June 2002 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

Urgggggg!!! SuSEFirewall2 is getting on my nerves!!!!!
by Chris Bek 08 Jan '03

08 Jan '03

Hi there SuSErs... Well I must be doing something really wrong because everything that I do with SuSEFirewall2 is just not working! I have a small network with 5 PCs (all Win9X) and a Linux box (Currently SuSE 7.3) acting as a server. The server is a DHCP server and a Samba server for the entire network. So far everything is working perfect!!! Users log on the network, logon script executes etc.... Then a new task came up: let's input the internet into the network. Configured a 56Kbps modem on the server with YAST. Manged to get my account setup and running. Made a test connection and netscape works great on the server as well as e-mail (pop3). I tried configuring SuSEfirewall to manage all incoming requests from the PCs of the network. The firewall warned me about masquerading etc. so I downloaded the latest version of SuSEfirewall2 from the internet and installed it. Since I only need direct masquerading to be done (no proxies are currently working on the net) I made all the necessary changes as outlined in the examples supplied with the software. Since I needed to have Samba to keep working on the network, I opened (among others) 139 port for samba to work. Double checked all the changes that I have made and run rcSuSEfirewall2 to see what happens. Strange enough when wvdial executes it tells me that DNS is not functioning properly since www.suse.com cannot be found (or something like that please forgive me I am away from the Linux station now). Further on, when I open mIRC or other like programs (winmx etc) from a station, I look at the activity of IPtraf (I check this to see what happens) and I see no connections being created whatsoever.... mIRC prompts me that there was an error trying to find the host.... I have made no changes to the Win9X PCs. Is there something that I am forgeting to do?? I undestand that it is impossible for all of you to react to this since I have no output of the SuSEfirewall.conf file being published to this message.... I understand. Can someone please send me their configuration file so I can see what you have done, on a system that currently is working fine?? In addition, is there something that I have to do regarding route or routing?? What about the Win9X PCs?? Is there something that I have to do there?? I thank you so very much for all your help is advance!!!! I am killing myself trying to figure this one out for about 2 weeks now and managed nothing more than thin air!!!!! Chris

11 10

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

File access permissions on home users directory
by Corneliu MUSAT 08 Jul '02

08 Jul '02

Hi, When I create a new user (useradd os yast2) the users home directory have 755 access permissions. Is this normal ? What am I doing wrong ?! -- Cornel. tel.:4092743604

6 6

MD5 password confirmation fails after update to OpenSSH 3.3 on SuSE 7.3
by Thomas Föcking 02 Jul '02

02 Jul '02

Hello, this morning I updated all linux servers running SuSE 7.3 to OpenSSH 3.3. Now I am not able to login via ssh anymore - password confirmation fails. First I tought, that sshd is not allowed to read /etc/shadow, but this was not the case. "harden_suse" made my /etc/shadow passwords be encrypted with MD5. After adding a new user with yast the new user's password was only DES encrypted. With this user I am able to login, with users who has got MD5 encrypted passwords I'm not able to login via ssh. Am I right, that the new sshd has got problems with MD5 password? What can I do now? Regards, Thomas

3 2

firewall problem
by Thomas Nyman 01 Jul '02

01 Jul '02

Hi, I have a problem with my SuSEfirewall2..despite reading the examples and faq I cant get it to allow incoming and otugoing traffic on port 25 the firewall is run on a machine configured as follows eth0 = external network (internet) eth1 = internal network (192.168.1.1) the machine runs postfix and postfix can't open port 25. I've enclosed my firewall script..I'm hoping someone can see what I've done wrong. Thomas -------------------------------------------------------

4 4

OpenSSH 3.3p1 on Suse 7.1 - lockup?
by Hemsley, Trevor 30 Jun '02

30 Jun '02

I've read most of the recent discussion about Openssh 3.3p1 but haven't seen this particular issue so... I installed the 3.3p1 patch on several Suse 7.1 boxes, 7 in the UK that I can reach locally yesterday and they all seem fine and 5 more in another country that I can't get to without a plane ticket :-( Sequence of installation was to use YOU to apply the patch while logged on via SSH on all machines then to shutdown -r now them, wait a bit then log back on. So far so good on all boxes. However, within 30 minutes of the reboot on the 5 machines that I cannot reach locally, 2 of them have become inaccessible. They don't ping and nmap with the -P0 option doesn't get any response from them. That looks pretty dead to me. Neither of these two machines has done this before and up until now, they've up and running for 113 days without any issue. I can't categorically state that it is the Openssh patch that's done this since I can't find anyone around to go and look at them to find out if they're sitting with an Ooops message or what's wrong with them. But it's suspicious enough that I've backed out 3.3p1 on the machines I can still get to and gone back to 2.9.9p2-98 for now. And, yes, if I'd read the mailing list before I put the patches on then I probably wouldn't have bothered :-) With issues like this, maybe Suse should pull these particular patches off the web page/ftp site? Especially since it appears that the 2.9.9p2 rpm's aren't vulnerable to the exploit that the advisory is meant to fix. Trevor Hemsley, Security Specialist, Atos Origin Ltd, Whyteleafe, +44-(0)1883-628139 [This electronic transmission and any files attached to it are strictly confidential and intended solely for the addressee. If you are not the intended addressee, you must not disclose, copy or take any action in reliance of this transmission. If you have received this transmission in error, please notify us by return and delete the same. The views expressed in this electronic transmission do not necessarily reflect those of Atos Origin or any of its subsidiary companies. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. Thank You.]

6 5

Re: [suse-security] Buffer Overflows in DNS Resolver libs...
by ts 29 Jun '02

29 Jun '02

> for those who doesn't know already: > > http://online.securityfocus.com/archive/1/279637/2002-06-2 > 6/2002-07-02/0 > > so, hava nice weekend ;) > > Sven Yeah, I looked at this, the resolver libraries. 8.3.3 and 9.0(?) were reported safe. Any ideas on a quick fix?

2 1

Buffer Overflows in DNS Resolver libs...
by Sven 'Darkman' Michels 29 Jun '02

29 Jun '02

for those who doesn't know already: http://online.securityfocus.com/archive/1/279637/2002-06-26/2002-07-02/0 so, hava nice weekend ;) Sven

1 0

who can chown in /home
by Gero Lindenblatt 29 Jun '02

29 Jun '02

Dear friends, i am noticing that every once in a while that rwx--xr-x /home root users..... ist changed back to rwxr-xr-x /home root root ..... I know these information is no very precise. sorry for that. Here my question: Is there a program under SUSE 7.2 that does this ? or can only root do this or one of his skripts ? also, today the server was down and the mqueue ist very full. is this any hint ? thanks a lot GL ______________________________________________________________________________ FreeMail in der Premiumversion! Mit mehr Speicher, mehr Leistung, mehr Erlebnis und mehr Pramie. Jetzt unter http://club.web.de/?mc=021105

4 3

UDP security
by Pacifico Chavez 28 Jun '02

28 Jun '02

Getting messages like: kernel: UDP: short packet: 556/548 other numbers also frequently show up: 0/141 1900/141 What could this be? ----------------------------------------------------------- Pacifico -----------------------------------------------------------

1 0

Apache worm in the wild - forwarded from debian-security
by Christoph Wegener 28 Jun '02

28 Jun '02

Hi everybody, FYI: here is a little summary from debian-security from this day concerning the "apache worm".... Enjoy and have a happy weekend ;)) Christoph ------- Start of forwarded message ------- From: Domas Mituzas <domas.mituzas(a)microlink.lt> To: freebsd-security(a)FreeBSD.ORG Cc: bugtraq(a)securityfocus.com, os_bsd(a)konferencijos.lt Subject: Fwd: Apache worm in the wild Date: 28.6.2002 13:01:32 Hi, our honeypot systems trapped new apache worm(+trojan) in the wild. It traverses through the net, and installs itself on all vulnerable apaches it finds. No source code available yet, but I put the binaries into public place, and more investigation is to be done. http://dammit.lt/apache-worm/ Regards, Domas Mituzas Central systems @ MicroLink Data To Unsubscribe: send mail to majordomo(a)FreeBSD.org with "unsubscribe freebsd-security" in the body of the message -------- End of forwarded message -------- On Fri, Jun 28, 2002 at 01:01:32PM +0200, Domas Mituzas wrote: Hi, > our honeypot systems trapped new apache worm(+trojan) in the wild. It > traverses through the net, and installs itself on all vulnerable apaches > it finds. No source code available yet, but I put the binaries into public Wow, an interesting puppy. I just ran it through dasm to get the assembler dump. The executable is not even stripped, and makes an interesting read, as it gives lots of information. It looks like it was either coded by someone with little experience or in a hurry, and there are several system calls like this one: Possible reference to string: "/usr/bin/uudecode -p /tmp/.uua > /tmp/.a;killall -9 .a;chmod +x /tmp/.a;killall -9 .a;/ tmp/.a %s;exit;" I wonder how many variants of this kind of thing we'll see, but I assume most people running Apache have upgraded already. Cheers, -- Miguel Mendez - flynn(a)energyhq.homeip.net GPG Public Key :: http://energyhq.homeip.net/files/pubkey.txt EnergyHQ :: http://www.energyhq.tk Of course it runs NetBSD! ------ Start of forwarded message ------- From: Brett Glass <brett(a)lariat.org> To: flynn(a)energyhq.homeip.net, Domas Mituzas <domas.mituzas(a)microlink.lt> Cc: freebsd-security(a)FreeBSD.ORG, bugtraq(a)securityfocus.com, os_bsd(a)konferencijos.lt Subject: Fwd: Re: Apache worm in the wild Date: 28.6.2002 19:27:13 At 05:38 AM 6/28/2002, flynn(a)energyhq.homeip.net wrote: >I wonder how many variants of this kind of thing we'll see, but I assume most people >running Apache have upgraded already. Upgrading Apache may prevent your system from being taken over, but it doesn't necessarily prevent it from being DoSed. One of my Apache servers, which had been upgraded to 2.0.39, went berserk on June 25th, spawning the maximum number of child processes and then locking up. The server did not appear to have been infiltrated, but the logs were filled with megabytes of messages indicating that the child processes were repeatedly trying to free chunks of memory that were already free. Probably the result of an attempted exploit going awry. (It could have been aimed at Linux, or at a different version of Apache; can't tell. But clearly it got somewhere, though not all the way.) --Brett To Unsubscribe: send mail to majordomo(a)FreeBSD.org with "unsubscribe freebsd-security" in the body of the message -------- End of forwarded message -------- ------- Start of forwarded message ------- From: "wink" <wink(a)deceit.org> To: "Domas Mituzas" <domas.mituzas(a)microlink.lt>, freebsd-security(a)FreeBSD.ORG Cc: bugtraq(a)securityfocus.com, os_bsd(a)konferencijos.lt Subject: Fwd: Re: Apache worm in the wild Date: 28.6.2002 20:10:05 Running strings on the binary amongst other things produces an ip address (12.127.17.71) that resolves to dns-rs1.bgtmo.ip.att.net, and also: FreeBSD 4.5 x86 / Apache/1.3.22-24 (Unix) FreeBSD 4.5 x86 / Apache/1.3.20 (Unix) I went ahead and touch'ed .a, .uua, and .log in /tmp and chflags to set them immutable as I didn't see any real error handling on failed i/o operations. Some other strings not mentioned yet are: rm -rf /tmp/.a;cat > /tmp/.uua << __eof__; mv /tmp/tmp /tmp/init;export PATH="/tmp";init %s that's all i have time for at the moment. To Unsubscribe: send mail to majordomo(a)FreeBSD.org with "unsubscribe freebsd-security" in the body of the message -------- End of forwarded message -------- -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

SUID / scanimage
by Oliver Block 28 Jun '02

28 Jun '02

Hi, what are the problems thas can result from setting scanimage and xscanimage SUID? bye Oliver __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com

3 2

RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023)
by Ryan Swenson 28 Jun '02

28 Jun '02

Hello, Since SuSE's announcment I have seen only how do I fix my ssh, how do I backport to earlier version? Why is my 3.3 not working, 3.3 has a buffer overflow. --- Redhat our neighbor handled this extremely well by putting this through their QA teams and found that there were many many issues with 3.3; they found that just by configuring counter-active options in the sshd.config would prevent such exploits without making the mistake to have their customers go to version 3.3 and not in many cases be able to support backward compatibility. Now that there are official advisories from OpenSSH/OpenBSD and Security Organizations they are informing all that 3.4 fixes bugs, a buffer overflow in 3.3, and yes provides additional security mechanisms. Does SuSE have a Security QA that reviews the new unfounded code releases and feautures? Is this how you treat all customers by responding offensively as or like below. We will opt to most likely no longer QA or include SuSE in our R&D projects. Redhat has a better grip on customer interaction, security erratta, updates, and customer satisfaction. If you would like newline characters which I could care less about, write a damn German anal retentive script to parse through my emails. Ryan S. P.s. Your security mailing lists could improve should you want customers to beleive your teams have a handle on interacting with their customers. Assuring them when you have sound suggestions for security and provide updates when warranted is also key. Its important not to forget that those who are on these lists may have huge partnerships with you, or buy considerably but it takes only one misrepresentation to do away with this relationship. Perhaps you do not care but then again its your business. -----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: Wednesday, June 26, 2002 6:01 PM To: Ryan Swenson Cc: Suse-security mailingliste Subject: RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023) > > FYI -SuSE Gang > > > http://online.securityfocus.com/advisories/4230 > > > Vendor security teams should investigate the validity of their claims before suggesting all its customers obtain a workaround version released just a short while ago. What exactly is your problem? Correct me if I misunderstand you. If you read that stuff a bit more carefully, you'd know that this was the only thing we could do, except for sitting there and do nothing. The fact that these packages were of preliminary nature is nothing new. There will be another sweep of them along your way. (Your mail lacks newline characters) Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

7 8

susefirewall2 on web
by Carlos Carrera 28 Jun '02

28 Jun '02

friends, where find SuSefirewall2 with administration on WEB ??? Thanks

1 0

Firewall problems in Suse 8.0
by Thomas Nyman 28 Jun '02

28 Jun '02

Hi good people, I recently switched to Suse 8.0 on my server but I'm having a little problem...acutally its a whopper of a problem...if I run SuSEfirewall2 it will masguerade etc and allow connections to the internet....but I can't get it to allow my clients on the internal network to access popfix on the server (i.e smtp)...it looks like I can pop the server (port 110), although I'll admit I'm not sure since there are no mails to collect (but I'm not getting any errors). On the server itself I can connect to postfix via telnet localhost 25 and everything seems to work but if I try to do a telnet to the server from a client it doesnt work (whic is good because I dont want telnet). On my previous server (Red Hat 7.2) I ran a firewall script for iptables that worked fine....sooo..I figured skip SuSEfirewall2 and run the old script..but that doesnt work either and whats more if I do a port scan I find that I have ports availabe or at least not in stealth mode that where always in stealth mode before, this despite running the very same script that I had before. There is something about suse 8.0 and iptables that I'm not getting. I have master.internet.server with two nics, eth0 is connected to the internet and eth1 is connected to a local lan (192.168.1 net). On the master.internet.server I run postfix, other than that the clients should be able to surf on the internet, i.e do www connections. Which is what my old script basically did. I'm hoping someone can point me the right or perhaps has a functioning script that as defaukt disallows everything and masqs the internal network, allows www and allows smtp. My mailserver is down right now so any quick answers would appreciated and I'll make sure Santa Clause hears about it :) Thomas

3 2

[Re: [suse-security] Open-SSH-3.4p1 and Kernel 2.0.x]
by Thierry Lombardot 28 Jun '02

28 Jun '02

I just wanted to report the same problem as Christoph pointed with open-SSH-3.4p1 and kernel 2.0.x, after standard compilation: # /usr/sbin/sshd > This platform does not support both privilege separation and compression > compression disabled > Privilege separation user sshd does not exist > > ----------------- And this is an advice from an openssh developper: The issue is your using Linux 2.2 or below kernel which does not support the required mmap() features we need. This issue will be addressed in the next release. Until then just diable compression. -> This is still not working. Any comments? Th. Christoph Wegener wrote: >Hi, >does anybody have a kernel 2.0.x and Open-SSH-3.4p1 running _WITH_ SepPriv activated?!? >I always get an mm error even when compression is turned off... :(( > >Thanx for any hint >Christoph >-- > .-. Ruhr-Universitaet Bochum > /v\ L I N U X Lehrstuhl fuer Biophysik > // \\ >Penguin Computing< c/o Christoph Wegener > /( )\ Gebaeude ND 04/Nord > ^^-^^ D-44780 Bochum, GERMANY > >Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 >mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de > > > > >

3 2

Re: [suse-security] Open-SSH-3.4p1 and Kernel 2.0.x
by Christoph Wegener 28 Jun '02

28 Jun '02

Hi Andy, if you would have read my email carefully you would have noticed that in fact I HAVE turned of compression! Thanx anyway - greetings Christoph 27.7.2002 18:35:34, Andy Moore <andy(a)nexusdata.co.uk> wrote: >set compression off in the sshd_config > >On Thu, 2002-06-27 at 15:11, Christoph Wegener wrote: >> Hi, >> does anybody have a kernel 2.0.x and Open-SSH-3.4p1 running _WITH_ SepPriv activated?!? >> I always get an mm error even when compression is turned off... :(( >> >> Thanx for any hint >> Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Olaf Kirch 28 Jun '02

28 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: openssh Announcement-ID: SuSE-SA:2002:023 Date: Tue Jun 25 2002 Affected products: 6.4, 7.0, 7.1, 7.2, 7.3, 8.0 SuSE Linux Database Server, SuSE eMail Server III, SuSE Linux Enterprise Server, SuSE Linux Firewall on CD Vulnerability Type: unknown Severity (1-10): 9 SuSE default package: yes Content of this advisory: 1) security vulnerability resolved: unknown vulnerability in the OpenSSH daemon. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information There's a new vulnerabilty in the OpenSSH daemon, of which we were notified yesterday. The OpenSSH/OpenBSD team has asked Linux vendors to upgrade their platforms to OpenSSH 3.3, and change the configuration to use the relatively new "Privilege Separation" code. According to their information, 3.3 does not fix the vulnerability, but using privilege separation prevents exploits. We were not given any additional information on the nature of the vulnerability. Setting PrivilegeSeparation to on causes large portions of the daemon to run in a so-called "chroot jail", i.e. in a very restricted environment. An attacker breaking this part of the SSH daemon will *not* obtain full root privilege (as he would if sshd ran without this option), but will find himself in an empty directory, inside a process running as a non privileged user (he can still do some harm this way, but it's a far cry from full root powers). The SuSE security team has prepared RPMs that upgrade OpenSSH to version 3.3p1 on all SuSE Linux platforms. Based on the information we've been given, we are unable to provide updates containing a complete fix, nor can we guarantee that the workaround using privilege separation is enough to protect you. Given these imponderabilities, we suggest to you to take additional precautions until details of the vulnerability have been published, and we have been able to assess it: - if you do not need external access to your SSH daemons, turn off the SSH service on these machine completely, or block external access at the firewall. - if you do need external access to your SSH daemons, make sure you restrict the hosts that it will talk to by setting appropriate firewall rules. If, for some reason, you cannot configure your firewall to block external SSH access, you can also restrict access through /etc/hosts.allow; the following will allow connections from hosts with IP addresses 1.2.3.4, from hosts on the clas C IP network 192.168.5.0, and from hosts in the foo.net DNS domain, while rejecting any other connections. sshd : 1.2.3.4 : allow sshd : 192.168.5.0/255.255.255.0 : allow sshd : *.foo.net : allow sshd : ALL : deny As soon as we are given the relevant details, the SuSE security team will publish a follow-up advisory, and another openssh update, as required. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. If you are running nscd (enabled by default since SuSE Linux 7.0), the name service caching daemon, shut down the daemon prior to upgrading (this works around a bug in the groupadd command): rcnscd stop Then, install the package using the following command to apply the update: rpm -Fvh openssh*.rpm After upgrading, please restart the SSH server by executing the following command as super user: rcsshd restart Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Special notice concerning SuSE Linux 6.4 and 7.0: SuSE Linux 6.4 ceased to be supported a week or two ago. However, given the potential impact of this problem, we decided to issue update packages for 6.4 as well. These are in the process of getting built, and will show up on our FTP server soon. Users of SuSE Linux 6.4 and 7.0, please also note that crypto update packages for these platforms are always made available through ftp.suse.de only, not ftp.suse.com, due to the crypto laws that were in effect in the US at the time of the original release of the product. i386 Intel Platform SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.3p1-6.i386.patch… aa29ca8bcedf674605c69d3ebb20456c ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.3p1-6.i386.rpm 568b475b982721e62f557557c59624fb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/openssh-3.3p1-6.src.rpm 5a533bd017d86346986904b0c9e6c3e5 SuSE-7.3 ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssh-3.3p1-6.i386.rpm 86b3182d742afba08a99bb04ae91f70f source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/openssh-3.3p1-6.src.rpm 4d017a1b4a49d0da63ca18c817961b48 SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec1/openssh-3.3p1-6.i386.rpm d559ad7d04162a32c58fa07b480be820 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/openssh-3.3p1-6.src.rpm 90a4577e90d31ab9c393269c94f4fe86 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec1/openssh-3.3p1-6.i386.rpm 3f5999291e0959ebbc1afbd152d3b1f0 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/openssh-3.3p1-6.src.rpm 73c1b72c4616253d8292fad76ef0b41b SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-3.3p1-6.i386.rpm b670aa96ceaa97a33cd4b2009492e1ea source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-3.3p1-6.src.rpm 8f77876f90ef86a2e6fb8e23c34fbd6f Sparc Platform SuSE-7.3 ftp://ftp.suse.com/pub/suse/sparc/update/7.3/sec1/openssh-3.3p1-4.sparc.rpm d1306f869119e076bcb1693d8de837e4 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/openssh-3.3p1-4.src.rpm 6495e65b671b788cb62f8dcfd7f81f45 SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sec1/openssh-3.3p1-4.sparc.rpm ae8c8de1505ed2ac56fc5ec20041819c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/openssh-3.3p1-4.src.rpm 16425d92da3c9fa9feeee0322a216b1b SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-3.3p1-4.sparc.rpm 05a40abfdbd42b5465e367a187a3393c source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-3.3p1-4.src.rpm bf000a597b2cc3b33517887fa50f0504 AXP Alpha Platform SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/sec1/openssh-3.3p1-4.alpha.rpm 478503f40c0ef3ed2d5b3ea40dd74e32 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/openssh-3.3p1-4.src.rpm e8b93a73622386a95497d0418d2bfa50 SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-3.3p1-4.alpha.rpm 3001c656fb57915c4bb5dcd5fa8de76d source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-3.3p1-4.src.rpm 2fd9646fa24b5298d37a79902230c826 PPC Power PC Platform SuSE-7.3 ftp://ftp.suse.com/pub/suse/ppc/update/7.3/sec1/openssh-3.3p1-4.ppc.rpm 77dd425d361dc084bad50feefdf1f94c source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/openssh-3.3p1-4.src.rpm 8a928dc956cd107ee91d72fe4b4a8bc6 SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec1/openssh-3.3p1-4.ppc.rpm ddbc79c387273ddd0da636c7df951c85 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/openssh-3.3p1-4.src.rpm ef9f5de04c632490fe77b96e06892f01 SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-3.3p1-4.ppc.rpm 67867b11cefc77dca95aaeb130012507 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-3.3p1-4.src.rpm 76e2f4d9fb52cc5c7220f52108614542 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - mozilla Cross-dependencies between mozilla and other packages in SuSE Linux products keep us from providing version upgrades for the mozilla packages. Fixing security bugs in our packages is usually done by adding the necessary patches to the existing version to ensure the compatibility and consistency that is expected from our products. In some cases (as with the mozilla package) the complexity of the issue does not allow to add patches any more. By consequence, security related issues in mozilla cannot be addressed. As a service to our user community, we provide packages of newer mozilla versions at ftp://ftp.suse.com/pub/projects/mozilla/. These packages have been verified to run fine; they are not located in the update directory of the distribution in question because we cannot make any claims about the compatibility with the other packages in the product. Security-aware users are encouraged to install the packages from the projects/ directory. - ghostscript RedHat released a security announcement concerning a problem in ghostscript, which could be exploited to gain privilege of the print server user. We are investigating whether SuSE Linux is affected. - kernel netfilter update we are in the process of preparing a kernel update that will include a security fix for a minor netfilter bug. - fetchmail we are in the process of releasing a security update for fetchmail that corrects a vulnerability that could be exploited by hostile mail servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRiUcney5gA9JdPZAQFEmAf9H0OsASl3qLpG/XurLiFsQ5Iapxc1Z/wj rHcAaa9IrfvsQ6t3q6y+k4nQJRsmoH4K3x3eTRJMu6z7OUJnpQV67LnjFpjo7c43 u+e47XfEtRpqH7wnA7glf7m+ABy7L1oFGnJgBv7Opj9NwwAbjjoKhibmOoJmA53A Wp1pw+gZV1p64jYhSHHlZRQ7Xa+vG4vnp15Jf8ehX2Z7wxFpQBWKA7onmsvN54Q8 ufvw5v26rnAGnZEsxWErP+c+ZT6Iz98hzopaexhKCCTlIWl/MwOVx9VGjsWg+sm/ xZbBW73lCfTkG4sJBL0bxBLDBBR7KNk3LTxB9ysxYP5fRVMXeLXM3g== =ZKKJ -----END PGP SIGNATURE-----

15 22

RE: [suse-security] Securing Bind9
by Reckhard, Tobias 28 Jun '02

28 Jun '02

[restrict recursive queries to trusted clients] > That way only your clients can query and cachepoinoning is > not so likely > anymore. What gives you the impression that this will reduce the likelihood of cache poisoning? Caches are poisoned by wrongly configured or malicious DNS servers, not clients. Tobias PS: The smart-ass response of a djbdns-advocate would, of course, be: the best way to secure your DNS server is to remove any trace of BIND and install djbdns. Of course, nobody wanted to hear that. ;-)

1 0

Securing Bind9
by Patrik Breitenmoser 27 Jun '02

27 Jun '02

Hi all. I've just installed the bind9 nameserver from the suse7.3 CD and then applayed all patches. now the name server ist up and running. my questions is now. what can i do (named.conf, ...) to make the server more secure? thanks a lot patrik Breitenmoser

4 3

RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023)
by ts 27 Jun '02

27 Jun '02

> Like I said this list sucks! > Ryan, Some individuals can be trying, but that's life. Roman, I have noticed, can be abrupt if he feels the issue has been sufficiently examined and explained. By and large however the SuSE security team is extremely responsive and probably more capable than many competing distros IMO. BUT: Your attacks on these individuals really just demonstrates some immaturity and your insults and racial epithets are embarrassing and disturbing. In this case you are in the wrong and need to make a decision tete-a-tete SuSE quietly and in private without venting everywhere and against everyone.

1 0

CFS Crypto-File Problems
by Ryan Swenson 27 Jun '02

27 Jun '02

Hello, Some of us here use SuSe Linux at each foreign site to provide CFS filesystems to protect a directory containing certificates for all our various java security related certs. Its more or less our Key Escrow. Unfortunately a German co-worker took off for a 5 week vacation, and a system crashed and restarted but never mounted the CFS. Normally in the boot process we are prompted for the passphrase. What can I do to remount the CFS filesystem in the security mount point partion I created. I have a partition all of its own for CFS, the directory exists but has not mounted the filesystem. Where do I begin, to find where CFS is specified, how to mount it, etc. Thanks, Ryan S.

3 2

tricky firewall problem ...
by Martin Schichl 27 Jun '02

27 Jun '02

Dear list, I want to switch to another ISP and as I have a server, i have to run the machine for a while on two completely different IPs (with different gateways). I managed to get the system up with: eth1 = old IP Adress eth2 = new IP Adress standard gateway = gateway of eth1 if i come from inside my machine, everything works OK: ping to IP within new IP-Range: the ping goes across eth2 ping to any other IP-Adress: the ping goes across eth1 BUT: If I ping from an extern machine, I can only reach eth1 If I try to ping eth2 from extern I get following lines in my firewall log: Packet log: input ACCEPT eth2 PROTO=1 129.27.115.31:8 62.99.248.227:0 L=84 S=0x00 I=6768 F=0x0000 T=58 (#16) martian source 1f731b81 for e3f8633e, dev eth2 ll header: 00 4f 49 06 b6 f3 00 a0 c5 47 9e 6a 08 00 -> martian source ... that means, that the firewall does expect a package with this source IP adress via this route ... On the other hand, if I ping eth2 from within our subnet of the new provider it works and if I ping eth1 from here i get the same situation vice versa ... any idea how to handle this? ThanX, Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

1 0

OpenSSH 3.3p1
by Ralf Koch 27 Jun '02

27 Jun '02

Hi list, after updating my OpenSSH installation on a SuSE 7.3 system, md5 passwords no longer work with OpenSSH. Does this mean I have to convert my complete shadow file from md5 to standard crypt passwords, or is there (will there be) a pam fix to solve this issue? Thx in advance, Ralf

4 3

RE: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023)
by Ryan Swenson 27 Jun '02

27 Jun '02

Like I said this list sucks! -----Original Message----- From: Stefan Eissing [mailto:stefan.eissing@greenbytes.de] Sent: Thursday, June 27, 2002 10:54 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Re: [suse-security-announce] SuSE SecurityAnnouncement: OpenSSH (SuSE-SA:2002:023) Just for the record: I completely agree with Martin's statement and his analysis of the mail he commented. SuSE is doing a fantastic job and this mailing list and their announcements are very supportive and informative. Thanks to all involved! Regards, Stefan Am Donnerstag den, 27. Juni 2002, um 16:42, schrieb Martin Leweling: > Hi, > > On Thursday 27 June 2002 16:17, Ryan Swenson wrote: >> --- Redhat our neighbor handled this extremely well by putting >> this through >> their QA teams and found that there were many many issues with >> 3.3; they >> found that just by configuring counter-active options in the >> sshd.config >> would prevent such exploits without making the mistake to have their >> customers go to version 3.3 and not in many cases be able to support >> backward compatibility. > > That's not QA. This is just what I call a wait-and-see approach. > Red Hat just waited for the problem to go away, SuSE could have done > that as well. > > ISS and the OpenBSD team are the ones you should blame, for their > very vague and nebulous announcements. > > Anyway, SuSE's announcement was clear enough for me to decide not > to upgrade in the first place but to firewall sshd instead, until > further > clarification concerning the impact of the vulnerability. Personally, > I trust my own intelligence enough to not rely on hand-holding from any > vendor too much. > > I'll skip the rest of your mail since useless flames are not worth > repeating. > > Regards, > Martin > -- > Martin Leweling > Institut fuer Planetologie, WWU Muenster > Wilhelm-Klemm-Str. 10, 48149 Muenster, Germany > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Open-SSH-3.4p1 and Kernel 2.0.x
by Christoph Wegener 27 Jun '02

27 Jun '02

Hi, does anybody have a kernel 2.0.x and Open-SSH-3.4p1 running _WITH_ SepPriv activated?!? I always get an mm error even when compression is turned off... :(( Thanx for any hint Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

RE: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSe paration
by Reckhard, Tobias 27 Jun '02

27 Jun '02

> Again I feel SuSE jumped ahead or in with a knee-jerk > reaction to the alleged OpenBSD/OpenSSH exploit for SSH whose > argument to this moment has been largely unfounded. Until > they have produced enough documentation actually warning of > the exploit and where exactly it does so, it has not even > been made a CVE candidate, released in any official advisory > except SuSE. The Developers of OpenSSH do not even have an > answer themselves but to upgrade to 3.3 for a mere workaround > whereas 3.3 has fundemental issues of its own. ISS and Theo announced a *remote root exploit* in OpenSSH, not giving any information about mitigating factors or any other details. This is a very serious problem. And if there wasn't an exploit out in the wild already, after this announcement it is highly probable that it wouldn't take long for one to appear. On the black-hat side, that is. In the meantime, with the news being out, the only half-solution given was adopted by SuSE very quickly and released to its customers, not few of whom rely on OpenSSH to administer systems across the Internet. > I would wait until its official before getting all too > excited -perhaps look at > http://online.securityfocus.com/advisories/4230 That's exactly what Olaf et al. checked out. I don't see your point. SuSE didn't claim that the new OpenSSH RPMs fix the problem, it was rather clear (at least to me) that they were 'only' patched so as to conform to Theo's recommended mitigator. I see nothing wrong with that. And if you know better, don't update your package, it's not like they're forcing you or anything. I think you'll agree that just because you've got a vendor, that doesn't mean you shouldn't try to make informed decisions of your own about your systems. But it's nice to have prompt assistance from the vendor, SuSE in this case. Tobias

2 1

RE: [suse-security] OpenSSH ISSUE
by Ryan Swenson 27 Jun '02

27 Jun '02

By far it is, it is a great product. For a client and even server implementation also www.appgate.com is nice as well! All Swedish Security is good! :) mindterm is an applet that can be local to your system, or imbedded in your webpage and implements a full ssh1/ssh2 compliant application that supports tcp/udp tunneling and ftp as well. It uses Arcfour and supports AES as well as all 4 modes of DES/3DES. Its free for personal use. The server is not and is expensive as hell as most things in Sweden are. Ryan S. -----Original Message----- From: Stefan Suurmeijer [mailto:stefan@raptorweb.nl] Sent: Thursday, June 27, 2002 8:38 AM To: Ryan Swenson Cc: suse-security(a)suse.com; Olaf Kirch Subject: Re: [suse-security] OpenSSH ISSUE If you're going to go that way you might want to consider the "commercial" ssh version. It's free for non-commercial use (download it from www.ssh.com) Version 3.2 now, and it seems a lot more stable than openssh. Ryan Swenson wrote: >Hello, >OpenSSH has released 3.4 which addresses these security issues with regard to challenge response configuration options,etc etc... It fixes several other issues; there now exists official advisories from www.cert.org,www.openssh.com, and ISS. Perhaps everyone stop wasting their time with 3.3 and obtain 3.4 which is well supported and documented. > > > >

1 0

RE: [suse-security] OpenSSH ISSUE
by Ryan Swenson 27 Jun '02

27 Jun '02

Hello, OpenSSH has released 3.4 which addresses these security issues with regard to challenge response configuration options,etc etc... It fixes several other issues; there now exists official advisories from www.cert.org,www.openssh.com, and ISS. Perhaps everyone stop wasting their time with 3.3 and obtain 3.4 which is well supported and documented. -----Original Message----- From: Roman Drahtmueller [mailto:draht@suse.de] Sent: Thu 6/27/2002 6:23 AM To: Nico van Eikema Hommes Cc: suse-security(a)suse.com; Olaf Kirch Subject: Re: [suse-security] OpenSSH 3.3p1, HostBasedAuthentication > Hi, > > For the record, or for others using this feature: the helper program > "ssh-keysign", needed for HostBasedAuthentication, is missing in the > OpenSSH 3.3p1 RPM. Actually, there are many things missing, broken or otherwise braindead in this package (this is why some people pay for a linux distribution). Please do not send us the error reports any more. We know that it's broken. If possible, please downgrade to the openssh-2.9.9p2 package if you still have it, or await the packages that we publish soon. No promises wrt the version of these packages. > Best wishes, > > Nico van Eikema Hommes > -- > Dr. N.J.R. van Eikema Hommes Computer-Chemie-Centrum > hommes(a)chemie.uni-erlangen.de Universitaet Erlangen-Nuernberg > Phone: +49-(0)9131-8526532 Naegelsbachstr. 25 > FAX: +49-(0)9131-8526565 91052 Erlangen, Germany Grüße, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

OpenSSH 3.3p1, HostBasedAuthentication
by Nico van Eikema Hommes 27 Jun '02

27 Jun '02

Hi, For the record, or for others using this feature: the helper program "ssh-keysign", needed for HostBasedAuthentication, is missing in the OpenSSH 3.3p1 RPM. Best wishes, Nico van Eikema Hommes -- Dr. N.J.R. van Eikema Hommes Computer-Chemie-Centrum hommes(a)chemie.uni-erlangen.de Universitaet Erlangen-Nuernberg Phone: +49-(0)9131-8526532 Naegelsbachstr. 25 FAX: +49-(0)9131-8526565 91052 Erlangen, Germany

2 1

RE: [suse-security] Securing Bind9
by Peer Stefan 27 Jun '02

27 Jun '02

hi > From: Patrik Breitenmoser [mailto:pbreitenmoser@festland.ch] > Hi all. > > I've just installed the bind9 nameserver from the suse7.3 CD and then > applayed all patches. > > now the name server ist up and running. > > > my questions is now. what can i do (named.conf, ...) to make > the server more > secure? this depends very much on your configuration. how many clients do you have, do you want to allow all clients to be able to query all domains/zones? what about zone-transfers, what about forwarders, client authentication and so on. please provide some more information about your environment, how many clients, how many zones, what do you want to do with it (apart from "i want to resolve names!" - this is why you set up dns after all, i believe ;-) cheers, stefan

1 0

YaST 2 Online Update Problem?
by Simon Oliver 27 Jun '02

27 Jun '02

I've just installed SuSE 8.0 from DVD. All went well (great work SuSE). So first thing to do was an on-line update via ftp. However, while downloading the patches YaST complains on every patch: "Cannoton check patch [whatever] because the GPG package because the GPG package is not installed or the package diescription is corrupted." I've checked and GPG is installed. What's up? -- Simon Oliver

2 2

SuSefirewall2-ftp
by Carlos Carrera 27 Jun '02

27 Jun '02

Friendo, in FW_MASQ_NETS=172.16.0.0/24,0/0,tcp,21 Allow FTP in NET = 172.16.0.0/24 But NO ALLOW !!!, access FTP failure.. Help me

2 2

ipchains on dynamic ip
by Oliver Block 27 Jun '02

27 Jun '02

Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com

2 1

Re: [suse-security] ipchains on dynamic ip - P.S.
by BLeonhardt＠analytek.de 27 Jun '02

27 Jun '02

... P.S. : ... but why should you allow 3128 (Proxy) on your ISDN Interface ? ... that's no good idea ! Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Oliver Block <oblock2002(a)yahoo.de> 27.06.02 02:43 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains on dynamic ip Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] ipchains on dynamic ip
by BLeonhardt＠analytek.de 27 Jun '02

27 Jun '02

Hi, I think your "skript" should work ... I've made nearly the same rule the iptables / netfilter and is working correctly ... try it ?!? Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Oliver Block <oblock2002(a)yahoo.de> 27.06.02 02:43 An: suse-security(a)suse.com Kopie: Thema: [suse-security] ipchains on dynamic ip Hi everybody, I have a questions. How to allow traffic to a specific port without specifying the ip-address. Does i.e. ipchains -I input -i ippp0 --destination-port 3128 -p tcp -j ACCEPT work? Which other ways a to filter dynamic ip-adresses? tia Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] SuSE Apache patch sufficient?
by Alan Rouse 26 Jun '02

26 Jun '02

>> However, the exploit posted this morning on vulnwatch indicates that >> such an exploit exists against Linux. > > Again: > No, the exploit posted on vulnwatch this morning works agains xBSD > only. If you read the comments in the .c file, you will see their claim that they have exploited this under linux. Quoting below: * However, contrary to what ISS would have you believe, we have * successfully exploited this hole on the following operating systems: * * Sun Solaris 6-8 (sparc/x86) * FreeBSD 4.3-4.5 (x86) * OpenBSD 2.6-3.1 (x86) * Linux (GNU) 2.4 (x86) So either they are bluffing or the eploit does exist. I prefer not to assume the former. And I don't exactly consider these folks a trusted third party.

7 9

libwrap.a in own programmes
by Armin Schöch 26 Jun '02

26 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi ! I want to use the tcp_wrapper library in my own programmes to make them look at /etc/hosts.allow/deny in order so see whether a network connection should be refused or allowed. Unfortunately, I couldn't find much information about the way of doing this. The man page of "request_init" did help but was not enough. A search with Google didn't help me so now I'm hoping someone on this list could give me a hint where to find more information about the tcp_wrapper library. Any links, docs ? Thanks, Armin - -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Weitere Infos: siehe http://www.gnupg.org iD8DBQE9GPQsG8Xv4GxznLoRArIAAKDPxFnRpSI7vMj5SrutAEzrUVzb4ACghMuk khlt7i4mhWq8ViIpsExJ72g= =DiYA -----END PGP SIGNATURE-----

3 2

RE: [suse-security] Re: [suse-security-announce] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Ryan Swenson 26 Jun '02

26 Jun '02

FYI -SuSE Gang http://online.securityfocus.com/advisories/4230 Vendor security teams should investigate the validity of their claims before suggesting all its customers obtain a workaround version released just a short while ago.

2 1

firewall and mail relay/forwarder
by matthew zonderop 26 Jun '02

26 Jun '02

Hi All, I am running SuSEfirewall2 and I would like it to act as mail relay/forwarder for my internal mail server. I am having some config issues. Could someone help me out with the sendmail config....it works sort of...... matthew

1 0

RE: [suse-security] More information on the OpenSSH vulnerability
by Alan Rouse 26 Jun '02

26 Jun '02

I have to say, SuSE has done an excellent job under difficult circumstances in this matter. Thank you for looking out for us. -----Original Message----- From: Olaf Kirch [mailto:okir@suse.de] Sent: Wednesday, June 26, 2002 1:58 PM To: suse-security(a)suse.com Subject: [suse-security] More information on the OpenSSH vulnerability -----BEGIN PGP SIGNED MESSAGE----- ISS and the OpenSSH team just released advisories concerning the OpenSSH vulnerability. These advisories state that the vulnerability exists only if the package has been compiled with support for S/Key or BSDAUTH authentication. Inspecting the patches included in the OpenSSH advisory however show that there is a second vulnerability that can be exploited when interactive keyboard mode is enabled (via the PAMAuthenticationViaKbdInt option in sshd_config). Neither S/Key or BSDAUTH were enabled in previous RPMs released by SuSE (i.e. the OpenSSH 2.9.9p2 RPMs previously released on March 6, and the OpenSSH 3.0.2p1 RPMs released with SuSE Linux 8.0). Support for interactive keyboard mode is compiled in, and is off by default in recent RPMs. However, it can be enabled by the administrator. Which means that, in the default configuration, SuSE Linux users are not affected by this vulnerability. We will release another set of RPMs that fix this vulnerability soon. -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRoAK3ey5gA9JdPZAQGPYwf+LM2z48HlQLHZBkKcKKjJPHyxVlK4JcFs vqyfcXTgXpjw1ja4NAZpYipMTCHC46IRVjiWHOxKTku2fyUjWe/w3/HdBnY7C51m Un2O7/LcxUrCLipnz6M8c+RzGoWbLQlne0Q8ohPkEcIIOIGBzVYQ+eHjKVY4QYDy +bCA/I+DhsS1QVmdgysNGWjuTd3oiUCYypb1ICLDhE2H0lD3su/HHzhJbFn+lT/a SKqlAwlYGcnL0+776gz1hx084uHKI29BvRaFDmtQ9MVbfDG/Tc/DqqtskPxtSsLL ZkvdPLyQOTjLxZkp7BBDH+1NSim+7t9xiYw8T2kYSsnRlZm8BreOlA== =LoIo -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

More information on the OpenSSH vulnerability
by Olaf Kirch 26 Jun '02

26 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- ISS and the OpenSSH team just released advisories concerning the OpenSSH vulnerability. These advisories state that the vulnerability exists only if the package has been compiled with support for S/Key or BSDAUTH authentication. Inspecting the patches included in the OpenSSH advisory however show that there is a second vulnerability that can be exploited when interactive keyboard mode is enabled (via the PAMAuthenticationViaKbdInt option in sshd_config). Neither S/Key or BSDAUTH were enabled in previous RPMs released by SuSE (i.e. the OpenSSH 2.9.9p2 RPMs previously released on March 6, and the OpenSSH 3.0.2p1 RPMs released with SuSE Linux 8.0). Support for interactive keyboard mode is compiled in, and is off by default in recent RPMs. However, it can be enabled by the administrator. Which means that, in the default configuration, SuSE Linux users are not affected by this vulnerability. We will release another set of RPMs that fix this vulnerability soon. -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRoAK3ey5gA9JdPZAQGPYwf+LM2z48HlQLHZBkKcKKjJPHyxVlK4JcFs vqyfcXTgXpjw1ja4NAZpYipMTCHC46IRVjiWHOxKTku2fyUjWe/w3/HdBnY7C51m Un2O7/LcxUrCLipnz6M8c+RzGoWbLQlne0Q8ohPkEcIIOIGBzVYQ+eHjKVY4QYDy +bCA/I+DhsS1QVmdgysNGWjuTd3oiUCYypb1ICLDhE2H0lD3su/HHzhJbFn+lT/a SKqlAwlYGcnL0+776gz1hx084uHKI29BvRaFDmtQ9MVbfDG/Tc/DqqtskPxtSsLL ZkvdPLyQOTjLxZkp7BBDH+1NSim+7t9xiYw8T2kYSsnRlZm8BreOlA== =LoIo -----END PGP SIGNATURE-----

1 0

Fwd: Much ado about nothing.
by Christoph Wegener 26 Jun '02

26 Jun '02

What about the SuSE OpenSSH builts concerning this advisory?!? Greetz Christoph ------- Start of forwarded message ------- From: Benjamin Krueger <benjamin(a)seattleFenix.net> To: freebsd-security(a)FreeBSD.ORG Subject: Fwd: Much ado about nothing. Date: 26.6.2002 16:23:26 http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584 Regards, -- Benjamin Krueger "Life is far too important a thing ever to talk seriously about." - Oscar Wilde (1854 - 1900) ---------------------------------------------------------------- Send mail w/ subject 'send public key' or query for (0x251A4B18) Fingerprint = A642 F299 C1C1 C828 F186 A851 CFF0 7711 251A 4B18 To Unsubscribe: send mail to majordomo(a)FreeBSD.org with "unsubscribe freebsd-security" in the body of the message -------- End of forwarded message --------

4 3

System Crash while scanned by nessus or saint
by Matthias Krauss 26 Jun '02

26 Jun '02

Hi List, i've a suse linux box (7.3 Kernel 2.4.16) which is dying without console messages while scanning from a foreign host with nessus or saint, the last log message points always to "can not execute finger ...", a tcpdump shows always different (last) messages, for testing i've stopped inetd, ssh, apache,smb and so on but the host still dies, des anybody have a idea wha this could be ? I made an kernel update from 2.4.10 to 2.4.16 but other hosts with the same setup and kernel doesnt have tha prob ?? many thanks Matthias

4 3

New OpenSSH - strange processlist
by Sven 'Darkman' Michels 26 Jun '02

26 Jun '02

Hi all, i noticed that 2 sshd's are running per login?! Szenario: no one logged in: 1 sshd (main) running. 1 user logged in: 1 sshd (main), 1 sshd (owner root), 1 sshd (owner user) running. 2 users logged in: 1 sshd (main), 2 sshd (owner root), 2 sshd (owner user) running. anybody knows why? afaik it wasn't so befor the update... Greetings, Sven

2 1

DETAILS for OpenSSH bug
by Christoph Wegener 26 Jun '02

26 Jun '02

FYI - Details of the OpenSSH bug can be found in: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584 Greetz Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

RE: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSeparation
by Ryan Swenson 26 Jun '02

26 Jun '02

Again I feel SuSE jumped ahead or in with a knee-jerk reaction to the alleged OpenBSD/OpenSSH exploit for SSH whose argument to this moment has been largely unfounded. Until they have produced enough documentation actually warning of the exploit and where exactly it does so, it has not even been made a CVE candidate, released in any official advisory except SuSE. The Developers of OpenSSH do not even have an answer themselves but to upgrade to 3.3 for a mere workaround whereas 3.3 has fundemental issues of its own. I would wait until its official before getting all too excited -perhaps look at http://online.securityfocus.com/advisories/4230 Ryan S. -----Original Message----- From: Simon Oliver [mailto:simon.oliver@umist.ac.uk] Sent: Wednesday, June 26, 2002 9:48 AM To: suse-security(a)suse.com Subject: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSeparation > - They are asking all users to upgrade to version 3.3 (sic), > and enable the PrivilegeSeparation option. I have some machines running sshd V3 (not-SuSE distro). So I downloaded 3.3p1 from openssh - there are two configure options to set privsep options during compilation, but what values should I use? --with-privsep-path= --with-privsep-user= Can these be overidden / supplied in sshd_config or must it be done at compile time. Also, are there any unforseen (by me) side effects? -- Simon Oliver -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] System Crash while scanned by nessus or saint
by Matthias Krauss 26 Jun '02

26 Jun '02

Thanks, the scan is a non dangerous / default options, same with saint, you're right, seems to be an important daemon but which one is it ??? ... will keep on searching ... M. -----Ursprüngliche Nachricht----- Von: Michael Haunzwickl [mailto:michael.haunzwickl@syn.at] Gesendet: Mittwoch, 26. Juni 2002 15:18 An: Matthias Krauss; Suse-Security Betreff: Re: [suse-security] System Crash while scanned by nessus or saint Hi there, have you allready check the Nessus Options? There is one point where you can say: "Include all plug-ins" or "Just -not dangerous- plug-ins" (or something like that) ... if you use the full options, Nessus also performs DoS Attacks, and maybe crashes one of your still running deamons. Seems to be an importent deamon ... if the box crashes down ... TheJackal ----- Original Message ----- From: "Matthias Krauss" <MKrauss(a)hitchhiker.com> To: "Suse-Security" <suse-security(a)suse.com> Sent: Wednesday, June 26, 2002 3:05 PM Subject: [suse-security] System Crash while scanned by nessus or saint > Hi List, > i've a suse linux box (7.3 Kernel 2.4.16) which is dying without console > messages > while scanning from a foreign host with nessus or saint, the last log > message points > always to "can not execute finger ...", a tcpdump shows always different > (last) messages, > for testing i've stopped inetd, ssh, apache,smb and so on but the host still > dies, > des anybody have a idea wha this could be ? I made an kernel update from > 2.4.10 to > 2.4.16 but other hosts with the same setup and kernel doesnt have tha prob > ?? > > many thanks > > Matthias > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > --- Ausgehende Mail ist zertifiziert virenfrei. Überprüft durch AVG Antivirus System (http://www.grisoft.com/de) Version: 6.0.371 / Virendatenbank: 206 - Erstellungsdatum: 13.06.2002

1 0