June 2002 - openSUSE Security - openSUSE Mailing Lists

OpenSSH Vulnerability and Setting PrivilegeSeparation
by Simon Oliver 26 Jun '02

26 Jun '02

> - They are asking all users to upgrade to version 3.3 (sic), > and enable the PrivilegeSeparation option. I have some machines running sshd V3 (not-SuSE distro). So I downloaded 3.3p1 from openssh - there are two configure options to set privsep options during compilation, but what values should I use? --with-privsep-path= --with-privsep-user= Can these be overidden / supplied in sshd_config or must it be done at compile time. Also, are there any unforseen (by me) side effects? -- Simon Oliver

1 0

Re: [suse-security] Prob. updating EmailServer II for apache vuln?
by Oliver Bleutgen 26 Jun '02

26 Jun '02

> Is there a specific update for the Apache buffer overflow for SuSE eMail > Server II? > I attempted to update is as though it were a SuSE7.0 server (And then > later tried the 7.1 updates) and received Segmentation faults from the > httpd children each time i tried to access. > Originally installed (before update) was: > Apache 1.3.12-128 > mod_ssl-2.6.6-128 > Anyone else updated their SuSE II mail server? Clues? thanks Phew, finally someone who made the same fault as me, it seems. I'm on the standard 7.0 distribution and had also this problem. I even tried to compile from the source rpm, same result. Finally I figured that other (older) installed apache modules were creating a mess. Seems like some time in the past (April 2001) SuSE issued an update from apache 1.3.12 to apache 1.3.19 together with the new modules, which wasn't relevant for me. Irritatingly, I didn't find that older apache update on the relevant page on www.suse.com, only the modules. If you still have the old modules running (mod_contrib, mod_perl etc.), this is the cause for what you see - btw. why aren't there any rpm dependencies which would prevent such problems? Go to http://www.suse.com/us/support/download/updates/70_i386.html and scroll down to April, 28th, 2001. Install these modules together with the new apache, and it will do it. HTH, oliver

1 0

Re: [suse-security] Prob. updating EmailServer II for apache vuln?
by Torge Szczepanek 26 Jun '02

26 Jun '02

Am Mit, 2002-06-26 um 14.55 schrieb Ralph Angenendt: > Nope. It didn't work for me either. But: Chris Bailiff posted a small > Apache-DSO on bugtraq (blowchunk), which rejects all traffic requesting > chunked transfers. It's the last Attachment in > <http://online.securityfocus.com/archive/1/278281/2002-06-16/2002-06-22/2>. > > Works here - at least until a *real* fix is possible. I used this mod_blowchunks also on an IMAP Server 1.1 and on an E-Mailserver 2.0 I believe that the additional modules for the apache server are problematic. I am currently trying to compile the newest apache myself and add ldap, mod_php3 support etc. to this. But this takes time, so adding mod_blowchunks helps until my self-compiled server is running as the old SuSE one. A more generic question: Where do I get updates for the e-mail and IMAP server?!? There are no updates on ftp.suse.com for this servers...

2 1

Prob. updating EmailServer II for apache vuln?
by Nathan Fain 26 Jun '02

26 Jun '02

Is there a specific update for the Apache buffer overflow for SuSE eMail Server II? I attempted to update is as though it were a SuSE7.0 server (And then later tried the 7.1 updates) and received Segmentation faults from the httpd children each time i tried to access. Originally installed (before update) was: Apache 1.3.12-128 mod_ssl-2.6.6-128 Anyone else updated their SuSE II mail server? Clues? thanks Nathan

2 1

OpenSSH 3.3p1 / SuSE 7.3 / no login possible
by Thomas Reitelbach 26 Jun '02

26 Jun '02

Hello list, i know there are many threads about the actual OpenSSH and the upcoming problems. But i think my problem has not been discussed here before. After updating a SuSE 7.3 to OpenSSH 3.3.p1 no ssh login is possible. not as root and not as normal user. the password is always rejected. i think that it may be a problem with pam, but i'm not experienced enough to be sure. after some time of trying i deinstalled 3.3 and reinstalled 2.9p2 from suse 7.3 CDs. now login works again. theese are some messages that i got while debugging and they may be interesting: pleasure:/ # ./sshd -d debug1: sshd version OpenSSH_3.3 debug1: read PEM private key done: type RSA debug1: private host key: #0 type 1 RSA debug1: read PEM private key done: type DSA debug1: private host key: #1 type 2 DSA debug1: Bind to port 80 on ::. Server listening on :: port 80. --- no i try to connect --- debug1: Server will not fork when running in debugging mode. Connection from ::ffff:217.82.228.190 port 33275 debug1: Client protocol version 2.0; client software version OpenSSH_3.3 debug1: match: OpenSSH_3.3 pat OpenSSH* Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_3.3 debug1: list_hostkey_types: ssh-rsa,ssh-dss debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: client->server aes128-cbc hmac-md5 none debug1: kex: server->client aes128-cbc hmac-md5 none debug1: SSH2_MSG_KEX_DH_GEX_REQUEST received debug1: SSH2_MSG_KEX_DH_GEX_GROUP sent debug1: dh_gen_key: priv key bits set: 134/256 debug1: bits set: 1604/3191 debug1: expecting SSH2_MSG_KEX_DH_GEX_INIT debug1: bits set: 1608/3191 debug1: SSH2_MSG_KEX_DH_GEX_REPLY sent debug1: kex_derive_keys debug1: newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: waiting for SSH2_MSG_NEWKEYS debug1: newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: KEX done debug1: userauth-request for user root service ssh-connection method none debug1: attempt 0 failures 0 debug1: Starting up PAM with username "root" debug1: PAM setting rhost to "pd952e4be.dip.t-dialin.net" Failed none for root from ::ffff:217.82.228.190 port 33275 ssh2 Failed none for root from ::ffff:217.82.228.190 port 33275 ssh2 debug1: userauth-request for user root service ssh-connection method keyboard-interactive debug1: attempt 1 failures 1 debug1: keyboard-interactive devs debug1: auth2_challenge: user=root devs= debug1: kbdint_alloc: devices '' Failed keyboard-interactive for root from ::ffff:217.82.228.190 port 33275 ssh2 debug1: userauth-request for user root service ssh-connection method password debug1: attempt 2 failures 2 debug1: PAM Password authentication for "root" failed[7]: Authentication failure Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 debug1: userauth-request for user root service ssh-connection method password debug1: attempt 3 failures 3 Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 debug1: userauth-request for user root service ssh-connection method password debug1: attempt 4 failures 4 Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 Failed password for root from ::ffff:217.82.228.190 port 33275 ssh2 Connection closed by ::ffff:217.82.228.190 debug1: Calling cleanup 0x806ec80(0x0) debug1: Calling cleanup 0x8053dc0(0x0) debug1: Calling cleanup 0x806ec80(0x0) This is my pam config (it's the suse default) #%PAM-1.0 auth required pam_unix.so # set_secrpc auth required pam_nologin.so auth required pam_env.so account required pam_unix.so password required pam_pwcheck.so password required pam_unix.so use_first_pass use_authtok session required pam_unix.so none # trace or debug session required pam_limits.so Does anyone see whats wrong? Any ideas how to solve this or what to try? Thank you very much! Thomas

9 10

suexec not working?
by Gregory Goddard 26 Jun '02

26 Jun '02

Did anyone run into this? He is referring to the 7.1 RPMs. I updated my 7.1 system last night and didn't have this problem. -g ---------- Forwarded message ---------- Date: Tue, 25 Jun 2002 11:58:53 -0400 From: Keith Monroe <keith(a)nospam.UFL.EDU> Subject: suexec not working on Suse apache rpm All, Found a problem with the Suse fix for the apache chunk bug. When you install the new rpm suexec is not setuid and does not start. Issue the commands "chmod 4711 /usr/sbin/suexec" to make it setuid and restart your the web server. You should see that Suexec was started in the httd error log. This problem was found in Suse "apache-1.3.19-115.i386.rpm" but may reside in others. Keith

3 2

RE: [suse-security] OpenSSH and MD5 passwords
by Reckhard, Tobias 26 Jun '02

26 Jun '02

Good job, Olaf! :-) After my criticism, I feel it's OK to praise you publicly as well. Tobias

3 2

Will there be an alternative fix for the openssh-issue?
by Oliver Bleutgen 26 Jun '02

26 Jun '02

Hi, I have a question on how the future of this openssh issue will be handled. Since openssh 3.3 isn't really a fix for the announced vulnerability, there has to be another update after we know what the real issue is. For now I just firewalled port 22 on the machines to only accept connections from my machine, instead of upgrading. What is SuSE's plan? Esp. for the 7.0 and 7.1 SuSE releases. 1. build a new openssh 3.3 + real fix? 2. build a new openssh 2.9.x (or whatever versions was installed before)? 3. both of the above? The reason I ask is because 3.3 seems to be a little bit ... uhm ... problematic - even if I only read the original release notes, ignoring the messages on this list so far - and I'd like to be prepared. cheers, oliver

2 1

OpenSSH and MD5 passwords
by Olaf Kirch 26 Jun '02

26 Jun '02

I investigated this issue and found the problem... Note that this has nothing to do with the "OpenSSH and PAM is broken" issue; that is about password expiry and changing your password as you try to log on. The MD5 problem does not occur on all platforms; it only occurs on 7.3 and earlier. It is caused by a symbol messup with libcrypt bs OpenSSL's libcrypto. The pam_unix module calls crypt() to hash the supplied password; normally this will call crypt() from libcrypt.so (note missing o before dot :). This crypt implementation understands Linux password extensions, such as signaling MD5 passwords by prefixing the salt with $1$. With the new OpenSSH, link order or whatever has changed, causing it to pick up crypt() from libcrypto.so, which does not understand these extensions. As a quick workaround, edit /etc/init.d/sshd and add the following line before sshd is started: export LD_PRELOAD=/usr/lib/libcrypt.so This should cause the correct crypt function to be picked up. Sorry for this confusion. We'll make sure to add tests using md5 passwords to our test database. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann

1 0

RE: [suse-security] OpenSSH 3.3p1 / SuSE 7.3 / no login possible
by Reckhard, Tobias 26 Jun '02

26 Jun '02

> I agree about your vision of security problems, first close the gate , > second make the gate really secure. The gate isn't really closed, though, or at least the bolts aren't fastened nor the key turned. The remote compromise of a user account is almost as bad as a remote root exploit, as Steffen already said. However, we're stuck with that being the only way to mitigate the problem currently.. Which is not SuSE's fault at all. > About the MD5 problem, well..none is perfect that's a prob > that is giving > some prob to the real writters of openSSH code. > So? Shall we get upset with SuSE guys for this? It is true that the 'PAM and OpenSSH' messup is no fault of SuSE. However, it is unfortunate that their testing did not find the problem. I do think that there should be a well-defined test procedure for packages and for OpenSSH that would include at least some PAM tests. Even if not, I believe in this case that it was known for 3.3p1 to exhibit problems with PAM. And that should have been stated in the SuSE advisory, IMHO. People can and must be expected to read advisories before they modify their systems. I can understand Olaf and the rest of the SuSE team for how they acted here and I believe noone who applied the 3.3p1 update is worse off security-wise. The problems that have turned up are nonetheless bothersome. Cheers Tobias (who's been using public key authentication in OpenSSH for quite a while already)

1 0