June 2002 - openSUSE Security - openSUSE Mailing Lists

Fou4s - Fast OnlineUpdate for SuSE 0.6.0
by Markus Gaugusch 05 Jun '02

05 Jun '02

Hi, A major new release of my Yast OnlineUpdate replacement is out. Fou4s is best suited to be run as a cron job and automatically download/install update packages. >From the Changelog: 0.6.0, Wed Jun 5 2002 * Fixes for 0.5.0 + Fixed error "too many arguments", if Auto= in config file was empty or not set + lsof now uses -n parameter to disable network resolution (faster!) + If there are installation problems, a recommendation for -a option is printed + "Need to download ... packages" counted packages from remarklist too * Multiple Server support!! This should make multi-configfile "hacks" obsolete. * /etc/fou4s.conf will not be moved away anymore during RPM update. The new version is now saved as /etc/fou4s.conf.rpmnew when updating. This behaviour will be kept as long as possible from now on. * Fou4s public GPG key is now delivered with fou4s itself and not downloaded from the keyservers (some people behind proxies had problems with this). * Support for patch.rpm files (has always worked, but now it's official ;) * Use http://ftp.gwdg.de as default server, because ftp doesn't work with proxy and http is faster. BTW: you can ignore HTTP 416 errors from wget. (please change your current config file if you are updating) Fou4s is available from http://fou4s.gaugusch.at or via fou4s -u --checkfou4s && fou4s -i Bad News: SuSE has removed package description files for SuSE 6.4 and 7.0. See also the statement on my homepage. This will also break Email Server II updates. I'm sorry, but there is nothing I can do. Maybe some volunteer can provide package descriptions (they are only simple text files), that point to a SuSE mirror. Fou4s could then use those package descriptions. I don't run SuSE 7.0 anymore, so don't ask Me. Fou4s checks all packages against the SuSE build key, so there won't be a security problem with trojaned packages! The only exception is fou4s itself, which is checked against fou4s(a)gaugusch.at regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

nmap
by arawak 05 Jun '02

05 Jun '02

Hi What would the command options to get this type of output using Nmap. list of one line per network with the name, ip network address, number of addresses and number of hosts.? output to a file... I'm new to the scanning with nmap... But I want to learn. Dre ..

2 1

Telnet Problem
by Stanley Caramoy 05 Jun '02

05 Jun '02

Hello.... I'm having a problem with my Linux Server (SuSE 7.0). Someone has tried to login to my machine without username and password. He/She tried to login with Telnet (from Windows) with extra commands behind the telnet command. He/She can access my Linux Server without Username and Password. How to make the security of my Linux Server better ? Thanks... -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

9 10

Re: [suse-security] Telnet Problem
by BLeonhardt＠analytek.de 05 Jun '02

05 Jun '02

Hi, never use telnet for remote access or something like that... ... all traffic ( inclusive username / password ) will be transmitted as "plain text" over the network(s) ... user ssh ... there is a sshd on the linux-distro... install that ... use my howto on http://www.linux-it.net ... Install putty onto your client .. ...you've to login as root for sshd installation ... ! Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Stanley Caramoy <s_caramoy(a)gmx.de> 05.06.02 13:30 An: suse-security(a)suse.com Kopie: Thema: [suse-security] Telnet Problem Hello.... I'm having a problem with my Linux Server (SuSE 7.0). Someone has tried to login to my machine without username and password. He/She tried to login with Telnet (from Windows) with extra commands behind the telnet command. He/She can access my Linux Server without Username and Password. How to make the security of my Linux Server better ? Thanks... -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Firewall Routing/Forwarding Problem
by Robert Szentmihalyi 05 Jun '02

05 Jun '02

Hi, I have a strange problem which I have been debugging unsuccessfully for two days now. Perhaps one of you can help. We have a web server (SuSE Linux 7.3) behind a firewall (SuSE Linux 7.1) with iptables filtering rules. The firewall's NICs are configured as follows: eth0 62.245.134.130 netmask 255.255.255.240 connected directly to the web server via a cross-over cable eth1 62.245.134.146 netmask 255.255.255.240 connected to the internet route -n tells Destination Gateway Genmask Flags Metric Ref Use Iface 62.245.134.128 0.0.0.0 255.255.255.240 U 0 0 0 eth1 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 0.0.0.0 62.245.134.129 0.0.0.0 UG 0 0 0 eth1 62.245.134.129 is the gateway IP address assigned to us by the ISP. The web servers NIC is configured as eth0 62.245.134.145 netmask 255.255.255.240 and the routing table looks like this: Destination Gateway Genmask Flags Metric Ref Use Iface 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 0.0.0.0 62.245.134.146 0.0.0.0 UG 0 0 0 eth0 The problem is that the web server is not reachable on from the other side of the firewall although IP forwarding is activeated on the firewall. I don't think the problem is related to the filtering rules, but I can post the script if neccessary. Am I missing something? Do I have to configure the firewall as an ethernet bridge for this to work? Any hint is appreciated. Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

1 0

RE: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING IN
by Peer Stefan 05 Jun '02

05 Jun '02

> The adsl-router is connected direct to the externel device > (eth1) of the > server. The internel device (eth0) is connect to a switch. > The same configuration was running on an ohter server with > SuSE Linux 7.0 > (Kernel 2.2) and SuSEfirewall1. do you have a routerdaemon up and running, listening and shouting on udp-port 520? ('netstat -anp | grep 0.0.0.0:520') if so, you can either configure your routerdaemon not to shout on both interfaces or you disable the logging of these messages. regards, stefan

2 1

Kaspersky AntiVirus Trouble
by sc＠optomed.de 05 Jun '02

05 Jun '02

hi all, i am trying to install Kaspersky AV Linux, but having serious trouble while compiling the monitor (better "klmon" module - for on access scans) i folled the handbook-instructions (just a few) but this ends up in more than 40 lines of errors....at the end of this mail, www.kaspersky.com, google + groups doesn't helped so far... any kind of help is welcome - thank you Andreas (Rainer, could you help again ?) -------------------------------------------------------------------------------------------------------------- comp1:/opt/AVP/kavmonitor/module.linux # make gcc -c -D__KERNEL__ -I/usr/src/linux/include -Wall -O2 -fomit-frame-pointer -fno-strict-aliasing -pipe -fno-strength-reduce -m486 -malign-loops=2 -malign-jumps=2 -malign-functions=2 -DCPU=686 -DMODULE handle_execve.c In file included from module.h:8, from handle_execve.c:6: /usr/include/linux/version.h:2: #error "=======================================================" /usr/include/linux/version.h:3: #error "You should not include/usr/include/{linux,asm}/ header" /usr/include/linux/version.h:4: #error "files directly for the compilation of kernel modules." /usr/include/linux/version.h:5: #error "" /usr/include/linux/version.h:6: #error "glibc now uses kernel header files from a well-defined" /usr/include/linux/version.h:7: #error "working kernel version (as recommended by Linus Torvalds)" /usr/include/linux/version.h:8: #error "These files are glibc internal and may not match the" /usr/include/linux/version.h:9: #error "currently running kernel. They should only be" /usr/include/linux/version.h:10: #error "included via other system header files - user space" /usr/include/linux/version.h:11: #error "programs should not directly include <linux/*.h> or" /usr/include/linux/version.h:12: #error "<asm/*.h> as well." /usr/include/linux/version.h:13: #error "" /usr/include/linux/version.h:14: #error "To build kernel modules please do the following:" /usr/include/linux/version.h:15: #error "" /usr/include/linux/version.h:16: #error " o Have the kernel sources installed" /usr/include/linux/version.h:17: #error "" /usr/include/linux/version.h:18: #error " o Make sure that the symbolic link" /usr/include/linux/version.h:19: #error " /lib/modules/`uname -r`/build exists and points to" /usr/include/linux/version.h:20: #error " the matching kernel source directory" /usr/include/linux/version.h:21: #error "" /usr/include/linux/version.h:22: #error " o Now copy /boot/vmlinuz.version.h to" /usr/include/linux/version.h:23: #error " /lib/modules/`uname -r`/build/include/linux/version.h" /usr/include/linux/version.h:24: #error "" /usr/include/linux/version.h:25: #error " o When compiling, make sure to use the following" /usr/include/linux/version.h:26: #error " compiler option to use the correct include files:" /usr/include/linux/version.h:27: #error "" /usr/include/linux/version.h:28: #error " -I/lib/modules/`uname -r`/build/include" /usr/include/linux/version.h:29: #error "" /usr/include/linux/version.h:30: #error " instead of" /usr/include/linux/version.h:31: #error "" /usr/include/linux/version.h:32: #error " -I/usr/include/linux" /usr/include/linux/version.h:33: #error "" /usr/include/linux/version.h:34: #error " Please adjust the Makefile accordingly." /usr/include/linux/version.h:35: #error "======================================================="

4 4

RE: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING IN
by Peer Stefan 05 Jun '02

05 Jun '02

hello, > From: Dr. Peter Bast [mailto:pb@infai.de] > Hello, > > I get permanently the following messages in my /var/log/messages: > > Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= > MAC= SRC=192.168.201.55 DST=192.168.201.255 LEN=32 TOS=0x00 PREC=0x00 > TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 > Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth1 OUT= > MAC= SRC=192.168.0.2 DST=192.168.0.255 LEN=32 TOS=0x00 > PREC=0x00 TTL=64 > ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 according to /etc/services udp-port 520 serves a routing protocoll. > > I use a Server with SuSE Linux 8.0 connected to a LAN via eth0 > (192.168.201.55) and to an externel ADSL-Router via eth1 > (192.168.0.2). > The LAN-IP of the Hardware-Router is 192.168.0.1. All Netmasks are set > to 255.255.255.0. The connections between the internal > Netdevice (eth0) > and the external Netdevice (eth1) are very slow. On the > Server running > BIND9, Squid Samba and Sendmail. did you enable routing in the kernel (i guess so) and do you need it? do you use a hub where eth0 is connected to the adsl-router? if you just want to get rid of the entries you have to configure /etc/rc.config.d/firewall2-custom.rc.config and add something like fw_custom_before_antispoofing() { iptables -A INPUT -j [DROP|ACCEPT] -p udp --dport 520 true } hope that helps you a bit. regards, stefan

2 1

IP alias and SuSE firewall
by Juergen.Mell＠t-online.de 05 Jun '02

05 Jun '02

Hi List, I need to configure our firwall machine for two different static IP addresses on the same ISDN dial-up interface. The configuration is: SuSE 7.1 SuSE Firewall 4.7 Kernel 2.2.19 I did already configure the alias address for the interface and I can ping or connect to services from the local machine. But any packet coming from the internet via the dial-up line to the secondary IP address is rejected by the firewall (pakets to the primary address pass normally). I tried to configure FW_DEV_WORLD = "ippp0 ippp0:0" but that did not help either. How can I tell the firewall script to accept pakets for the secondary address? Any help is greatly appreciated! Jürgen

2 1

SuSE-FW-DROP-ANTI-SPOOFING IN
by Dr. Peter Bast 05 Jun '02

05 Jun '02

Hello, I get permanently the following messages in my /var/log/messages: Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= MAC= SRC=192.168.201.55 DST=192.168.201.255 LEN=32 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth1 OUT= MAC= SRC=192.168.0.2 DST=192.168.0.255 LEN=32 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 I use a Server with SuSE Linux 8.0 connected to a LAN via eth0 (192.168.201.55) and to an externel ADSL-Router via eth1 (192.168.0.2). The LAN-IP of the Hardware-Router is 192.168.0.1. All Netmasks are set to 255.255.255.0. The connections between the internal Netdevice (eth0) and the external Netdevice (eth1) are very slow. On the Server running BIND9, Squid Samba and Sendmail. The follgenden firewall settings are used for SuSEfirewall2: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="http https pop3 pop3s smtp telnet 53" FW_SERVICES_EXT_UDP="53" FW_SERVICES_INT_TCP="25 53 80 110 137 3128" FW_SERVICES_INT_UDP="53 137" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_SQUID="yes" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" I hope everybody can help.me..................... Thanks! Peter

1 0