November 2002 - openSUSE Security - openSUSE Mailing Lists

Re: RE: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 04 Nov '02

04 Nov '02

Hope you "see" it now. I HAVE SIMPLY ATTACHED IT INLINE ! If not, don't hesitate to contact me again ... Kristofer "Evert Smit" <admin(a)sidhe.net> wrote (Sun, 3 Nov 2002 12:04:27 +0100): > Hi kristofer, did not see you script :) possible for you to mail it > again? > #!/usr/bin/perl -w # fwdport -- act as proxy forwarder for dedicated services use strict; # require declarations use Getopt::Long; # for option processing use Net::hostent; # by-name interface for host info use IO::Socket; # for creating server and client sockets use POSIX ":sys_wait_h"; # for reaping our dead children my ( %Children, # hash of outstanding child processes $REMOTE, # whom we connect to on the outside $LOCAL, # where we listen to on the inside $SERVICE, # our service name or port number $proxy_server, # the socket we accept() from $ME, # basename of this program ); ($ME = $0) =~ s,.*/,,; # retain just basename of script name check_args(); # processing switches start_proxy(); # launch our own server service_clients(); # wait for incoming die "NOT REACHED"; # you can't get here from there # process command line switches using the extended # version of the getopts library. sub check_args { GetOptions( "remote=s" => \$REMOTE, "local=s" => \$LOCAL, "service=s" => \$SERVICE, ) or die <<EOUSAGE; usage: $0 [ --remote host ] [ --local interface ] [ --service service ] EOUSAGE die "Need remote" unless $REMOTE; die "Need local or service" unless $LOCAL || $SERVICE; } # begin our server sub start_proxy { my @proxy_server_config = ( Proto => 'tcp', Reuse => 1, Listen => SOMAXCONN, ); push @proxy_server_config, LocalPort => $SERVICE if $SERVICE; push @proxy_server_config, LocalAddr => $LOCAL if $LOCAL; $proxy_server = IO::Socket::INET->new(@proxy_server_config) or die "can't create proxy server: $@"; print "[Proxy server on ", ($LOCAL || $SERVICE), " initialized.]\n"; } sub service_clients { my ( $local_client, # someone internal wanting out $lc_info, # local client's name/port information $remote_server, # the socket for escaping out @rs_config, # temp array for remote socket options $rs_info, # remote server's name/port information $kidpid, # spawned child for each connection ); $SIG{CHLD} = \&REAPER; # harvest the moribund accepting(); # an accepted connection here means someone inside wants out while ($local_client = $proxy_server->accept()) { $lc_info = peerinfo($local_client); set_state("servicing local $lc_info"); printf "[Connect from $lc_info]\n"; @rs_config = ( Proto => 'tcp', PeerAddr => $REMOTE, ); push(@rs_config, PeerPort => $SERVICE) if $SERVICE; print "[Connecting to $REMOTE..."; set_state("connecting to $REMOTE"); # see below $remote_server = IO::Socket::INET->new(@rs_config) or die "remote server: $@"; print "done]\n"; $rs_info = peerinfo($remote_server); set_state("connected to $rs_info"); $kidpid = fork(); die "Cannot fork" unless defined $kidpid; if ($kidpid) { $Children{$kidpid} = time(); # remember his start time close $remote_server; # no use to master close $local_client; # likewise next; # go get another client } # at this point, we are the forked child process dedicated # to the incoming client. but we want a twin to make i/o # easier. close $proxy_server; # no use to slave $kidpid = fork(); die "Cannot fork" unless defined $kidpid; # now each twin sits around and ferries lines of data. # see how simple the algorithm is when you can have # multiple threads of control? # this is the fork's parent, the master's child if ($kidpid) { set_state("$rs_info --> $lc_info"); select($local_client); $| = 1; print while <$remote_server>; kill('TERM', $kidpid); # kill my twin cause we're done } # this is the fork's child, the master's grandchild else { set_state("$rs_info <-- $lc_info"); select($remote_server); $| = 1; # was: print while <$local_client>; # added by kh 20021102 >>> while (<$local_client>) { if (m/xyz/) { print STDOUT "RegExpr matches\n"; last; } else { print; } } # <<< end kill('TERM', getppid()); # kill my twin cause we're done } exit; # whoever's still alive bites it } continue { accepting(); } } # helper function to produce a nice string in the form HOST:PORT sub peerinfo { my $sock = shift; my $hostinfo = gethostbyaddr($sock->peeraddr); return sprintf("%s:%s", $hostinfo->name || $sock->peerhost, $sock->peerport); } # reset our $0, which on some systems make "ps" report # something interesting: the string we set $0 to! sub set_state { $0 = "$ME [@_]" } # helper function to call set_state sub accepting { set_state("accepting proxy for " . ($REMOTE || $SERVICE)); } # somebody just died. keep harvesting the dead until # we run out of them. check how long they ran. sub REAPER { my $child; my $start; while (($child = waitpid(-1,WNOHANG)) > 0) { if ($start = $Children{$child}) { my $runtime = time() - $start; printf "Child $child ran %dm%ss\n", $runtime / 60, $runtime % 60; delete $Children{$child}; } else { print "Bizarre kid $child exited $?\n"; } } # If I had to choose between System V and 4.2, I'd resign. --Peter Honeyman $SIG{CHLD} = \&REAPER; };

2 1

SuSEfirewall2 + M$ vpn server
by Fabio Sena 04 Nov '02

04 Nov '02

Good night, I was presented to the SuSE Linux 8.0 for a friend who was in Germany, I very liked it system firewall of it, and am trying to implement a system with VPN through the Firewall Suse, being placed a server VPN after firewall SuSE, using 3 ethenets, for the best agreement, am sending an archive in annex with my problem and that I am receiving a message affirming that my server VPN this not answering. I am trying to make to carry through one vpn pair a server MS win 2000 server, that is for backwards of the Firewall Suse, For this I configured a ETH DMZ, and I liberated ports 1700:1800 for the connection for my server vpn that this with false IP 192.168.1.2 When I try to make one vpn, firewall makes the reverse of masks of the real IP for the false IP, in the requested ports 1723, it arrives to check user and password more informs that my server vpn is not answering, if I to place server VPN it are of firewall it functions total. If it was possible, it would like that the gentlemen vpn indicated me a form to configure one using SuSEfirewall, and which ports and the protocols that are used in this type of configuration Messages Nov 4 15:10:04 fwpro kernel: SuSE-FW-ACCEPT-REVERSE_MASQ IN=eth2 OUT=eth1 SRC=200.xxx.xxx.xxx DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=125 ID=40058 DF PROTO=TCP SPT=1320 DPT=1723 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) FW description FW_SERVICES_EXT_TCP="pptp 1723 500 53 ssh" FW_SERVICES_EXT_UDP="42:500 1024:5000" # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="47 50 51 gre" FW_SERVICES_DMZ_TCP="pptp 53 500 1723:1800 5800 5900" FW_SERVICES_DMZ_UDP="53 500 1024:5000 5900" # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="47 50 51" FW_FORWARD="200.249.140.60,192.168.1.2 192.168.1.2,200.249.140.60" FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,500 0/0,192.168.1.2,tcp,1723 0/0,192.168.1.2,tcp,5900 0/0,192.168.1.2,tcp,3389 0/0,192.168.1.2,udp,500" |--------ETH0(DMZ 192.168.1.1)---------ETH1(M$ VPN SERVER)--ETH0(INTERNAL LAN 10.10.40.251) RANGE 10.10.40.252-254 | | Internet-------------------ETH2(Suse8.0(SuSEfirewall2)) | | | |----------ETH1(Internal lan10.10.40.250) | | | | | SWicth ---------------------------------| | |Internal lan []'s Fabio Sena

1 0

Example set-upfor 7.1
by Andrew Bennett 04 Nov '02

04 Nov '02

Hi, I've placed an example run-through of an installation of SuSE 7.1 for a secure(ish) server for new users. It's at http://www.itosn.com/security on the bit that is headed 'Setting Up A Secure Server/Firewall'. I know it's not particularly secure but it's a first stab at creating a run-through for a new user to get them under way. Any comments/errors/whatever, anyone??? Rgds Andrew Bennett ITOSN

1 0

Re: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

Hey Evert, an additional hint: take care of a "good" regex ! a too simple expression will cause in missing mail. I think of cases the mail-body contains the expression .... Best Regards Kristofer

1 0

Re: RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

Hey Evert, attached the little bit adapted FwdPort (SOURCE: O'Reilly Perl Cookbook :-) 1) i tested it with PostFix an simply changed my /etx/postfix/master.cf to listen to port 20025 ... Please do so (or similar (in inetd.conf e.g)) ! 2) change the m/xyz/ to something appropriate to your problem. I suggest m/MAILER-DAEMON/ BUT THERE IS A LITTLE PIT-FALL: you'll never get "real" MAILER-DAEMON msgs any more - i think you can live with it .... 3) start the script (as root) with "fwd_port.pl -l >your-machine<:25 -r localhost:20025" Hope you to get "less" mail Kristofer > this sounds like a good idea.... gotta tell never done this before... if > you'd like to help me, i would be deeply indepbted to you. > > regards > > -----Original Message----- > From: K.Hoelzer [mailto:suse_infos@htm-technology.com] > Sent: Saturday, November 02, 2002 11:53 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] DOS on sendmail daemon > > > > CC: <suse-security(a)suse.com> > Subject: Re: [suse-security] DOS on sendmail daemon > X-Mailer: POP-eye V0.174 > Reply-To: kh(a)htm-technology.com > Mime-Version: 1.0 > Content-Type: text/plain; charset=us-ascii > X-MailScanner: Found to be clean > X-RCPT-TO: <sent(a)htm-technology.com> > Status: U > X-UIDL: 334611336 > > > > Hi List, > > > > i am having a security issue sort of, and was wondering if you know > any > > solutions to this. Someone is bombarding my server with mail, forcing > > sendmail to run the max allowed child processes and start to reject > > requests > > to send mail. what techniques could i use to filter the traffic to > > sendmail > > before it acctually hits the daemon, and therefor prevent the high > load > > on > > it? > > > > regards > > Evert Smit > > Hello Evert, > > what's about placing a port-forwarder between the incoming stuff (port > 25) > an your smtpd. (inetd-config ...) > > Within the script you can scan for "MAILER-DAEMON@" or some more > appropriate > already during the login (HELO/EHLO .. RCPT TO a.s.o.) and simply/rough > abort the connection if needed. > > This should take less system-resources than childen the whole smtpd. > > There are enough script-sceletons out there i think -- O'Reilly :-) > If needed i can send you one .... > > Regards > > Kristofer Hoelzer > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > >

1 0

wtmp file
by Ian Laws 02 Nov '02

02 Nov '02

Hi All, I wonder if someone has got access to my computer as in the wtmp log file I have the following 'user'. I thought at first that my logs were corrupted so I recreated wtmp on 30 Oct 2002. The 'user' is there again! X******* ****X******* X*******X******* Sun Apr 7 02:37 still logged in My Machine :- Linux Tango 2.4.4 #2 Mon Oct 7 03:36:57 CEST 2002 i586 unknown using SuSE 7.2 installation was done at the back-end of August 2002. -- Ian David Laws Linux is for Networking Mac is for Working ian(a)the-laws-clan.de Windows is for Solitaire

2 3

RE: [suse-security] DOS on sendmail daemon
by mailinglists＠belfin.ch 02 Nov '02

02 Nov '02

> well pulling the plug would result in the webiste of my customer going > offline, i.e his shop won't work anymore and he'll loose over > 10k per day > when not online. That's a point. You could still pull the plug of oyur mail server...unless it's the same box. But I don't think it's necessary. > for now i did the following, using virtuserttables to filter the valid > adresses out, and move the rest to /dev/null. if i reject > them they will > bounce back to me again.. so makes no sense. That's right. > any more ideas_ yes. if your box is an open relay (or was) close that hole first. Find out where the stuff comes from. Write a mail to abuse(a)isps.somewhere (according to what you've found out) including your mail log. Next you do is wait. You can't do much more. Your line will be dead for some time. Some years ago I had an open sendmail relay. It took 4 days until the bad boys learned that my mail server wasn't an open relay anymore. > -----Original Message----- > From: mailinglists(a)belfin.ch [mailto:mailinglists@belfin.ch] > Sent: Saturday, November 02, 2002 11:31 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] DOS on sendmail daemon > > > Hi > > since you cannot stop it either way (your line will be dead > anyway even if > you can reduce cpu load on your mail server) what about > pulling the plug? > > Philipp > > > > > -----Original Message----- > > From: Martin Konold [mailto:martin.konold@erfrakon.de] > > Sent: Saturday, November 02, 2002 11:37 AM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] DOS on sendmail daemon > > > > > > On Saturday 02 November 2002 10:17 am, Miguel Albuquerque wrote: > > > > Hi, > > > > > Your server is an open relay, close it. > > > > Of course this is the most important action. > > > > > Try adding an REJECT access rule for this domain: > > > > > > ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br > > > > > > or his IP/Network: > > > >[200.170.149.113]) > > > > Please be very careful with adding reject rules. Basically > > this leads to > > blocking many innocent people and is potentially a partial DOS. > > > > (the above address looks to me like a dynamic dial up / DSL number) > > > > Regards, > > --martin > > > > -- > > -- > > Dipl.-Phys. Martin Konold > > e r f r a k o n > > Erlewein, Frank, Konold & Partner - Beratende Ingenieure > und Physiker > > Germanenstrasse 15, 70563 Stuttgart, Germany > > email: martin.konold(a)erfrakon.de > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

RE: [suse-security] DOS on sendmail daemon
by K.Hoelzer 02 Nov '02

02 Nov '02

CC: <suse-security(a)suse.com> Subject: Re: [suse-security] DOS on sendmail daemon X-Mailer: POP-eye V0.174 Reply-To: kh(a)htm-technology.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-MailScanner: Found to be clean X-RCPT-TO: <sent(a)htm-technology.com> Status: U X-UIDL: 334611336 > Hi List, > > i am having a security issue sort of, and was wondering if you know any > solutions to this. Someone is bombarding my server with mail, forcing > sendmail to run the max allowed child processes and start to reject > requests > to send mail. what techniques could i use to filter the traffic to > sendmail > before it acctually hits the daemon, and therefor prevent the high load > on > it? > > regards > Evert Smit Hello Evert, what's about placing a port-forwarder between the incoming stuff (port 25) an your smtpd. (inetd-config ...) Within the script you can scan for "MAILER-DAEMON@" or some more appropriate already during the login (HELO/EHLO .. RCPT TO a.s.o.) and simply/rough abort the connection if needed. This should take less system-resources than childen the whole smtpd. There are enough script-sceletons out there i think -- O'Reilly :-) If needed i can send you one .... Regards Kristofer Hoelzer

1 0

RE: [suse-security] DOS on sendmail daemon
by mailinglists＠belfin.ch 02 Nov '02

02 Nov '02

Hi since you cannot stop it either way (your line will be dead anyway even if you can reduce cpu load on your mail server) what about pulling the plug? Philipp > -----Original Message----- > From: Martin Konold [mailto:martin.konold@erfrakon.de] > Sent: Saturday, November 02, 2002 11:37 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] DOS on sendmail daemon > > > On Saturday 02 November 2002 10:17 am, Miguel Albuquerque wrote: > > Hi, > > > Your server is an open relay, close it. > > Of course this is the most important action. > > > Try adding an REJECT access rule for this domain: > > > > ip-170-149-113.xdsl-fixo.ctbcnetsuper.com.br > > > > or his IP/Network: > > >[200.170.149.113]) > > Please be very careful with adding reject rules. Basically > this leads to > blocking many innocent people and is potentially a partial DOS. > > (the above address looks to me like a dynamic dial up / DSL number) > > Regards, > --martin > > -- > -- > Dipl.-Phys. Martin Konold > e r f r a k o n > Erlewein, Frank, Konold & Partner - Beratende Ingenieure und Physiker > Germanenstrasse 15, 70563 Stuttgart, Germany > email: martin.konold(a)erfrakon.de > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Starting the firewall
by Dirk Borchers 01 Nov '02

01 Nov '02

still got problems with the firewall. i installed the latest version. but when booting, i get error messages. so i disabled the firewall. the computer started without any error messages. i logged in and started the firewall by hand - no error messages; all is working as it should. so: how can i configure the 8.1 system to start the firewall after everything else has been initialized? and suse-config not modifying this preferences... dirk

6 8