # where we listen to on the inside $SERVICE, # our service name or port number $proxy_server, # the socket we accept() from $ME, # basename of this program ); ($ME = $0) =~ s,.*/,,; # retain just basename of script name check_args(); # processing switches start_proxy(); # launch our own server service_clients(); # wait for incoming die "NOT REACHED"; # you can't get here from there # process command line switches using the extended # version of the getopts library. sub check_args { GetOptions( "remote=s" => \$REMOTE, "local=s" => \$LOCAL, "service=s" => \$SERVICE, ) or die <<EOUSAGE; usage: $0 [ --remote host ] [ --local interface ] [ --service service ] EOUSAGE die "Need remote" unless $REMOTE; die "Need local or service" unless $LOCAL || $SERVICE; } # begin our server sub start_proxy { my @proxy_server_config = ( Proto => 'tcp', Reuse => 1, Listen => SOMAXCONN, ); push @proxy_server_config, LocalPort => $SERVICE if $SERVICE; push @proxy_server_config, LocalAddr => $LOCAL if $LOCAL; $proxy_server = IO::Socket::INET->new(@proxy_server_config) or die "can't create proxy server: $@"; print "[Proxy server on ", ($LOCAL || $SERVICE), " initialized.]\n"; } sub service_clients { my ( $local_client, # someone internal wanting out $lc_info, # local client's name/port information $remote_server, # the socket for escaping out @rs_config, # temp array for remote socket options $rs_info, # remote server's name/port information $kidpid, # spawned child for each connection ); $SIG{CHLD} = \&REAPER; # harvest the moribund accepting(); # an accepted connection here means someone inside wants out while ($local_client = $proxy_server->accept()) { $lc_info = peerinfo($local_client); set_state("servicing local $lc_info"); printf "[Connect from $lc_info]\n"; @rs_config = ( Proto => 'tcp', PeerAddr => $REMOTE, ); push(@rs_config, PeerPort => $SERVICE) if $SERVICE; print "[Connecting to $REMOTE..."; set_state("connecting to $REMOTE"); # see below $remote_server = IO::Socket::INET->new(@rs_config) or die "remote server: $@"; print "done]\n"; $rs_info = peerinfo($remote_server); set_state("connected to $rs_info"); $kidpid = fork(); die "Cannot fork" unless defined $kidpid; if ($kidpid) { $Children{$kidpid} = time(); # remember his start time close $remote_server; # no use to master close $local_client; # likewise next; # go get another client } # at this point, we are the forked child process dedicated # to the incoming client. but we want a twin to make i/o # easier. close $proxy_server; # no use to slave $kidpid = fork(); die "Cannot fork" unless defined $kidpid; # now each twin sits around and ferries lines of data. # see how simple the algorithm is when you can have # multiple threads of control? # this is the fork's parent, the master's child if ($kidpid) { set_state("$rs_info --> $lc_info"); select($local_client); $| = 1; print while <$remote_server>; kill('TERM', $kidpid); # kill my twin cause we're done } # this is the fork's child, the master's grandchild else { set_state("$rs_info <-- $lc_info"); select($remote_server); $| = 1; # was: print while <$local_client>; # added by kh 20021102 >>> while (<$local_client>) { if (m/xyz/) { print STDOUT "RegExpr matches\n"; last; } else { print; } } # <<< end kill('TERM', getppid()); # kill my twin cause we're done } exit; # whoever's still alive bites it } continue { accepting(); } } # helper function to produce a nice string in the form HOST:PORT sub peerinfo { my $sock = shift; my $hostinfo = gethostbyaddr($sock->peeraddr); return sprintf("%s:%s", $hostinfo->name || $sock->peerhost, $sock->peerport); } # reset our $0, which on some systems make "ps" report # something interesting: the string we set $0 to! sub set_state { $0 = "$ME [@_]" } # helper function to call set_state sub accepting { set_state("accepting proxy for " . ($REMOTE || $SERVICE)); } # somebody just died. keep harvesting the dead until # we run out of them. check how long they ran. sub REAPER { my $child; my $start; while (($child = waitpid(-1,WNOHANG)) > 0) { if ($start = $Children{$child}) { my $runtime = time() - $start; printf "Child $child ran %dm%ss\n", $runtime / 60, $runtime % 60; delete $Children{$child}; } else { print "Bizarre kid $child exited $?\n"; } } # If I had to choose between System V and 4.2, I'd resign. --Peter Honeyman $SIG{CHLD} = \&REAPER; };

2 1

SuSEfirewall2 + M$ vpn server
by Fabio Sena 04 Nov '02

04 Nov '02

Good night, I was presented to the SuSE Linux 8.0 for a friend who was in Germany, I very liked it system firewall of it, and am trying to implement a system with VPN through the Firewall Suse, being placed a server VPN after firewall SuSE, using 3 ethenets, for the best agreement, am sending an archive in annex with my problem and that I am receiving a message affirming that my server VPN this not answering. I am trying to make to carry through one vpn pair a server MS win 2000 server, that is for backwards of the Firewall Suse, For this I configured a ETH DMZ, and I liberated ports 1700:1800 for the connection for my server vpn that this with false IP 192.168.1.2 When I try to make one vpn, firewall makes the reverse of masks of the real IP for the false IP, in the requested ports 1723, it arrives to check user and password more informs that my server vpn is not answering, if I to place server VPN it are of firewall it functions total. If it was possible, it would like that the gentlemen vpn indicated me a form to configure one using SuSEfirewall, and which ports and the protocols that are used in this type of configuration Messages Nov 4 15:10:04 fwpro kernel: SuSE-FW-ACCEPT-REVERSE_MASQ IN=eth2 OUT=eth1 SRC=200.xxx.xxx.xxx DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=125 ID=40058 DF PROTO=TCP SPT=1320 DPT=1723 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) FW description FW_SERVICES_EXT_TCP="pptp 1723 500 53 ssh" FW_SERVICES_EXT_UDP="42:500 1024:5000" # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="47 50 51 gre" FW_SERVICES_DMZ_TCP="pptp 53 500 1723:1800 5800 5900" FW_SERVICES_DMZ_UDP="53 500 1024:5000 5900" # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="47 50 51" FW_FORWARD="200.249.140.60,192.168.1.2 192.168.1.2,200.249.140.60" FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,500 0/0,192.168.1.2,tcp,1723 0/0,192.168.1.2,tcp,5900 0/0,192.168.1.2,tcp,3389 0/0,192.168.1.2,udp,500" |--------ETH0(DMZ 192.168.1.1)---------ETH1(M$ VPN SERVER)--ETH0(INTERNAL LAN 10.10.40.251) RANGE 10.10.40.252-254 | | Internet-------------------ETH2(Suse8.0(SuSEfirewall2)) | | | |----------ETH1(Internal lan10.10.40.250) | | | | | SWicth ---------------------------------| | |Internal lan []'s Fabio Sena

1 0

Example set-upfor 7.1
by Andrew Bennett 04 Nov '02

04 Nov '02

Hi, I've placed an example run-through of an installation of SuSE 7.1 for a secure(ish) server for new users. It's at http://www.itosn.com/security on the bit that is headed 'Setting Up A Secure Server/Firewall'. I know it's not particularly secure but it's a first stab at creating a run-through for a new user to get them under way. Any comments/errors/whatever, anyone??? Rgds Andrew Bennett ITOSN

1 0

Re: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

Hey Evert, an additional hint: take care of a "good" regex ! a too simple expression will cause in missing mail. I think of cases the mail-body contains the expression .... Best Regards Kristofer

1 0

Re: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

Hey Evert, attached the little bit adapted FwdPort (SOURCE: O'Reilly Perl Cookbook :-) 1) i tested it with PostFix an simply changed my /etx/postfix/master.cf to listen to port 20025 ... Please do so (or similar (in inetd.conf e.g)) ! 2) change the m/xyz/ to something appropriate to your problem. I suggest m/MAILER-DAEMON/ BUT THERE IS A LITTLE PIT-FALL: you'll never get "real" MAILER-DAEMON msgs any more - i think you can live with it .... 3) start the script (as root) with "fwd_port.pl -l >your-machine<:25 -r localhost:20025" Hope you to get "less" mail Kristofer > this sounds like a good idea.... gotta tell never done this before... if > you'd like to help me, i would be deeply indepbted to you. > > regards > > -----Original Message----- > From: K.Hoelzer [mailto:suse_infos@htm-technology.com] > Sent: Saturday, November 02, 2002 11:53 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] DOS on sendmail daemon > > > > CC: <suse-security(a)suse.com> > Subject: Re: [suse-security] DOS on sendmail daemon > X-Mailer: POP-eye V0.174 > Reply-To: kh(a)htm-technology.com > Mime-Version: 1.0 > Content-Type: text/plain; charset=us-ascii > X-MailScanner: Found to be clean > X-RCPT-TO: <sent(a)htm-technology.com> > Status: U > X-UIDL: 334611336 > > > > Hi List, > > > > i am having a security issue sort of, and was wondering if you know > any > > solutions to this. Someone is bombarding my server with mail, forcing > > sendmail to run the max allowed child processes and start to reject > > requests > > to send mail. what techniques could i use to filter the traffic to > > sendmail > > before it acctually hits the daemon, and therefor prevent the high > load > > on > > it? > > > > regards > > Evert Smit > > Hello Evert, > > what's about placing a port-forwarder between the incoming stuff (port > 25) > an your smtpd. (inetd-config ...) > > Within the script you can scan for "MAILER-DAEMON@" or some more > appropriate > already during the login (HELO/EHLO .. RCPT TO a.s.o.) and simply/rough > abort the connection if needed. > > This should take less system-resources than childen the whole smtpd. > > There are enough script-sceletons out there i think -- O'Reilly :-) > If needed i can send you one .... > > Regards > > Kristofer Hoelzer > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > >

1 0

wtmp file
by Ian Laws 02 Nov '02

02 Nov '02

Hi All, I wonder if someone has got access to my computer as in the wtmp log file I have the following 'user'. I thought at first that my logs were corrupted so I recreated wtmp on 30 Oct 2002. The 'user' is there again! X******* ****X******* X*******X******* Sun Apr 7 02:37 still logged in My Machine :- Linux Tango 2.4.4 #2 Mon Oct 7 03:36:57 CEST 2002 i586 unknown using SuSE 7.2 installation was done at the back-end of August 2002. -- Ian David Laws Linux is for Networking Mac is for Working ian(a)the-laws-clan.de Windows is for Solitaire

2 3

RE: [suse-security] DOS on sendmail daemon
by mailinglists＠belfin.ch 02 Nov '02

02 Nov '02

> well pulling the plug would result in the webiste of my customer going > offline, i.e his shop won't work anymore and he'll loose over > 10k per day > when not online. That's a point. You could still pull the plug of oyur mail server...unless it's the same box. But I don't think it's necessary. > for now i did the following, using virtuserttables to filter the valid > adresses out, and move the rest to /dev/null. if i reject > them they will > bounce back to me again.. so makes no sense. That's right. > any more ideas_ yes. if your box is an open relay (or was) close that hole first. Find out where the stuff comes from. Write a mail to abuse(a)isps.somewhere (according to what you've found out) including your mail log. Next you do is wait. You can't do much more. Your line will be dead for some time. Some years ago I had an open sendmail relay. It took 4 days until the bad boys learned that my mail server wasn't an open relay anymore. > -----Original Message----- > From: mailinglists(a)belfin.ch [mailto:mailinglists@belfin.ch] > Sent: Saturday, November 02, 2002 11:31 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] DOS on sendmail daemon > > > Hi > > since you cannot stop it either way (your line will be dead > anyway even if > you can reduce cpu load on your mail server) what about > pulling the plug? > > Philipp > > > > > -----Original Message----- > > From: Martin Konold [mailto:martin.konold@erfrakon.de] > > Sent: Saturday, November 02, 2002 11:37 AM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] DOS on sendmail daemon > > > > > > On Saturday 02 November 2002 10:17 am, Miguel Albuquerque wrote: > > > > Hi, > > > > > Your server is an open relay, close it. > > > > Of course this is the most important action. > > > > > Try adding an REJECT access rule for this domain: > > > > > > ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br > > > > > > or his IP/Network: > > > >[200.170.149.113]) > > > > Please be very careful with adding reject rules. Basically > > this leads to > > blocking many innocent people and is potentially a partial DOS. > > > > (the above address looks to me like a dynamic dial up / DSL number) > > > > Regards, > > --martin > > > > -- > > -- > > Dipl.-Phys. Martin Konold > > e r f r a k o n > > Erlewein, Frank, Konold & Partner - Beratende Ingenieure > und Physiker > > Germanenstrasse 15, 70563 Stuttgart, Germany > > email: martin.konold(a)erfrakon.de > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

CC: <suse-security(a)suse.com> Subject: Re: [suse-security] DOS on sendmail daemon X-Mailer: POP-eye V0.174 Reply-To: kh(a)htm-technology.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-MailScanner: Found to be clean X-RCPT-TO: <sent(a)htm-technology.com> Status: U X-UIDL: 334611336 > Hi List, > > i am having a security issue sort of, and was wondering if you know any > solutions to this. Someone is bombarding my server with mail, forcing > sendmail to run the max allowed child processes and start to reject > requests > to send mail. what techniques could i use to filter the traffic to > sendmail > before it acctually hits the daemon, and therefor prevent the high load > on > it? > > regards > Evert Smit Hello Evert, what's about placing a port-forwarder between the incoming stuff (port 25) an your smtpd. (inetd-config ...) Within the script you can scan for "MAILER-DAEMON@" or some more appropriate already during the login (HELO/EHLO .. RCPT TO a.s.o.) and simply/rough abort the connection if needed. This should take less system-resources than childen the whole smtpd. There are enough script-sceletons out there i think -- O'Reilly :-) If needed i can send you one .... Regards Kristofer Hoelzer

1 0

RE: [suse-security] DOS on sendmail daemon
by mailinglists＠belfin.ch 02 Nov '02

02 Nov '02

Hi since you cannot stop it either way (your line will be dead anyway even if you can reduce cpu load on your mail server) what about pulling the plug? Philipp > -----Original Message----- > From: Martin Konold [mailto:martin.konold@erfrakon.de] > Sent: Saturday, November 02, 2002 11:37 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] DOS on sendmail daemon > > > On Saturday 02 November 2002 10:17 am, Miguel Albuquerque wrote: > > Hi, > > > Your server is an open relay, close it. > > Of course this is the most important action. > > > Try adding an REJECT access rule for this domain: > > > > ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br > > > > or his IP/Network: > > >[200.170.149.113]) > > Please be very careful with adding reject rules. Basically > this leads to > blocking many innocent people and is potentially a partial DOS. > > (the above address looks to me like a dynamic dial up / DSL number) > > Regards, > --martin > > -- > -- > Dipl.-Phys. Martin Konold > e r f r a k o n > Erlewein, Frank, Konold & Partner - Beratende Ingenieure und Physiker > Germanenstrasse 15, 70563 Stuttgart, Germany > email: martin.konold(a)erfrakon.de > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Starting the firewall
by Dirk Borchers 01 Nov '02

01 Nov '02

still got problems with the firewall. i installed the latest version. but when booting, i get error messages. so i disabled the firewall. the computer started without any error messages. i logged in and started the firewall by hand - no error messages; all is working as it should. so: how can i configure the 8.1 system to start the firewall after everything else has been initialized? and suse-config not modifying this preferences... dirk

6 8

iptables TTL target
by mailinglists＠belfin.ch 01 Nov '02

01 Nov '02

Hi this is my problem: + iptables -t mangle -A PREROUTING -i eth1 -j TTL --ttl-inc 1 iptables: No chain/target/match by that name modprobe ipt_ttl is in my script. According to http://cert.uni-stuttgart.de/archive/usenet/comp.os.linux.security/2002/08/m sg00458.html there should be two ttl modules in /lib/modules/2.4.18-4GB/kernel/net/ipv4/netfilter/. ipt_TTL for the target ipt_ttl for matching. ipt_TTL isnt in the modules directory. Is this module missing in the Suse distro? If not wow am I going to get the TTL target to work? Thanks, Philipp

1 0