May 2002 - openSUSE Security - openSUSE Mailing Lists

Firewall deaktivieren
by Florian Winger 15 May '02

15 May '02

Hello list, I`m using SuSE 8.0 and want to use the rlogin or ftp command. I have already removed the SuSEfirewall2 and the personal-firewall pakages with YAST2. But I´m still not able to rlogin from a different PC. "IP Adress: Connection refused" I´m confused!!! Please help me..... Regards Flo -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

libpcap - SuSE 7.3 different versions...
by Marcin Gryszczuk 14 May '02

14 May '02

Hi All.... I have just found out (by total accident) that libpcap on SuSE 7.3 distribution differs from that which is on suse ftp server in 7.3 distro director. In CD distribution I have 0.6.2-86 and on suse ftp is 0.6.2-100. Is it some security update or something? But I can not found any announcement about it and there is no libpcap update in SuSE 7.3 update directory as well. Am I missing something or is it common situation? Best regards to all... Marcin Gryszczuk

2 1

RE: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help !
by Peer Stefan 14 May '02

14 May '02

> But his logs say his station was pinging the remote host, not > the otherway around. ok, i reread the original post by geordon vantassle. i'm sorry, i just scanned through it without reading the message carefully ... as far as i understand this post, there was a traceroute-attempt from 192.168.1.1. it reached 192.168.1.20 which then tried to ping 207.26.131.137. geordon also said, that a box wasn't alive at the time. i don't get which box wasn't alive - 192.168.1.20 or 207.26.131.137? geordon, if 192.168.1.20 wasn't alive and tried to ping 207.26.131.137, then don't panic but be carefull - maybe someone spoofed an ip-address and became part of your local net. if 207.26.131.137 wasn't alive, then there's just another box on the internet switched off ... do you know, who initiated the traceroute? regards, stefan

2 1

Unbalanced Mail...
by Phil Shrimpton 14 May '02

14 May '02

Hi, Is this somebody trying to (mis)use my mail server? ------- from sina35-183.sina.com.cn [202.108.35.183] (may be forged) with id g4DJFQA06051 ----- Transcript of session follows ----- 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' 553 5.0.0 "H+O"<lKw9bEL3v0fO5M3... Unbalanced '"' Cheers Phil -- Linux 2.4.4-4GB 9:02pm up 10:30, 3 users, load average: 0.25, 0.07, 0.02

2 1

RE: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help !
by Peer Stefan 14 May '02

14 May '02

Hi > From: John Andersen [mailto:jsa@pen.homeip.net] > > On Monday 13 May 2002 11:59 am, Geordon VanTassle wrote: > > Can someone please point me to the right direction to look to stop > > logging this particular thing? I can't even figure out why the > > Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, > > which isn't alive even, but that's a different story. > > Don't try to suppress the logging, try to suppress the pinging. > Its VERY unusual for a windows machine to ping something > all by itself, Find out WHY. i guess this box uses software like audiogalaxy, imesh or something similar. these programs try to ping hosts known to share multimedia files. if you were connected to an audiogalaxy-server once, you will be pinged for some time, before the ip-address is removed from the database. regards, stefan

2 1

SuSE 8.0 SuSEFirewall2 logging question: help!
by Geordon VanTassle 14 May '02

14 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I am pulling my hair out trying to figure out how to stop logging the following: May 13 14:54:43 gvantass kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= OUT=eth1 SRC=192.168.1.1 DST=192.168.1.20 LEN=56 TOS=0x00 PREC=0xC0 TTL=255 ID=3878 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.1.20 DST=207.26.131.137 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=12025 PROTO=ICMP TYPE=8 CODE=0 ID=1024 SEQ=5377 ] Can someone please point me to the right direction to look to stop logging this particular thing? I can't even figure out why the Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, which isn't alive even, but that's a different story. I would really appreciate some assistance, as I've tried looking in /sbin/SuSEfirewall2 and /etc/sysconfig/SuSEfirewall2 but haven't been able to figure out how to stop this. TIA - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "Hegel was right when he said that we learn from history that man can never learn anything from history." (George Bernard Shaw) il\�J�J -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPOAbIN77fDX88Gt5AQGbZwgAg9igkJZP/dn8sIgq5B8PAsrGjK0aRBLu /WgSjaJzVabB/N45vPnbgVtu+RQWzDECZNHgk672HmUEFiNpOkvOzdTMNzdwXWqR IVscMQqw9fFsUTR6OSrqsfmrKo5RqELLzZHDowcYQcUGULZpRAW/ZykodC4yG/AI nX+3KQs82+JrjTaEr3xS0r1PCKXETxQqNsAzzT2G0594y2Fsj3yh4+WmzQ9AZSP4 Q6UPbhaTxmR5Yrhlq1gQPWSafuWG+52wL5nSJCzsRKcHcLhLjDe4/clhCEwlXSET A/7PMhwIGIWORjEHTl4+z1zI88M9teW9/vC0mQAY5aWZD6hHWRVRKQ== =ZdzE -----END PGP SIGNATURE-----

2 1

Ok, I Give...
by Gary Counsellor 13 May '02

13 May '02

I have been seeing this since I started SFW2 and conect via ppp. Not sure why it's there, tried looking for clues as to why, who but found nothing meaningful. Figured it might be me and my isp (Well, I gotta think of something) Even tried to see if it time sync'd with anything going on with my box ie; sendmail, autofetch, etc. Usually I just copy error messages into google and find what I need to know but that didn't work this time. Any suggestions? I'd be happy just to stop seeing it reported but stopping it entirely, if feasible, would be cool also. SuSE-FW-UNAUTHORIZED-TARGET IN=ppp0 OUT= MAC= SRC=209.244.43.100 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=24643 PROTO=2 Thanks for the help, -- Gary Counsellor http://www.musician2000.com sineigs.all.attitudes(a)eskimo.com Please remove .all.attitudes before replying

1 0

Re: [suse-security] SuSE 8.0 SuSEFirewall2 logging question: help!
by Alberto Butrico (linux) 13 May '02

13 May '02

Geordon, Extracted from /etc/rc.config.d/firewall2.rc.config # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # only change/activate this if you know what you are doing! FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" I think that your you should play with those parameters... Saludos, Alberto mailto:linux@opc.com.uy Linux User #242064 UyLug Member #195 Con fecha Lunes, 13 de Mayo de 2002, 16:59:21, escribió: GV> -----BEGIN PGP SIGNED MESSAGE----- GV> Hello , GV> I am pulling my hair out trying to figure out how to stop logging the GV> following: GV> May 13 14:54:43 gvantass kernel: SuSE-FW-TRACEROUTE-ATTEMPT GV> IN= OUT=eth1 SRC=192.168.1.1 DST=192.168.1.20 LEN=56 TOS=0x00 GV> PREC=0xC0 TTL=255 ID=3878 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.1.20 GV> DST=207.26.131.137 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=12025 GV> PROTO=ICMP GV> TYPE=8 CODE=0 ID=1024 SEQ=5377 ] GV> Can someone please point me to the right direction to look to stop GV> logging this particular thing? I can't even figure out why the GV> Windows computer at 192.168.1.20 is trying to ping 207.26.131.137, GV> which isn't alive even, but that's a different story. GV> I would really appreciate some assistance, as I've tried looking in GV> /sbin/SuSEfirewall2 and /etc/sysconfig/SuSEfirewall2 but haven't been GV> able to figure out how to stop this. GV> TIA GV> - -- GV> Best regards, GV> Geordon mailto:gvantass@interaccess.com GV> PGP Key ID: 0xFCF06B79 Your Fortune ==>> "Hegel was right when he said that we learn from GV> history that man can never learn anything from history." (George GV> Bernard Shaw) GV> il\JJ GV> -----BEGIN PGP SIGNATURE----- GV> Version: PGP 6.5i GV> iQEVAwUBPOAbIN77fDX88Gt5AQGbZwgAg9igkJZP/dn8sIgq5B8PAsrGjK0aRBLu GV> /WgSjaJzVabB/N45vPnbgVtu+RQWzDECZNHgk672HmUEFiNpOkvOzdTMNzdwXWqR GV> IVscMQqw9fFsUTR6OSrqsfmrKo5RqELLzZHDowcYQcUGULZpRAW/ZykodC4yG/AI GV> nX+3KQs82+JrjTaEr3xS0r1PCKXETxQqNsAzzT2G0594y2Fsj3yh4+WmzQ9AZSP4 GV> Q6UPbhaTxmR5Yrhlq1gQPWSafuWG+52wL5nSJCzsRKcHcLhLjDe4/clhCEwlXSET GV> A/7PMhwIGIWORjEHTl4+z1zI88M9teW9/vC0mQAY5aWZD6hHWRVRKQ== GV> =ZdzE GV> -----END PGP SIGNATURE-----

1 0

New autotooter autowu v1.0
by Marko.Muncan＠arxes.de 13 May '02

13 May '02

I just got a copy of that new autorooter which roots wuftpd up to 2.6.2(1). Now i tried to emanine it and didn´t came through. I tried it on my network and it exploited them but i dont know whut it does. Does anyone know what it does? Mit freundlichen Grüßen Marko Muncan __________________________________________ arxes Network Communication Consulting AG Schanzenstraße 36 Gebäude 197 D-51063 Köln Telefon: +49 (0) 221 96486 - 268 Telefax: +49 (0) 221 96486 - WEB: http://www.arxes.de MailTo: Marko.Muncan(a)arxes.de Informieren Sie sich über unsere Veranstaltungen zu den aktuellen IT-Themen unter http://www.arxes.de/de/events/index.html

1 0

AW: [suse-security] smpppd
by Bitzer, Gerd 13 May '02

13 May '02

Hi, if smpppd is triggered via inetd, then there may be the possibilty to use tcpd to log and control, which source IP adresses could trigger smpppd. Just as an idea. HtH -----Ursprüngliche Nachricht----- Von: tux the turtle [mailto:tu.th.tu@gmx.net] Gesendet am: Montag, 13. Mai 2002 13:29 An: suse-security(a)suse.com Betreff: [suse-security] smpppd Hi; is there any way to get informations about which app has triggered smpppd and how to xclude the one app from access but not the other? There's something that connects me to my ISP each time i log in and i don't want to follow the t-a-e-method. Besides that: it would be great for logging... Thanx... -- *** Tux IS a turtle isn't it? *** Sys soft / Sys hard: ====================== SuSE 7.3 prof, Kernel 2.4.10-4GB (SuSE std), KDE 2.2.2 src-tarball, alsa 0.5.11 Athlon 700MHz 640MB, MoBo: Epox EP-7KXA / VT82C686A more Sys soft/ more Sys hard: ====================== SuSE 8.0 pers, Kernel 2.4.18-4GB (SuSE std), KDE 3.0 src-tarball HP Omnibook XT1000 F3433HT -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0