March 2002 - openSUSE Security - openSUSE Mailing Lists

why new GnuPG packages when it is dynamically linked ?
by malte_gell＠t-online.de 15 Mar '02

15 Mar '02

Hello, when doing ldd /usr/bin/gpg I get libz.so.1 => /lib/libz.so.1 (0x40026000) so GnuPG (on SuSE 7.3 at least) seems to be linked dynamically against libz, so it should be enough to update libz, but why offers SuSE a new gpg package although it's linked dynamically against libz ? Thanx Malte

6 7

Portsentry...
by Michael Garabedian 15 Mar '02

15 Mar '02

I would just like to tell you all about a great product. Portsentry...I just installed it on a test server and this is the output I got in an email Active System Attack Alerts =-=-=-=-=-=-=-=-=-=-=-=-=-= Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Security Violations =-=-=-=-=-=-=-=-=-= Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Unusual System Events =-=-=-=-=-=-=-=-=-=-= Mar 15 02:07:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:07:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:07:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:17:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:17:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:17:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:27:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:27:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:27:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:37:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:37:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:37:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:47:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:47:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:47:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Connect from host: 24.159.174.26/24.159.174.26 to TCP port: 111 Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via wrappers with string: "ALL: 24.159.174.26" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:54:26 sheeva portsentry[96]: attackalert: Host 24.159.174.26 has been blocked via dropped route using command: "/usr/local/bin/iptables -I INPUT -s 24.159.174.26 -j DROP" Mar 15 02:57:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:57:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:57:36 sheeva inetd[1251]: finger/tcp (2): bind: Address already in use Mar 15 02:59:00 sheeva /USR/SBIN/CRON[3533]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) Mar 15 02:59:00 sheeva /USR/SBIN/CRON[3533]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) Mar 15 02:59:00 sheeva /USR/SBIN/CRON[3533]: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly) Mar 15 03:00:00 sheeva /USR/SBIN/CRON[3536]: (root) CMD ( /bin/sh^I/usr/local/etc/logcheck.sh) Mar 15 03:00:00 sheeva /USR/SBIN/CRON[3536]: (root) CMD ( /bin/sh^I/usr/local/etc/logcheck.sh) Mar 15 03:00:00 sheeva /USR/SBIN/CRON[3536]: (root) CMD ( /bin/sh^I/usr/local/etc/logcheck.sh) File /var/log/secure cannot be read. File /var/log/maillog cannot be read. Cool ...my first security project. Mike

3 3

RE: Portsentry
by Reto Inversini 15 Mar '02

15 Mar '02

hi, be careful, that important server addresses are ignored by portsentry (e.g. your own IP, the DNS servers, etc.). otherwise an attacker could denial of service you ... but nevertheless, portsentry is a great tool and we use it for several years without any problems. best regards reto inversini

1 0

Re: [suse-security] Appletalk-ddp
by E. Scichilone 15 Mar '02

15 Mar '02

> > Hello list, >(schnipp) > > The problem: A couple of Macintoshs want to communicate with a >> Linux-PC with iptables installed, they need to pop/send their mail >> (thats no prob) and need to post some files on the Linux-System, but >> not with appletalk (afpovertcp), but with tcp. So the questions are: >> 1. How can I enable the ddp-protocol within my iptables? ´iptables >> ... -p ddp ...´ doesn´t work. >> 2. Which ports need to be opened to let macs and linux communicate >> with each other? >> Thank you in advance > >Hello, > >You don't mention whether or not you've configured Netatalk. In order >for Macintosh computers using Appletalk to see a Linux server, you need >to compile and configure Netatalk on the Linux machine. You also need to >configure your kernel to have built in Appletalk support. DDP, to the >best of my knowledge runs completely indepedently of TCP/IP and thus >will not be affected by iptables. > >Netatalk can be found on Sourceforge. It is fairly easy to configure if >you just take the default configuration files and tweak them. Netatalk >is also compiled with the standard > > ./configure > make > su -c 'make install' > >method. > >Bill Miller >jrmiller(a)cbnlottery.com Oh, yes, sorry, I forgot. Yes, netatalk is running. Yes, every Apple I want to can access any share on the Linuxbox, until I turn on the iptables-rules, which are: - all iptables-policies: DROP - accept d-ports 22,25,110,548 (INPUT) for -s 192.168.0.0/24 - accept s-ports 22,25,110,548 (output) for -d ^^^^^^^^^^^^^^ ... thats it ... and with ´iptables -L´ I get the correct tables-report. But the point is, as I mentioned, when I start my small iptables-script, the Macs ( < V9.2 btw) can´t access the Linuxbox by using tcp. Unfortunately, neither the scanlogd nor the ordinary firewall-logs (haven´t been able to include them yet) report, which ports has been tried to connect to. I already have tried to open the ports 137-139 for the Apple I am working with, but thats not the solution. Thank you Enrico --

1 0

RE: [suse-security] exported file systems
by Stelios Charalambides (5794) 15 Mar '02

15 Mar '02

OK. I know it's Friday :-) My users are creating files via NT :-< on Linux and NFS. The files on Linux all end up beloning to nobody I think and the NFS client software (Interdrive) doesn't seem to have any relevant configuration in it. I've looked at NIS but I don't think it's for this situation. Or is it? Help a poor old confused VMS system manager sort this Linux box out > -----Original Message----- > From: Martin Peikert [SMTP:Martin.Peikert@discon.de] > Sent: 15 March 2002 14:44 > To: Stelios Charalambides (5794) > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] exported file systems > > Stelios Charalambides (5794) wrote: > > Chaps, how does one go about setting the protection / ownership on > exported > > file systems automatically when they mount? > > > > > > This message is confidential and may also contain privileged > > information. If you are not the intended recipient, please contact > > the NHBC IT Dept. on +44 1494 735353 or ITRCMSG(a)nhbc.co.uk (You should > > not disclose its content to any other person). > > The contents of this email are, unless the contrary is expressed, solely > > > the view of the writer(s) and not of NHBC. NHBC has not authorised > this > > email (unless the contrary is expressed) and the fact that it is sent on > > > the NHBC system is not authorisation. NHBC is not responsible for > > the contents and accepts no responsibility for them. Data Protection > > Act 1998. NHBC is the Data Controller for the purposes of the Act. > > It stores this email and may record details taken from it as record > > of your communication. NHBC may pass your details to other > > organisations if the reason for your contacting us makes it > > appropriate. If you do not want your details passed on please > > inform NHBC immediately. > > This email has been scanned for viruses however the NHBC does not > > accept any liability in respect of damage caused by any virus which > > is not detected. NHBC is a member of the General Insurance > > Standards Council. > > If it is NFS you're talking about, take a look at > http://www.linuxdoc.org/HOWTO/NFS-HOWTO/server.html#CONFIG > If not, be more specific. > > GTi > P.S.: Your siganture exceeds the recommended four lines. > -- > This message is not confidential :-) This message is confidential and may also contain privileged information. If you are not the intended recipient, please contact the NHBC IT Dept. on +44 1494 735353 or ITRCMSG(a)nhbc.co.uk (You should not disclose its content to any other person). The contents of this email are, unless the contrary is expressed, solely the view of the writer(s) and not of NHBC. NHBC has not authorised this email (unless the contrary is expressed) and the fact that it is sent on the NHBC system is not authorisation. NHBC is not responsible for the contents and accepts no responsibility for them. Data Protection Act 1998. NHBC is the Data Controller for the purposes of the Act. It stores this email and may record details taken from it as record of your communication. NHBC may pass your details to other organisations if the reason for your contacting us makes it appropriate. If you do not want your details passed on please inform NHBC immediately. This email has been scanned for viruses however the NHBC does not accept any liability in respect of damage caused by any virus which is not detected.NHBC is a member of the General Insurance Standards Council.

1 0

YOU automatic update
by Patrick Sannes 15 Mar '02

15 Mar '02

Hello all, I have a question. Is it possible to perform automatic updates with yast online updater. Becouse it would be nice that yast look every night for updates on the packages that are installed on youre system and install them. (perhaps a nice mail after a update what he had done that night). thanks Patrick

1 0

RE: [suse-security] exported file systems
by Stelios Charalambides (5794) 15 Mar '02

15 Mar '02

Oooohh! That's a useful site. I shall now go quiet while I read. ;-> > -----Original Message----- > From: Martin Peikert [SMTP:Martin.Peikert@discon.de] > Sent: 15 March 2002 14:44 > To: Stelios Charalambides (5794) > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] exported file systems > > Stelios Charalambides (5794) wrote: > > Chaps, how does one go about setting the protection / ownership on > exported > > file systems automatically when they mount? > > > > > > This message is confidential and may also contain privileged > > information. If you are not the intended recipient, please contact > > the NHBC IT Dept. on +44 1494 735353 or ITRCMSG(a)nhbc.co.uk (You should > > not disclose its content to any other person). > > The contents of this email are, unless the contrary is expressed, solely > > > the view of the writer(s) and not of NHBC. NHBC has not authorised > this > > email (unless the contrary is expressed) and the fact that it is sent on > > > the NHBC system is not authorisation. NHBC is not responsible for > > the contents and accepts no responsibility for them. Data Protection > > Act 1998. NHBC is the Data Controller for the purposes of the Act. > > It stores this email and may record details taken from it as record > > of your communication. NHBC may pass your details to other > > organisations if the reason for your contacting us makes it > > appropriate. If you do not want your details passed on please > > inform NHBC immediately. > > This email has been scanned for viruses however the NHBC does not > > accept any liability in respect of damage caused by any virus which > > is not detected. NHBC is a member of the General Insurance > > Standards Council. > > If it is NFS you're talking about, take a look at > http://www.linuxdoc.org/HOWTO/NFS-HOWTO/server.html#CONFIG > If not, be more specific. > > GTi > P.S.: Your siganture exceeds the recommended four lines. > -- > This message is not confidential :-) > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here This message is confidential and may also contain privileged information. If you are not the intended recipient, please contact the NHBC IT Dept. on +44 1494 735353 or ITRCMSG(a)nhbc.co.uk (You should not disclose its content to any other person). The contents of this email are, unless the contrary is expressed, solely the view of the writer(s) and not of NHBC. NHBC has not authorised this email (unless the contrary is expressed) and the fact that it is sent on the NHBC system is not authorisation. NHBC is not responsible for the contents and accepts no responsibility for them. Data Protection Act 1998. NHBC is the Data Controller for the purposes of the Act. It stores this email and may record details taken from it as record of your communication. NHBC may pass your details to other organisations if the reason for your contacting us makes it appropriate. If you do not want your details passed on please inform NHBC immediately. This email has been scanned for viruses however the NHBC does not accept any liability in respect of damage caused by any virus which is not detected.NHBC is a member of the General Insurance Standards Council.

1 0

RE: [suse-security] FTP security...
by Reckhard, Tobias 15 Mar '02

15 Mar '02

> > without the protection against eavesdropping, injection or > modification > > given by SSH. > > Session Hijacking is also possible with the data connection. Which means that data can be injected and/or modifed, no? ;-) Nice weekend, y'all. Tobias

1 0

File Access Auditing
by Bill Miller 15 Mar '02

15 Mar '02

Hello, I have been looking for last few months for a good method of auditing access to files by my users. I use a SuSE Linux (presently 7.2) system with Samba and Netatalk as a file server. What I really need is the ability to say that at 3:32 PM on March 12th, user Debbie accessed the file /path/to/some/file/here. I have looked at Snare but on my test machine (which is a Single processor Celeron 333 instead of my production servers which are Dual Xeons), it makes the machine unusably slow. While I realize that a Celeron 333 is a far cry from a Dual Xeon, the Xeons have far more users then the test server, which has a single user. I have also looked at modifying the audit module which ships with Samba so that rather then print to syslog, it stores information into a Postgresql Database. This has two problems. The first being that the VFS interface to Samba has not been stabilized. The second being that it does not audit my Macs. I have looked at Tripwire, but that seems to really be geared towards static files and detecting changes that should not have happened rather then just logging accesses. Another problem I've seen with Snare is that it will most likely log file accesses when my backup program is running which will add 50-60,000 entries to the log file. That is a very bad thing as the log file will grow way too fast. Thank you for any suggestions you may have. Bill Miller Jr. jrmiller(a)cbnlottery.com

2 4

RE: [suse-security] FTP security...
by Reckhard, Tobias 15 Mar '02

15 Mar '02

> If you want use the server only internal, you can make a ssh tunnel. No, you can't. You can make an SSH tunnel for the FTP control connection, but you can't make an SSH tunnel for the data connection. Unless you modify the FTP daemon and SSH source code, that is. If all you want to do is protect usernames and passwords, this may be fine with you. But the data (e.g. transferred files and directory listings) is transmitted in clear text without the protection against eavesdropping, injection or modification given by SSH. Tobias

2 1