November 2002 - openSUSE Security - openSUSE Mailing Lists

ipchains and Portscan
by Volker Spies 28 Nov '02

28 Nov '02

Hallo, I have problems with my ipchains firewall. When I run a portscan with nmapwin to my linux box form the internet it shows me the following ports as open: 7/tcp open echo 9/tcp open discard 13/tcp open daytime 17/tcp open qotd 18/tcp open msp 19/tcp open chargen 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 25/tcp open smtp 37/tcp open time 43/tcp open whois 53/tcp open domain 70/tcp open gopher 79/tcp open finger 80/tcp open http 81/tcp open hosts2-ns 88/tcp open kerberos-sec 109/tcp open pop-2 110/tcp open pop-3 113/tcp open auth 119/tcp open nntp 139/tcp open netbios-ssn 143/tcp open imap2 389/tcp open ldap 443/tcp open https 465/tcp open smtps 513/tcp open login 554/tcp open rtsp 563/tcp open snews 569/tcp open ms-rome 636/tcp open ldapssl 749/tcp open kerberos-adm 993/tcp open imaps 995/tcp open pop3s 1002/tcp open unknown 1494/tcp open citrix-ica 1720/tcp open H.323/Q.931 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 5190/tcp open aol 5400/tcp open pcduo-old 6667/tcp open irc 7000/tcp open afs3-fileserver 7070/tcp open realserver 10000/tcp open snet-sensor-mgmt 12000/tcp open cce4x The only services that are running to the outside Sshd Httpd Ftpd There are other services but not reachable form outside: Smtp Imap Squid Webmin The rest is definitely blocked by the firewall rules (only to outside interface). The firewall log shows that the ports are blocked. I see the portscan and I see that, for example, Port 25 is denied. Wired: On Port 10000 i've webmin running only reachable from the inside. Why does nmap show snet-sensor-mgmt ???? Why shows nmapwin (and other port scanners) that so many ports are in the state OPEN??? By the way when I start nmap locally on the firewall then it shows the correct ports open Sshd Httpd Ftpd Smtp Imap Squid webmin Best regards Volker

4 7

RE: [suse-security] Security and Update
by Reckhard, Tobias 28 Nov '02

28 Nov '02

> On Wed, 27 Nov 2002, Alex Levit wrote: > > > On the subject of YOU, there are plenty of people using > SuSE's YOU on this > > list and we don't experience such problems. Look somewhere > else for possible > > problems. > > I'm using YOU and for single machine maintenance I've been quite happy > with it. Switching to fou4s now that I'm going large-scale with SuSE > 8.0, as 80 YOU windows is more than I want to handle. Note that SuSE has obviously been working heavily on YaST2 and YOU development from 7.3 to 8.1. In 7.3, the ncurses-based (i.e. ASCII) GUI was terrible, it's definitely better (more responsive) in 8.1. YOU was the pits in 7.3. I experienced the same problems as the original poster, probably, I've ignored some inbetween mails in this thread. After I'd installed 7.3, YOU worked. It got slower and slower with every time I used it after that, eating more and more memory. After a couple of weeks it would terminate without doing its job on the lower-end machine of the two I have, with 64 MB of physical RAM and a 128 MB swap. Note that it had been swap-thrashing for quite some time before that. YOU in 8.0 is a lot more conservative in memory use. I've switched to fou4s for its easier automated use and useful features over YOU, not planning to go back. Just wanted to say that you can't judge YOU on a 7.3 system when all you know is 8.0 or 8.1. They're very different in behaviour, believe me. Tobias

1 0

Re: [suse-security] Security and Update
by GarUlbricht7＠netscape.net 28 Nov '02

28 Nov '02

DJ: I am aware that your question got answered and this thread may be already "beat to death" but I thought I would add my 2 cents. I agree that the first time I used YOU (Yast Online Update", I didn't know what happened so I tried it again, and again.... However,alot of the documentation is right there in the window. I agree it only made sense to me after I had tried YOU several times to see what happened. You may enjoy "fou4s" more, but if you decided to use YOU, I suggest reading: <file:/usr/share/doc/packages/yast2-config-online-update/y2c_online_update.html> which should be on your system. In addition to "man pages" and "--help", I am finding the "read me files" in "usr/share/doc/packages/" very helpful. I access them via Konqueror. I have also found that in addition to SuSE, people like Togan <http://dinamizm.ath.cx/> and the LINUX Documentation Project <http://en.tldp.org/> have already answered many my questions. HTH Gar ********* DJ <linux_programmer(a)hotmail.com> wrote: >MG> I'd suggest you to try fou4s (http://fou4s.gaugusch.at/), it offers you >MG> the possibility to install security fixes only (fou4s -is) as well as >MG> automatic checking/downloading/updating. I think this functionality is in >MG> YOU of SuSE 8.1, too, but yast2 online_update --help doesn't give any >MG> information about it :( > >Thank you! I'm going to checkout fou4s. The documentation for SuSE is >extremely lacking. Lots of errors in the manuals and lots of missing >information. It seems like the documentation also has a hard time >keeping current with the SuSE version. > >I just ran YOU in manual mode and there is no help wants so ever, that >I could find. After the screen repainted with the downloaded >information, I didn't have a clue what to do next. I posted in the >suse-e list, so I don't want to take up any more of your time on YOU. > >I sure wish the SuSE specific documentation was better. > >I'm definitely going to look at fou4s. > >Thank you again. > >-- >__________________________ >DJ >mailto: linux_programmer(a)hotmail.com > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

6 5

Re: [suse-security] Security and Update
by Jim Westbrook 28 Nov '02

28 Nov '02

Markus, I downloaded the latest release of fou4s and tried it again. With the single exception of a library dependency for KDE, all updates were received and installed. Thank you for the time required to create/maintain your utility. JimW Markus Gaugusch wrote: > > > On the subject of YOU, I had to reinstall a SuSE 7.3 last week. When I > > attempted to grab the YOU updates, the system crashed (no kybd response, etc.) > > requiring a cold boot recover. Once back to running, I tried YOU again, from > > the cli, and it again performed the package check then crashed the system. > > > > I then tried YOU on another SuSE 7.3 box - and after the package check > > it crashed that system as well. I've given up on YOU, but the > > alternative app doesn't work for me either. > I guess, you mean my fou4s as "alternative app". If you have problems with > it, I'd appreciate to hear about them. > I just want to make it as powerful, easy and useful as possible (and last > but not least: working). > > kind regards, > Markus Gaugusch > > -- > __________________ /"\ > Markus Gaugusch \ / ASCII Ribbon Campaign > markus(a)gaugusch.at X Against HTML Mail > / \

1 0

Squirrelmail as shipped with SuSE 81..Was it fixed?
by Matthew Johnson 28 Nov '02

28 Nov '02

Just wondering if Squirrelmail as shipped with SuSE has this vulnerability: http://www.iss.net/security_center/static/10145.php Thanks :) -- Matthew Johnson <matthew(a)psychohorse.com>

1 0

IIS Worms
by Mario Ohnewald 27 Nov '02

27 Nov '02

Hello! What can i do against these worms? [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..Á^\../winnt/system32/cmd.exe [Mon Nov 25 18:18:50 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:18:53 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe [Mon Nov 25 18:18:56 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..Á234../winnt/system32/cmd.exe [Mon Nov 25 18:19:00 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..%5c../winnt/system32/cmd.exe [Mon Nov 25 18:19:10 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/scripts/..%2f../winnt/system32/cmd.exe [Mon Nov 25 18:19:14 2002] [error] [client 80.145.88.201] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/scripts/..À¯../winnt/system32/cmd.exe [Tue Nov 26 00:43:09 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/scripts/.%2e/.%2e/winnt/system32/cmd.ex [Tue Nov 26 00:43:10 2002] [error] [client 80.133.121.24] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] File does not exist: /usr/local/httpd/htdocs/scripts/..%5c%5c../winnt/system32/cmd. [Tue Nov 26 06:35:51 2002] [error] [client 211.72.192.249] File does not exist: /usr/local/httpd/htdocs/error/error.html [Tue Nov 26 07:59:16 2002] [error] [client 210.241.51.68] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): / [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/scripts/root.exe [Wed Nov 27 09:36:25 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/MSADC/root.exe [Wed Nov 27 09:36:29 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/scripts/root.exe [Wed Nov 27 10:00:12 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/MSADC/root.exe [Wed Nov 27 10:00:16 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/c/winnt/system32/cmd.exe [Wed Nov 27 10:00:23 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/d/winnt/system32/cmd.exe [Wed Nov 27 10:00:27 2002] [error] [client 80.145.87.190] File does not exist: /usr/local/httpd/htdocs/error/error.html How can i reverse the ip to an address like whois does. What do u do against it? I am just bothered because of my mini bandwitdth. cheers, Mario

4 3

RE: [suse-security] RE: SuSEfirewall2: external ip aliases with forward / masq?
by Howard, Neal 27 Nov '02

27 Nov '02

>-----Original Message----- >From: Togan Muftuoglu >Sent: Wednesday, November 27, 2002 12:29 PM >To: 'suse-security(a)suse.com' >Subject: Re: [suse-security] RE: SuSEfirewall2: external ip aliases with >forward / masq? > > >* Howard, Neal; <nhoward(a)cwftx.net> on 27 Nov, 2002 wrote: >> >>but alas, it only supports two ip addresses of originating source and final >>internal destination like: >> >>FW_FORWARD_MASQ = "x.y.z.123,192.168.1.10,tcp,5631 \ >> x.y.z.123,192,168,1,10,udp,5632" > >Actually there is one more parameter that you can do which is the >destination port > > x.y.z.123,192.168.1.10,tcp,5631,5858 > >source_ip,destination_ip,protocol,destination_port,redirected_port Ah, I can see how this will surely come in handy for other things. > >This will mean you will be setting the pcanywhere ports on your machines Sure looks that way... Oh well, the vendor will just have to accept it. --neal

1 0

kernel question
by Piet Roorda 27 Nov '02

27 Nov '02

well if I mess up it is a security risk so: does kernel-source-2.4.19.SuSE-69.nosrc.rpm match with k_deflt.2.4.19-110.rpm? piet

1 0

problem with ICMP-Kernelparameter
by Torsten Pregel 27 Nov '02

27 Nov '02

hi list, i have linux kernel 2.4.18 and system suse 8 prof. the problem is, the kernel create not to follow files: ../ipv4/icmp_echorepley_rate ../ipv4/icmp_destunreach_rate ../ipv4/icmp_paramprobe_rate ../ipv4/icmp_timeexeed_rate thanks ps. sorry for my english --

1 0

RE: [suse-security] IIS Worms
by mailinglists＠belfin.ch 27 Nov '02

27 Nov '02

does such a thing also exist for a squid if you use it as a reverse proxy? > -----Original Message----- > From: studio3arc.com Admin [mailto:admin@studio3arc.com] > Sent: Wednesday, November 27, 2002 5:12 PM > To: mailinglists(a)belfin.ch; suse-security(a)suse.com > Subject: RE: [suse-security] IIS Worms > > > > > > > Hi > > > > to me this looks like some kind of nimda or code red. > > you can filter this using iptables string match. > > > > > > This can be done but you will also be placing reasonable overhead on > your system. There are plug-in for Apache that allows you to log these > separately. The best one I've seen and unfortunately I no longer have > the link used the hole created by nimda to place a courtesy file in a > autoexec start up script. Something to the tune of ' fix your damn > computer nimrod'. I have also seen others that e-mailed the > isp's admin. > In my experience though I never get a response. Placing a > courtesy note > in an autoexec file does work. Once I actually had a guy leave a > response on his drive asking me how to fix it. >

1 0