March 2002 - openSUSE Security - openSUSE Mailing Lists

missing signature
by Mitchel-Martin Timm 07 Mar '02

07 Mar '02

Some rpm- and srpm-packages haven't a signature. For Example: ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/modules-2.3.9-63.src.rpm ...(bind8, aaa_base, modules, bindutil, perl, syslogd). Why?

1 0

Re: Apache+php Proof of Concept Exploit
by phil 07 Mar '02

07 Mar '02

Greetings, I was testing out the source code on http://online.securityfocus.com/archive/82/259542 on my box and I have the following installed (to the best of my knowledge) using rpm -q <target name> mod_php4-core-4.0.6-147 phplib-7.2c-45 phpdoc-4.0.3-38 mod_php4-4.0.6-147 apache-1.3.19-48 And according to " <? phpinfo() ?> " PHP Version 4.0.6 Apache/1.3.19 IP Location used for test: http://192.168.0.2/time.php Hostname: lead.box.yankee (although in THIS test in THIS msg I used IP num) Port: 80 ---- time.php 's source code is ---- <center> <H1> <? echo "Connect!" ?><br> </H1> <? print(date("l dS of F Y h:i:s A")); ?><br><br> <? phpinfo() ?><br> </Center> <HR> ---- time.php 's source code is ---- after compiling apache_php.c and running these commands phil@lead > ./a.out 192.168.0.2 80 /time.php phil@lead > ./a.out 192.168.0.2 80 ./time.php phil@lead > ./a.out 192.168.0.2 80 "/time.php" phil@lead > ./a.out 192.168.0.2 80 "./time.php" phil@lead > ./a.out 192.168.0.2 80 "/time.php/" phil@lead > ./a.out 192.168.0.2 80 "./time.php/" phil@lead > ./a.out 192.168.0.2 80 ./time.php/ I get /var/log/httpd/error_log [Tue Mar 5 17:13:29 2002] [error] [client 192.168.0.2] Invalid URI in request POST ./time.php HTTP/1.0 [Tue Mar 5 17:14:08 2002] [error] [client 192.168.0.2] Invalid URI in request POST ./time.php HTTP/1.0 [Tue Mar 5 17:14:20 2002] [error] [client 192.168.0.2] Invalid URI in request POST ./time.php/ HTTP/1.0 [Tue Mar 5 17:14:25 2002] [error] [client 192.168.0.2] Invalid URI in request POST ./time.php/ HTTP/1.0 I'd also note that with 7 command line attempts above only 4 log entries were written. Three log entries are "missing" ;o) /var/log/httpd/access_log (note: they are now showing) 192.168.0.2 - - [05/Mar/2002:17:13:08 -0800] "POST /time.php HTTP/1.0" 200 7865 192.168.0.2 - - [05/Mar/2002:17:13:29 -0800] "POST ./time.php HTTP/1.0" 400 338 192.168.0.2 - - [05/Mar/2002:17:14:02 -0800] "POST /time.php HTTP/1.0" 200 7865 192.168.0.2 - - [05/Mar/2002:17:14:08 -0800] "POST ./time.php HTTP/1.0" 400 338 192.168.0.2 - - [05/Mar/2002:17:14:16 -0800] "POST /time.php/ HTTP/1.0" 200 7865 192.168.0.2 - - [05/Mar/2002:17:14:20 -0800] "POST ./time.php/ HTTP/1.0" 400 339 192.168.0.2 - - [05/Mar/2002:17:14:25 -0800] "POST ./time.php/ HTTP/1.0" 400 339 I know apache is still up cause I have several exploitable versions of php software (php-nuke, phorum) that I had been testing for exploits. (which I did find.) The question is SuSE immune to this "Proof of Concept Exploit" I have SuSE 7.2 only to test on, the guy that wrote this has, RedHat 7.0 with apache 1.3.22 I don't have any other boxes I can test on except win boxes (which doesn't matter for this particular question) -- Linux 2.4.7-4GB #1 Thu Oct 25 17:53:12 GMT 2001 i586

8 22

suse 7.3 security patches - where to find
by Manfred Larcher 07 Mar '02

07 Mar '02

I have got a local copy of ftp.suse.com/pub/suse/i386/update/7.3/ and I use sitecopy to update it. Do I need more, ist there another path with related files for 7.3? Or ist it enough to install those files when they are updated? thanx Manfred -- ------------------------------------ Pirlo Ges.m.b.H. & Co Manfred Larcher Hugo Petter Str. 8-14 A-6333 Kufstein Tel. +43 5372 64923 65 oder 35 Fax +43 5372 64923 61 mailto:mlarcher@pirlo.com http://www.pirlo.com ------------------------------------

2 1

Re: [suse-security] Highport access
by Paul Elliott 07 Mar '02

07 Mar '02

On Wed, Mar 06, 2002 at 11:30:07PM +0100, Andreas scholz wrote: > let me suggest to take a look at point Nr. 11 of firewall2.rc.config > > -FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" or better > > define a Port Range : "from:to" "1023:5999" > > (but i don´t know exactly how this could effect on other services) > > cu AS Does this mean that one could do the following if one wanted to allow the use of ftp, disallow ports 6000,7741,8007 but allow most other high ports? Will this work? FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data 1024:5999 6001:7740 7742:8006 8008:65535" -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

3 3

swat on SuSE7.3
by Razvan CATINAS 07 Mar '02

07 Mar '02

Hello! I want to configure samba on my linux box (SuSE 7.3) using swat. I can login to localhost:901 with a normal user, but when I try to login with "root" user, I receive: ----- 401 Bad Authorization username or password incorrect ----- root/password that I use are 100% correct. How can I solve this problem? Razvan C.

1 0

Re: [suse-security] Apache version
by m3047＠inwa.net 07 Mar '02

07 Mar '02

If "connection closed by foreign host" or something is what you're after, just packetfilter it. All you have to really block is SYNs against port 80. Of course if you really want to get obtuse and you don't mind emulating a SYN attack against yourself, you could block their ACK instead. (Why on earth would you do that? Oh, I don't know. Because it's easier than programming in a timer so that they only get one packet back every 30 seconds or so.. preferably an out of sequence one.). (Disclaimer goes here.) -- Fred Morris m3047(a)inwa.net

1 0

Re: [suse-security] SuSeFirewall2 and Squid, Transparent Proxy
by tacchino801＠libero.it 06 Mar '02

06 Mar '02

Hi, Robert 1 of all: Really many thanks for your answear and suggestion! Now I go to install the squid v2.4! But let me know undestand better a concept...Do you think that Squid 2.4 is "required" to use transparent proxy with kernel 2.4?! Great, You are beginning to speak Italian! ;-) Thanks and regards Lorenzo > Hi Lorenzo, > > I adopt that you use kernel 2.4.x! So if you use kernel 2.4.x you have > to use squid 2.4 (because it has some advantages which take affect when > using kernel 2.4.x). > And I think you should reconfigure you redirect option like: > FW_REDIRECT="192.168.1.0/24,!<SERVERIP>,tcp,80,3128 > 192.168.1.0/24,!<SERVERIP>,udp,80,3128" > > I hope that will help you. > > Ciao ;-) > > Robert Rottscholl - DE > > tacchino801(a)libero.it wrote: > > > HI, > > It is a long time that I read suse security mailing-list. > > > > I figured my SuseFirewall1 v 5.0 and squid 2.3 for transparent proxy, > > all works well! > > I used Manuals of my "Suse 7.2 Pro" box. > > > > > > Now I installed "Suse 7.3 Pro" I configured SuseFirewall2 script but I > > have a problem with SuseFirewall2 v2.0 and Squid 2.3. > > Transparent proxy does not work, and I can not understand why? > > > > I used iptraf to see the connections...clients access directly to > > network and not through squid ip address!! > > > > Networks Manuals of "Suse 7.3 Pro" are the same of "Suse 7.2" but the > > Suse Firewall is updated from 1 to 2! > > There are no specific mention to this! > > > > I have configued the SuseFirewall2 script with this lines: > > FW_SERVICE_SQUID="yes" > > FW_REDIRECT="192.168.1.0/24,0/0,tcp,80,3128 > 192.168.1.0/24,0/0,udp,80,3128" > > > > The squid.conf file is so configured: > > > > httpd_accel_host virtual > > httpd_accel_port 80 > > httpd_accel_with_proxy on > > httpd_accel_uses_host_header on > > > > Many thanks > > Lorenzo Rossi > > > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

Highport access
by Paul Elliott 06 Mar '02

06 Mar '02

Using SuSEfirewall2 how do I disallow external access to highport 6000, but allow access to the other highports? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

RE: [suse-security] SuSeFirewall2 and Squid, Transparent Proxy
by tacchino801＠libero.it 06 Mar '02

06 Mar '02

Hi, Carlos Ok! I go to check those settings..and do related changes. Did you test a similar configuration? Have you experienced problems..?! Grazie e ciao..:) Lorenzo From: "Carlos Carrera" <ccarrera(a)lamolina.edu.pe> Date: Wed, 6 Mar 2002 10:01:02 -0500 Message-ID: <000301c1c51f$bd71e2a0$100010ac(a)lamolina.edu.pe> Subject: RE: [suse-security] SuSeFirewall2 and Squid, Transparent Proxy OK, check FW_SERVICE_TCP_INT="3128" Recomend.. FW_SERVICE_AUTODETECT="no" FW_SERVICE_SQUID="no" Good Luck -----Mensaje original----- De: tacchino801(a)libero.it [mailto:tacchino801@libero.it] Enviado el: Miércoles, 06 de Marzo de 2002 04:05 a.m. Para: suse-security(a)suse.com Asunto: [suse-security] SuSeFirewall2 and Squid, Transparent Proxy HI, It is a long time that I read suse security mailing-list. I figured my SuseFirewall1 v 5.0 and squid 2.3 for transparent proxy, all works well! I used Manuals of my "Suse 7.2 Pro" box. Now I installed "Suse 7.3 Pro" I configured SuseFirewall2 script but I have a problem with SuseFirewall2 v2.0 and Squid 2.3. Transparent proxy does not work, and I can not understand why? I used iptraf to see the connections...clients access directly to network and not through squid ip address!! Networks Manuals of "Suse 7.3 Pro" are the same of "Suse 7.2" but the Suse Firewall is updated from 1 to 2! There are no specific mention to this! I have configued the SuseFirewall2 script with this lines: FW_SERVICE_SQUID="yes" FW_REDIRECT="192.168.1.0/24,0/0,tcp,80,3128 192.168.1.0/24,0/0,udp,80,3128" The squid.conf file is so configured: httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on Many thanks Lorenzo Rossi -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

postfix-smtpd over inetd
by mailinglists＠gmx.li 06 Mar '02

06 Mar '02

hi list, today i have got a problem with the postfix-smtpd. on my machine there is pop-before-smtp-system running, writing the poppers-client-ip into a hash which is used by the postfix-smtpd. unfortunately this pop-before-smtp-mechanism sometimes was to slow and by this the first email often was rejected (latency of just 1-2 sec between pop and smtpd). now i tried to run the postfix-smtpd over the inetd, but using a shellskript for smtpd in the inetd-conf: #!/bin/bash /bin/sleep 2 /usr/sbin/sendmail -bs the bad news: after doing this NO rejecting was performed any longer ;-( why? i thougth the sendmail-command is a substitution by postfix and my script starts the same daemon as defined in the master.cf by postfix. does anybody out there know something about this? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

4 8