November 2002 - openSUSE Security - openSUSE Mailing Lists

SMTP response without SYN ...
by Ray Leach 14 Nov '02

14 Nov '02

Hi Can anyone explain how it is possible that a machine can 'respond' to SMTP traffic that it didn't create. " Nov 11 10:58:29 firefly kernel: DROP OUTPUT INET: IN= OUT=eth0 SRC=66.8.45.165 DST=200.207.3.8 LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=0 DF PROTO=TCP SPT=25 DPT=4284 WINDOW=0 RES=0x00 ACK RST URGP=0 Nov 11 10:59:16 firefly last message repeated 4 times " This is from my logs. This particular machine does not even have an SMTP service/daemon running on it. It is a web server and my iptables rules do not allow incoming SMTP (DPT: 25) to this machine. Anyone have comments/answers? Ray

3 7

MS VPN Server(pptpd)
by Fabio Sena 14 Nov '02

14 Nov '02

Good Night, It forgives my lack of agreement more, where I would place users and password in this archive, knowing that conection of windows uses for default ms-chap version 2 # Secrets for authentication using CHAP # client server secret IP addresses # OUTBOUND CONNECTIONS # Here you should add your PPP Login and PPP password to connect to your # provider via pap. The * means that the entry(login and passoword may be # used for ANY host you connect to. # Thus you do not have to worry about the foreign machine name. Just # replace password with your password. #hostname * password # PREDIFINED CONNECTIONS # These are user and password entries for publically accessible call-by-call # Internet providers in Germany. If they confict with your config, remove them. # READ_IN_CALLBYCALL_SECRETS # INBOUND CONNECTIONS #client hostname <password> 192.168.1.1 Fabio Sena Brazil - PE

1 0

MS Vpnserver (pptpd)
by Fabio Sena 14 Nov '02

14 Nov '02

Good afternoon, I am receiving this reply when I try to logar way lan, for a customer windows Nov 13 16:21:02 fwpro kernel: SuSE-FW-ACCEPT IN=3Deth0 OUT=3D MAC=3D00:90:27:75:b5:8d:00:10:7b:00:63:94:08:00 SRC=3D200.249.140.58 DST=3D200.249.140.20 LEN=3D48 TOS=3D0x00 PREC=3D0x00 TTL=3D126 ID=3D59372 D= F PROTO=3DTCP SPT=3D1441 DPT=3D1723 WINDOW=3D64240 RES=3D0x00 SYN URGP=3D0 OP= T (020405B401010402)=20 Nov 13 16:21:02 fwpro pptpd[4103]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: local address =3D 10.10.40.250 Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: remote address =3D 10.10.40.252 Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: pppd speed =3D 115200 Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: pppd options file =3D /etc/ppp/options.pptp Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: Client 200.249.140.58 control connection started Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: Received PPTP Control Message (type: 1) Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: Made a START CTRL CONN RPLY packet Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: I wrote 156 bytes to the client. Nov 13 16:21:02 fwpro pptpd[4103]: CTRL: Sent packet to client Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Received PPTP Control Message (type: 7) Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: 0 min_bps, 1525 max_bps, 32 window size Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Made a OUT CALL RPLY packet Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Starting call (launching pppd, opening GRE) Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: pty_fd =3D 5 Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: tty_fd =3D 6 Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: I wrote 32 bytes to the client. Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Sent packet to client Nov 13 16:21:04 fwpro pptpd[4104]: CTRL (PPPD Launcher): Connection speed =3D 115200 Nov 13 16:21:04 fwpro pptpd[4104]: CTRL (PPPD Launcher): local address =3D 10.10.40.250 Nov 13 16:21:04 fwpro pptpd[4104]: CTRL (PPPD Launcher): remote address =3D 10.10.40.252 Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Received PPTP Control Message (type: 15) Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Got a SET LINK INFO packet with standard ACCMs Nov 13 16:21:04 fwpro pppd[4104]: The remote system is required to authenticate itself Nov 13 16:21:04 fwpro pppd[4104]: but I couldn't find any suitable secret (password) for it to use to do so. Nov 13 16:21:04 fwpro pptpd[4103]: Error reading from pppd: Input/output error Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: GRE read or PTY write failed (gre,pty)=3D(6,5) Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Client 200.249.140.58 control connection finished Nov 13 16:21:04 fwpro pptpd[4103]: CTRL: Exiting now Nov 13 16:21:04 fwpro pptpd[3802]: MGR: Reaped child 4103 ******************************************* And this reply when I am trying to use vpn, for a customer windows ******************************************* Nov 13 16:00:01 fwpro kernel: SuSE-FW-ACCEPT IN=3Deth0 OUT=3D MAC=3D00:90:27:75:b5:8d:00:10:7b:00:63:94:08:00 SRC=3D200.184.112.49 DST=3D200.249.140.20 LEN=3D48 TOS=3D0x00 PREC=3D0x00 TTL=3D118 ID=3D59130 D= F PROTO=3DTCP SPT=3D1429 DPT=3D1723 WINDOW=3D16384 RES=3D0x00 SYN URGP=3D0 OP= T (020405B401010402)=20 Nov 13 16:00:02 fwpro pptpd[3848]: MGR: Launching /usr/sbin/pptpctrl to handle client Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: local address =3D 10.10.40.250 Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: remote address =3D 10.10.40.253 Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: pppd speed =3D 115200 Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: pppd options file =3D /etc/ppp/options.pptp Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Client 200.184.112.49 control connection started Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Received PPTP Control Message (type: 1) Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Made a START CTRL CONN RPLY packet Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: I wrote 156 bytes to the client. Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Sent packet to client Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Received PPTP Control Message (type: 7) Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: 0 min_bps, 1525 max_bps, 32 window size Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Made a OUT CALL RPLY packet Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Starting call (launching pppd, opening GRE) Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: pty_fd =3D 5 Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: tty_fd =3D 6 Nov 13 16:00:02 fwpro pptpd[3849]: CTRL (PPPD Launcher): Connection speed =3D 115200 Nov 13 16:00:02 fwpro pptpd[3849]: CTRL (PPPD Launcher): local address =3D10.10.40.250 Nov 13 16:00:02 fwpro pptpd[3849]: CTRL (PPPD Launcher): remote address =3D 10.10.40.253 Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: I wrote 32 bytes to the client. Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Sent packet to client Nov 13 16:00:02 fwpro pppd[3849]: The remote system is required to authenticate itself Nov 13 16:00:02 fwpro pppd[3849]: but I couldn't find any suitable secret (password) for it to use to do so. Nov 13 16:00:02 fwpro pptpd[3848]: Error reading from pppd: Input/output error Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: GRE read or PTY write failed (gre,pty)=3D(6,5) Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Client 200.184.112.49 control connection finished Nov 13 16:00:02 fwpro pptpd[3848]: CTRL: Exiting now Nov 13 16:00:02 fwpro pptpd[3802]: MGR: Reaped child 3848 they know what it can cause this error? thank's []'s Fabio Sena Brasil - PE

1 0

DHCP Timeout
by Miguel Albuquerque 13 Nov '02

13 Nov '02

I realised that my SuSE 8.0 has problems to get a dhcp reponse from the server while my wife (win2k) don't. I've being observing this from some time now and sometimes, I need to reset the modem in order to get an IP, wich in occurrence is always the same. I know the dhcp server runs Linux (I dunno wich distro) and anyway is beyhond my reach. FW ruleset: FW_DEV_EXT="ppp0" FW_DEV_INT="eth0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="137:139 http pop3 smtp ssh" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" Firewall_log extract: Nov 13 22:11:41 ns kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:38:13:2e:40:08:00 SRC=10.0.166.11 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=34071 PROTO=2 Nov 13 22:13:11 ns kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:38:13:2e:40:08:00 SRC=10.0.166.11 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=34089 PROTO=2 The source IP is not mine... This message reapeats many times... Any idea? Thanks -- .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch "Was Sind und was Sollen die Zahlen?" Dedekind. ____________________________________________________________

1 0

How do I Unsubscribe
by Jacob Fierberg 13 Nov '02

13 Nov '02

How do I unsubscribe from the list Thanks

2 1

Spam autoresponses when posting to the list
by Christopher Mahmood 13 Nov '02

13 Nov '02

Hi all, I've blocked the idiot and the whole my-mail.ch domain because they never responded. He had subscribed to the several of our lists and was sending autoresponses to the header from on posts; i.e., the mail didn't actually go through our lists. It's obvious that spammers are getting more sophisticated with their evil trade and I don't expect that this is the last time we'll see something like this. As always, the best way to avoid something like this is to not use your normal address in your From: header. Your subscription is based on sender From (i.e., your "envelope" from) and that address is never shown to other subscribers. If you use a unique address when posting to our lists and mail delivered to that address can be automatically deleted or bounced. If you aren't sure how to do this feel free to ask ml-admin(a)suse.com and, time permitting, I'll do my best to help. Cheers, -- -ckm

1 0

Starting SuseFirewall2 SuSE 8.1
by Andreas 13 Nov '02

13 Nov '02

Hello together, I have a Problem to start the SuSEFW2 (version 3.1). I use ISDN dial-upconnection with dynamic ip and dns. On SuSE 7.2 it works with the same config. well. During the configuration by Yast a dialup-connection starts and nothing happens for minutes. tcpdump says: (212.93.30.150 my provider-dns) --- einstein:/etc/sysconfig # tcpdump -i ippp0 tcpdump: listening on ippp0 19:35:08.753066 192.168.22.1.pcg-radar > 212.93.30.150.domain: 58988+ PTR? ippp0.einstein.genius. (39) (DF) 19:35:13.763036 62.180.194.107.1037 > 212.93.30.150.domain: 58988+ PTR? ippp0.einstein.genius. (39) (DF) 19:35:13.818713 212.93.30.150.domain > 62.180.194.107.1037: 58988 NXDomain 0/1/0 (114) 19:35:13.818715 212.93.30.150.domain > 62.180.194.107.1037: 58988 NXDomain 0/1/0 (114) 19:35:18.773127 62.180.194.107.1037 > 212.93.30.150.domain: 58989+ PTR? ippp0. (23) (DF) --- etc. Onetime the FW get start but it blocks all dns-calls at Port 53 and every dialup the FW takes ca. 2 minutes to get up. here my FW-config: --- FW_QUICKMODE="no" FW_DEV_EXT="ippp0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="domain" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain ntp" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" -- Best Regards, Andreas --

1 0

trojaned tcpdum, are older distributions affected ?
by malte_gell＠t-online.de 13 Nov '02

13 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 http://hlug.fscker.com/ lists tcpdump-3.6.2.tar.gz as one of the trojaned versions, SuSE 7.3 comes with that version of tcpdump ([malte_gell@eingang] ~ > rpm -qa|grep tcpdump tcpdump-3.6.2-300) So, are the older versions that shipped with older distributions like 7.3 also infected or free ? I heard the infection took place just days ago, so older distributions should *not* be tojaned although using tcpdump 3.6.2 ? Regards, Malte -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iEYEAREDAAYFAj3Sr5EACgkQGzg12gD8wBbodgCdF6xaWVAOsWLQBC6JZ8Fi6fdw PgkAn1eVQ+lKdHfdMhNjoZMgiBtNdn/z =B/Tw -----END PGP SIGNATURE-----

2 1

Re: [suse-security] SuseFirewall2 DMZ
by Frédéric Poulet 13 Nov '02

13 Nov '02

Thanks my web server can be see from internet and from internal network ! ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

[Fwd: Latest libpcap & tcpdump sources from tcpdump.org contain a trojan
by Simon Oliver 13 Nov '02

13 Nov '02

Where does SuSE stand on this? >Apparently libpcap and tcpdump have been trojaned, in a similar way to >openssh earlier this year. Information about how long this has been the >case is sketchy. Trojaned versions appear to have made it out to a >number of mirrors. > >Further details can be found at http://hlug.fscker.com (mirror >http://www2.def-con.org/mirror/hlug.fscker.com/ appears to work). > >The tarballs available at www.tcpdump.org appear to still be trojaned. > >Good sources: >http://www.ibiblio.org/pub/Linux/distributions/gentoo/distfiles/libpcap-0.7 >.1.tar.gz >http://www.ibiblio.org/pub/Linux/distributions/gentoo/distfiles/tcpdump-3.6 >.2.tar.gz >http://www.ibiblio.org/pub/Linux/distributions/gentoo/distfiles/tcpdump-3.7 >.1.tar.gz > >MD5 Sum 0597c23e3496a5c108097b2a0f1bd0c7 libpcap-0.7.1.tar.gz >MD5 Sum 6bc8da35f9eed4e675bfdf04ce312248 tcpdump-3.6.2.tar.gz >MD5 Sum 03e5eac68c65b7e6ce8da03b0b0b225e tcpdump-3.7.1.tar.gz > >Trojaned sources: >http://www.tcpdump.org/release/libpcap-0.7.1.tar.gz >http://www.tcpdump.org/release/tcpdump-3.6.2.tar.gz >http://www.tcpdump.org/release/tcpdump-3.7.1.tar.gz > >MD5 Sum 73ba7af963aff7c9e23fa1308a793dca libpcap-0.7.1.tar.gz >MD5 Sum 3a1c2dd3471486f9c7df87029bf2f1e9 tcpdump-3.6.2.tar.gz >MD5 Sum 3c410d8434e63fb3931fe77328e4dd88 tcpdump-3.7.1.tar.gz > >The program connects to 212.146.0.34 (mars.raketti.net) on port 1963 >when the configure script is run. Sites with logs of network traffic >may wish to check for connections to this IP over recent days. > >We would be interested in hearing about any machines found to be >compromised using this route. > >Regards >John Green > >JANET-CERT Tel: +44 1235 822340 >UKERNA Fax: +44 1235 822398 >Atlas Centre cert(a)cert.ja.net >Chilton, Didcot >Oxfordshire >OX11 0QS >United Kingdom

4 4