May 2002 - openSUSE Security - openSUSE Mailing Lists

Output from the last command
by Torsten Mueller 04 May '02

04 May '02

Hey, on my SuSE-Linux-FTP-i386-7.2.0 i get 2 lines if i type the last, which i can't interpret: root pts/2 p50883d2e.dip.t- Mon Apr 29 02:56 - down (00:40) root pts/0 p50883d2e.dip.t- Mon Apr 29 02:07 - down (01:28) X******* ****X******* X*******X******* Thu Jan 1 01:00 - down (11806+01:36 root pts/0 pd9533d73.dip.t- Tue Apr 9 09:12 - 10:03 (00:50) root pts/0 pd9e47f88.dip.t- Sat Apr 6 07:07 - 07:15 (00:07) X******* ****X******* X*******X******* Thu Jan 1 01:00 - 01:00 (00:00) root pts/1 p5088308b.dip.t- Sat Mar 30 00:06 - 02:10 (02:03) root pts/0 p5088308b.dip.t- Sat Mar 30 00:06 - 02:10 (02:03) reboot system boot 2.4.7 Fri Mar 29 23:53 (30+02:42) I looked in /var/log/* but could not find mysterious entrys in the files between Sat Mar 30 00:06 and Sat Apr 6 07:07. I first tried to search with google, but the '*' seems to bring me other results, than i wanted. Thanks for your help. Torsten

1 0

iptables und dnat (ftp hinter router)
by killer 04 May '02

04 May '02

hallo zusammen. irgendwie hab ich leichte probleme mit iptables unter SUSE 8.0 ich will einfach nur einen port für den ftpserver an einen host hinter der firewall forwarden. unter ipchains habe ich das immer mit : ipmasqadm autofw -A -v -r tcp 21 21 -h 191.168.0.2 gemacht. laut nat howto sollte das unter iptables mit : iptables -t nat -A PREROUTING -p tcp --dport 21 -i ppp0 -j DNAT --to 192.168.0.2:21 funzen. aber irgendwie landen die packet in meiner default drop: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT=eth0 SRC=130.83.233.186 DST=192.168.0.2 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=7636 DF PROTO=TCP SPT=4468 DPT=666 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405640402080A03D4BDF80000000001030301) bin leider noch nicht ganz so erfahren in iptables, vielleicht kann mir da jemand helfen. mfg christian michallek

1 0

AW: Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSEsupported ??
by Gunther Stammwitz 03 May '02

03 May '02

Hi, It seems to work well with SuSE8, that's true. But as far as I know it is looking in /etc/rc.config which is no longer being used with SuSE 8.0. Mark should fix this :-) Bye, Gunther -----Ursprungliche Nachricht----- Von: Milan Goellner [mailto:milan.goellner@compu-shack.com] Gesendet: Freitag, 3. Mai 2002 08:00 An: gstammw(a)gmx.net; suse-security(a)suse.com Cc: jschoeler(a)cccbbs.de Betreff: Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSEsupported ?? Hi, I'm using harden_suse on 8.0 on production Servers, ran like a charm, finished in record time (I've been given new hardware ;) and there are no issues whatsoever SO FAR as the servers all still seem to be un-rooted ... so to speak. regards, Milan

1 0

Re: [suse-security] aaa_base updating /etc/passwd
by James Ogley 03 May '02

03 May '02

> So how would you do this ???? You also had a look at the prein-Script > ??? There the password-template is generated, so all your changes will > be lost. D'oh! Thanks for pointing that out... So, back to my original question - is there a way of preventing this from being done? (Other than every time aaa_base is updated, getting the .spm file, changing the preinstall script and rebuilding it?) And I'd still like to know why it says it's unchanged, when it changes it ;) -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.0) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

Need help with iptables: missing .so -- and I can't use DENY or ACCEPT
by JW 03 May '02

03 May '02

Hello, I have been trying for 2 days to get iptables to work. Something is really really wrong. Initially I was trying on a 7.3 install that had been upgraded from 7.2. I thought maybe the software was just messed up so I just finished a clean install of 8.0, yet I am getting exatly the same error messages: bismuth:~ # iptables -A INPUT -p tcp -i eth0 -s 192.168.0.110 -j DENY iptables v1.2.5: Couldn't load target `DENY':/usr/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # iptables -A INPUT -p tcp -i eth0 -s 192.168.0.110 -j deny iptables v1.2.5: Couldn't load target `deny':/usr/lib/iptables/libipt_deny.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # iptables -A INPUT -s 65.166.138.61 -j DENY iptables v1.2.5: Couldn't load target `DENY':/usr/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # I've tried dozens ot test commands too, any of the that use DENY or ACCEPT fail. Even more interesting: According to the Linuxnewbie.org tutorial, both of the following commands should prevent 192.168.0.110 from being able to access the machine running iptables: iptables -A INPUT -s 192.168.0.110 -j DENY iptables -A INPUT -s 192.168.0.110 -j DROP Yet, the exact _opposite_ happens: the local machine ends up not being able to to anything to the remote host, yet the remote host is still able to log in via telnet just fine. Disgusting. Thinking that maybe I was just misunderstanding something, I tried -d in place of -s and that does nothing at all, both hosts are able to log into each other. Something is badly amiss. Please, can anyone explain this? I get similar errors when I try to use ACCEPT. All I'm trying to do is restrict port 5000 (I'm using 5001 as a test) so that only 1 IP can access it. Eventually that IP will be 65.166.138.61 but I'm using 192.168.0.110 as a test. Please, someone strighten me out. And before you say RTFM, I've been reading it for 2 days. I'm going precisly by the book, and it's not working. Something is just plain wrong. Also please don't ask me to use SuSE Firewall2, I've tired it quite a few times and I'm never able to get it to work. Thanks in advance. -- ---------------------------------------------------- Jonathan Wilson System Administrator Clickpatrol.com Cedar Creek Software http://www.cedarcreeksoftware.com

4 6

aaa_base updating /etc/passwd
by James Ogley 03 May '02

03 May '02

As part of our security audit on any new boxen we deploy, we remove all spurious usernames from /etc/passwd and /etc/shadow However, when we updated aaa_base from ftp.suse.com, the RPM update gives this output: Updating /etc/passwd...unchanged Updating /etc/shadow...unchanged But it does change it - it restores all the spurious usernames (zope, amanda, codadmin etc etc) Surely all these usernames are not contained in the package's post-install script, so does it read them from somewhere else? (And really, why does it say it is leaving the files unchanged, when it clearly isn't?) -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.0) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 2

samba problem with cups changing /var/spool/lpd/lp access permissions
by Jochen Staerk 03 May '02

03 May '02

Hi List, When I set access permissions on /var/spool/lpd/lp to public writeable, my samba does work fine, but when i restart, cups (?) changes them back to rwx------ lp lp i can't find any file where i could configure cups not to do so - is there one? is there another possibility except running a script at startup that changes those permissions? The message Permissions for /var/spool/lpd ? From: Robert Casties (robert.casties(a)philo.unibe.ch) at Fri Nov 12 1999 - 04:54:41 PST matches my problem and changing /var/spool/lpd permissions doenst work with me (doenst affect anything). thanks&ciao Jochen

2 2

sendmail attack ? relaying denied
by Gero Lindenblatt 03 May '02

03 May '02

Hi, since yesterday my sendmail 8.11.3 does not relay any more. In the /etc/mail/access nothing was changed. I restarted sendmail again and again. but nothing helped. In /var/log/warn there are serveral lines like "sendmail[11695]: g4212j111695: collect: premature EOM: Error 0" Could this be a reason or am I hacked ? thanks GL ________________________________________________________________ Keine verlorenen Lotto-Quittungen, keine vergessenen Gewinne mehr! Beim WEB.DE Lottoservice: http://tippen2.web.de/?x=13

2 1

Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Milan Goellner 03 May '02

03 May '02

Hi, I'm using harden_suse on 8.0 on production Servers, ran like a charm, finished in record time (I've been given new hardware ;) and there are no issues whatsoever SO FAR as the servers all still seem to be un-rooted ... so to speak. regards, Milan

1 0

AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hi Jost, did you test it ?? Looks like I'm a cadger. If it workes well with your system I'm going to give it a try on my system :-))) Bye, Gunther -----Ursprüngliche Nachricht----- Von: jschoeler(a)cccbbs.de [mailto:jschoeler@cccbbs.de] Gesendet: Freitag, 3. Mai 2002 00:49 An: Gunther Stammwitz Betreff: Re: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? Hello, I think, that is my own risk and time, to test the harden_use together with SuSE 8.0. You can wait on another one, who will test it, but you can also test it for yourself. For such tests I can explain VmWare or something else, with a real test-area near the reality of your productive systems. When someone you tells, that it will be gone, that isn't a promise for your systems, or? Many greetings, Jost Schöler cccbbs Kommunikationstechnik Kreuzta/Germany "Gunther Stammwitz" <gstammw(a)gmx.net> wrote on 02.05.2002 19:15:06: > Hello Johan, > > thanks for your reply, but just TRYING is _NOT_ an option for me. > We're using linux in productive enviorments. Errors mustn't happen. > > Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. > > Bye, > Gunther > > -----Ursprüngliche Nachricht----- > Von: Johan Stäring [mailto:js@fy.chalmers.se] > Gesendet: Donnerstag, 2. Mai 2002 15:06 > An: Gunther Stammwitz > Cc: suse-security(a)suse.com; marc(a)suse.de > Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? > > > On Thu, 2 May 2002, Gunther Stammwitz wrote: > > :can I use harden_suse with SuSE-8.0 ?? > :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th > :June 2001. > :This is definitive BEFORE SuSE 8.0 has been released. > > Why not try instead of ask? :) > > Change the line $debug = 0 to $debug = 1 in the harden_suse script and > execute it. Look for error messages and look through the output files that > in debug mode ends up in a directory named something similar to > /tmp/.harden_suse.<pid> > > If nothing seems to break, the script works. > > /Johan, without a SuSE 8.0-machine to try on > > -- > ================================================================ > || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || > || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || > ================================================================ > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0