March 2002 - openSUSE Security - openSUSE Mailing Lists

FW: SCP from Server to Server without Password ??
by Drew J. Como 19 Mar '02

19 Mar '02

All, I did all of that and it is for some reason still not working. (I'm sure that it is something small that I am not noticing...) When I do the scp, here is the command I am issuing: /usr/bin/scp -i /home/backupuser/.ssh/id_dsa backup@host.domain.com:/home/backup/file.tgz Is there a scp switch that I need to use to force dsa?? Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com Bascom Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed." -----Original Message----- From: Drew J. Como [mailto:dcomo@bascom.com] Sent: Tuesday, March 19, 2002 10:51 AM To: 'suse-security(a)suse.com' Subject: SCP from Server to Server without Password ?? All, I had this working perfectly way back when I was using Data Fellow's SSH. Now, I have switched everything over to OpenSSH using SSH2 and am getting the following error when I try to scp. What am I missing? The authenticity of host 'xxxx' can't be established. RSA key fingerprint is 99:06:bd:3f:e7:ba:11:fc:a8:c5:9f:a3:d8:6d:12:AB. Are you sure you want to continue connecting (yes/no)? Aborted by user! verify_host_key failed Also I am trying to use DSA, not RSA. How do I change that? Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com Bascom Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

3 2

Off topic: popper failiure
by mailinglists＠belfin.ch 19 Mar '02

19 Mar '02

Hi all, I'm sorry sending you an answer that is quite off-topic. But I don't know where to go to. This is an error message that I find in /var/log/mail if a specific user tries to download his e-mails. Mar 19 17:51:47 mx popper[15251]: garciaj at fra-tgn-oyk-vty16.as.wcom.net (212.211.90.16): -ERR SIGHUP or SIGPIPE flagged [pop_send.c:405] Mar 19 17:51:47 mx popper[15251]: garciaj at fra-tgn-oyk-vty16.as.wcom.net (212.211.90.16): -ERR POP hangup from mx [popper.c:605] If I download his e-mails on my box, I have no such problems. Therefore I think it's not qpopper causing the problem. I hope somebody can help me Thanx in advance Philipp

1 0

RE: [suse-security] SCP from Server to Server without Password ??
by Peer Stefan 19 Mar '02

19 Mar '02

you have to build dsa-keys (ssh-keygen -d) and put them into the file authorized_keys2. known hosts are stored in the file known_hosts2. just connect once manually (probably to copy the public dsa-key to the peer) and everything will be fine :-) cheers, stefan -----Original Message----- From: Drew J. Como [mailto:dcomo@bascom.com] Sent: Tuesday, March 19, 2002 4:51 PM To: suse-security(a)suse.com Subject: [suse-security] SCP from Server to Server without Password ?? All, I had this working perfectly way back when I was using Data Fellow's SSH. Now, I have switched everything over to OpenSSH using SSH2 and am getting the following error when I try to scp. What am I missing? The authenticity of host 'xxxx' can't be established. RSA key fingerprint is 99:06:bd:3f:e7:ba:11:fc:a8:c5:9f:a3:d8:6d:12:AB. Are you sure you want to continue connecting (yes/no)? Aborted by user! verify_host_key failed Also I am trying to use DSA, not RSA. How do I change that? Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com Bascom Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed." -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] SCP from Server to Server without Password ??
by Reckhard, Tobias 19 Mar '02

19 Mar '02

> We do that with "scp". I´ve read that i can switch of the ugly > password-questions by generating ssh keys at both servers and > copying the > public keys to each other server. The private keys need to have an empty passphrase, though. > I did so, but the password-questions are still there. You can get rid of those by disabling password authentication. Only do so when you've got public-key authentication running reliably, though, or you'll risk locking yourself out. > Does anyone know how to install the keys at the right > position and what to > do to get this running ? Is there a tutorial or a description > how to make > an automated copying from one server to another without > password (via ssh?) See 'man ssh', 'man sshd' and 'man ssh-keygen'. Look for the public-key authentication options and the authorized_keys[2] file format. I recommend you use rsync in combination with SSH as a transport in place of scp. It allows you to switch to SSHv2, only performs incremental updates, and you can restrict the passphrase-less private key to the relevant rsync operation only. Mail me if you can't figure out how to do this yourself (after having tried at least a bit on your own, though, please). Tobias

4 3

RE: [suse-security] What to do against ARP-Poisoning?
by Reckhard, Tobias 19 Mar '02

19 Mar '02

Roland, > 1) All connections to my server can be redirected through an > attacking system > by using ARP-poisoning techniques Yes. And arp poisoning isn't your only worry. They could DoS your system, then steal your MAC address, too. ARP poison countermeasures won't help against that, only proper authentication of communicating parties will. > 2) I can try to notice if something happens to the ARP-table > but I can not > prevent things from happening without having a secure switch > at Puretec ;-) And remember that switches aren't security enforcement devices and shouldn't be expected to be. > 3) All unencrypted traffic can thus be read by the attacker <nitpick> Oh, even encrypted traffic can be read by the attacker. He shouldn't be able to read the plaintext, though. </nitpick> > 4) Even if I use a VPN to transfer all data between my > internal network and > my server at Puretec (thus being protected), Emails (i.e) > will be exchanged > with other systems on the internet and it is highly > improbable that this > traffic will be encrypted too. That depends entirely on the other systems and the level of influence you have on them. > 5) That way all emails will be readable to an attacker no > matter what I do to > protect them Plaintext Internet traffic can be read while its underway and you have no assurance of the path that traffic will take. Neighbours of your server in the ISP's rack aren't the only ones capable of capturing 'your' traffic, though it is relatively easy for them. Don't forget, though, that what matters is not so much the possibility of this happening or its probability, but rather the risk you're taking. I.e. how much of a problem would it be if someone captured your traffic? This will dictate how much effort you should put into attempts to (perhaps partially) fix the problem. One easy method to solve the arp poison issue is to place the server in an environment under your own physical control. That won't help defend against hackers 0wn1ng the mail exchangers of the people you send email to, which may well be well-known ISP machines. Tobias

4 3

SuSEfirewall2 and viewing your own internal web site.
by Argentium G. Tiger 19 Mar '02

19 Mar '02

I'm using SuSEfirewall2 doing network address translation. I have defined: FW_FORWARD_MASQ="0/0,192.168.2.12,tcp,80,80" This allows external machines to hit a test web server I have running. Now if I define a link on a web based page or forum that points back at my firewall's external address like this (assuming 1.2.3.4 is my firewall's external address): http://1.2.3.4/foo.jpg From any other machine in the world outside my firewall, I can click that link and see foo.jpg. But from inside my firewall from another machine, no go. I can't use the external address. I have to change the reference to http://192.168.2.12/foo.jpg (ie, the internal address). I'd like to know what I have to tweak in /etc/rc.config.d/firewall2.rc.config in order to allow other internal machines to use the external address to be masq-forwarded back in to the 192.168.2.12 machine? Maybe it's not possible... But I'm hoping it is. Sincerely, Argentium

4 5

RE: [suse-security] What to do against ARP-Poisoning?
by Meya, Jordi 19 Mar '02

19 Mar '02

Maybe in some presentation here: http://www.ipv6-es.com/02/in/i-docs.htm Did not go there, though :-( Jordi. -- > -----Mensaje original----- > De: Anders Johansson [SMTP:andjoh@cicada.linux-site.net] > Enviado el: 19 marzo 2002 12:52 > Para: suse-security(a)suse.com > Asunto: Re: [suse-security] What to do against ARP-Poisoning? > > If I've understood things correctly (not likely, I admit) IPv6 is designed > to > counter many of the worries you have. For instance, I understand that IPv6 > > will have built-in encryption. > > does anyone know when IPv6 is scheduled to be fully implemented/rolled > out? > > //Anders ********************************************************************** COLT Telecom Espana S.A. Oficina Registrada en: Telemaco, 5 28027 Madrid Tel. +34 91 789 9000 This message is subject to and does not create or vary any contractual relationship between COLT Telecommunications, its subsidiaries or affiliates ("COLT") and you. Internet communications are not secure and therefore COLT does not accept legal responsibility for the contents of this message. Any view or opinions expressed are those of the author. The message is intended for the addressee only and its contents and any attached files are strictly confidential. If you have received it in error, please telephone the number above. Thank you. **********************************************************************

1 0

What to do against ARP-Poisoning?
by Roland Hilkenbach 19 Mar '02

19 Mar '02

Hi list, I've got a root-server at Puretec running SuSE 7.2 and I'm concerned about the security of the machine due to the "rough" environment in that rack... I thought about prevention of ARP-Poisoning and came up with the following ideas: 1) Static entry in the ARP-table (arp -s) - if Puretec changes the NIC of the router, I#m offline - not good! 2) Accepting ARP-packets from the router only (iptables filters on MAC) - same problem as in 1) 3) Reading the arp-table via cronjob and comparing to the original value, sending a warning email, if the entry changes - the wail would go to the attacking machine, would it come through? 4) Using arpwatch would tell me about other root-servers contacting mine directly which should never be neccessary, short of a curios user like me - lots of false alarms to be expected 5)Taking the response-time of a ping to the router. The value should increase considerably going through a man in the middle - same problem as in 3), when the problem is detected, the attack was already successful. 6) Reading all MACs of all servers in the rack and comparing the entry for the router with them. If there's a match it looks like an attack, so I could reset the entry to the former value. If there's no match the entry should be accepted. Methods 1 and 2 prevent an ARP-Poisoning at the cost of turning the link down if Puretec (legally) changes the router! Methods 3, 4 and 5 only indicate a successful attack, but what to do now? I can't login to my machine without compromising the password. I could use One Time Passwords of course but I doubt I'll be able to convince my POP-users to that procedure too... Method 6 would give a opportunity to react on an attack shortly after it happened. Not very secure but at least something. I suppose the switch is the right place to prohibit ARP-Poisoning but that's the realm of Puretec, and as to their security-awareness I might tell you after the vendor reaction time ;-) I googled a bit and foung quite a lot of descriptions but no real solution to the problem. So my question: Is there any better solution to this problem? Any input is welcome - have a lot of fun Roland Hilkenbach

1 1

SuSE Firewall 2 Problem
by Chris Weber 19 Mar '02

19 Mar '02

hallo liste! ich möchte meinen linux-rechner als gateway betreiben. der linux-rechner macht die anwahl zum isp automatisch. das klappt schon mal. das interne netz soll auf meinem rechner nur auf die services squid, samba und apache zugreifen können. der die restliche anfragen sollen ins internet geroutet werden. das externe netz soll auf dem linux-rechner nur auf die den apache-service zugreifen können. restliche anfragen sollen zu den rechnern im internen netz weitergeleitet werden. reicht es wenn ich die firewall2.rc.config konfiguriere oder muss noch andere einstellungen machen, denn mein problem ist folgendes: sitze ich an meinem linux-rechner (ohne fw2 gestartet zu haben) funktioniert das internet, starte ich jedoch fw2 kommt folgende fehlermeldung in /var/log/messages: " Mar 18 02:34:52 server kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=194.25.2.129 DST=62.155.224.76 LEN=376 TOS=0x00 PREC=0x00 TTL=60 ID=28697 PROTO=UDP SPT=53 DPT=1025 LEN=356" externer adapter: ippp0 dns: 194.25.2.129 lokale dyn. ip: 62.155.224.76 meine firewall2.rc.config: ------------------------------------------ FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_INT_TCP="www 8080 139" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_DNS="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,80" FW_KERNEL_SECURITY="yes" ----------------------------------------------- ip_forward und routing sind in rc.config schon eingestellt. boot.local ist leer. danke im voraus! =) -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Re: [suse-security] SuSE Firewall 2 Problem
by Leen de Braal 19 Mar '02

19 Mar '02

As far as I know this is an englisg list. But here we go: I experienced the same problem, and I saw others today with same thing. It seems to me, that SuSEfirewall2 when installed off of the standard SuSe-distro, that is with iptables and SuSEfirewall2 checked, there is a bug in that sense, that ip-up script is not adapted for firewall2. I changed in the script all lines poiting to SuSEfirewall, to point to firewall2, and now these messages are gone. You can find ip-up in /etc/ppp. At 19:26 18-3-2002 +0100, you wrote: >hallo liste! > >ich möchte meinen linux-rechner als gateway betreiben. >der linux-rechner macht die anwahl zum isp automatisch. das klappt schon >mal. >das interne netz soll auf meinem rechner nur auf die services squid, samba >und apache >zugreifen können. der die restliche anfragen sollen ins internet geroutet >werden. >das externe netz soll auf dem linux-rechner nur auf die den apache-service >zugreifen können. >restliche anfragen sollen zu den rechnern im internen netz weitergeleitet >werden. >reicht es wenn ich die firewall2.rc.config konfiguriere oder muss noch >andere einstellungen machen, denn mein problem ist folgendes: > >sitze ich an meinem linux-rechner (ohne fw2 gestartet zu haben) funktioniert >das internet, >starte ich jedoch fw2 kommt folgende fehlermeldung in /var/log/messages: >" Mar 18 02:34:52 server kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= >SRC=194.25.2.129 DST=62.155.224.76 LEN=376 TOS=0x00 PREC=0x00 TTL=60 ID=28697 >PROTO=UDP SPT=53 DPT=1025 LEN=356" > >externer adapter: ippp0 >dns: 194.25.2.129 >lokale dyn. ip: 62.155.224.76 > >meine firewall2.rc.config: >------------------------------------------ >FW_DEV_EXT="ippp0" >FW_DEV_INT="eth0" >FW_DEV_DMZ="" >FW_ROUTE="yes" >FW_MASQUERADE="yes" >FW_MASQ_DEV="$FW_DEV_EXT" >FW_MASQ_NETS="192.168.1.0/24" >FW_PROTECT_FROM_INTERNAL="yes" >FW_AUTOPROTECT_SERVICES="yes" >FW_SERVICES_EXT_TCP="www" >FW_SERVICES_INT_TCP="www 8080 139" >FW_TRUSTED_NETS="" >FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" >FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" >FW_SERVICE_DNS="no" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="yes" >FW_FORWARD="" >FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,80" >FW_KERNEL_SECURITY="yes" >----------------------------------------------- >ip_forward und routing sind in rc.config schon eingestellt. >boot.local ist leer. > >danke im voraus! =) > > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

2 1