June 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security-announce] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Martin Wilck 26 Jun '02

26 Jun '02

Am Die, 2002-06-25 um 18.10 schrieb Olaf Kirch: > - if you do not need external access to your SSH daemons, > turn off the SSH service on these machine completely, or block > external access at the firewall. > > - if you do need external access to your SSH daemons, > make sure you restrict the hosts that it will talk to by setting > appropriate firewall rules. > > If, for some reason, you cannot configure your firewall to > block external SSH access, you can also restrict access through > /etc/hosts.allow; Hmm - I need to administer a remote machine hosted at a server farm. By no means can I afford to lock myself out of that system by upgrading ssh, as several people have reported on this list. Nor can I use host-based access control reasonably, because I login from a large dialin provider with changing IP address & hostname. I am very certain I am not alone with this problem. Do you have any advice how to proceed ? Being able to install the new version in parallel to the old one and only disable the old one when the new one proves to work would be a nice option. Martin

5 5

OT: Benchmarking
by BLeonhardt＠analytek.de 26 Jun '02

26 Jun '02

Hi, does anybody know a good site to get benchmark's for linux-servers ? not only one specific sw .. i.e. samba, sendmail, postfix, ... benchmarks ? for a different quantity of users ... Thank's ! And sorry for this OT ! Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de

1 0

Re: [suse-security] Re: [suse-security-announce] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Martin Wilck 26 Jun '02

26 Jun '02

Am Die, 2002-06-25 um 22.54 schrieb Michael Weinert: > Solution: > Get yourself a static name for your dynamic IP. Is that available from all providers? Martin

5 6

RE: [suse-security] OpenSSH 3.3p1 / SuSE 7.3 / no login possible
by Patrick Hofmann 26 Jun '02

26 Jun '02

Hi all, we fixed the problem temporarily with: - removing the "md5" in /etc/pam.d/passwd (was obviously placed there by harden_suse...) - reset the password for the admin-user who needs ssh (passwd user) With no local users on the system, it seems for us to be a less impact to the overall-security to use crypt-pw than to stay with OpenSSH 2.9 and all the rumours about the somewhat unknown 'remote root exploit'... Greetings, Patrick At 03:25 26.06.2002 +0200, M. Neubert wrote: >Hello list, > >i have the same problem but no answer. >My config: SuSE 7.3 / OpenSSH 3.3p1 / MD5-pass > >Only Protocol-2 with RSA-Auth is working. >What is the problem? MD5 or PAM? > >Please Help.... > >Mario

1 0

OpenSSH: missing sshd user explained + fix
by Olaf Kirch 26 Jun '02

26 Jun '02

Hi Henk, I'm cc'ing this to suse-security because I'm getting a bunch of mails on this issue. On Wed, Jun 26, 2002 at 09:01:00AM +0200, Henk Vosmeijer wrote: > As you wrote below I have upgraded openssh with the YAST2 tool. > But when starting sshd again I get: > Starting SSH deamonPrivilege separation user sshd does not exist > startproc: exit status of parent of /usr/sbin/sshd: 255 The most likely reason you're seeing this message is that you did not stop the nscd daemon prior to upgrading. The reason you need to do this is this: In the post-install script inside the RPM, a new group and user are created, both named sshd. This happens by calling groupadd sshd useradd -g sshd sshd (You can see the full script if you do rpm -q --script openssh). However, 15 minutes before releasing the RPMs someone alerted me that there's a bug in the groupadd tool; after adding a new group to /etc/group, it should tell nscd to throw away all cached group information, but it doesn't. So when useradd gets called, it tries to look up the group sshd (specified by the -g switch), and fails because nscd still has the old information. Note that this bug does not happen all the time; it hapends randomly, which is why it wasn't detected by our testing. This is why the Advisory recommends turning off nscd. Finally :) here's what you should do to fix your openssh install. Execute the following commands as root, and restart your sshd. install -m 755 -o root -g root -d /var/empty install -m 755 -o root -g root -d /var/lib/sshd groupadd -g 65 sshd useradd -u 71 -g sshd -s /bin/false -d /var/lib/sshd sshd This is the relevant part of the postinstall script that sets up the privilege separation user, and the chroot jail directory /var/empty. Cheers, Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann

1 0

OpenSSH PrivilegeSeparation
by Olaf Kirch 26 Jun '02

26 Jun '02

I'm ccing this to suse-security(a)suse.com because I'm getting a number of questions on this issue. On Wed, Jun 26, 2002 at 12:02:12AM +0200, Martin Wilck wrote: > After starting the new sshd with UsePrivilegeSeparation=yes, > the new sshd processes seem to still run as root and /proc/XYZ/root > is still "/". Is that normal? Privilege separation is only active before you've logged in. You can easily verify whether it is enabled by doing this: 1. connect to your server, login as root. 2. on a second console, connect to your server, without publickey authentication. The password prompt should appear. 3. Go back to the first session, and check the sshd processes: zappa:~ # ps lax|grep sshd [...] 002 0 22132 20042 10 0 [...] 0:00 /usr/sbin/sshd 006 71 22133 22132 11 0 [...] 0:00 /usr/sbin/sshd Note that the second one has uid 71. Now look at the process status: zappa:~ # cat /proc/22133/status Name: sshd State: S (sleeping) [...] Uid: 71 71 71 71 Gid: 65 65 65 65 FDSize: 32 Groups: 65 [...] zappa:~ # ll /proc/22133/root lrwxrwxrwx 1 root root [...] /proc/22133/root -> /var/empty As you see, the process is chrooted to /var/empty and running with uid 71/gid 65. After you log in, this intermediate process will go away. Also note that PrivilegeSeparation is in effect even when commented out in sshd_config; this option is on by default now. Cheers, Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann

1 0

RE: [suse-security] OpenSSH Update [Redhat too]
by Ryan Swenson 26 Jun '02

26 Jun '02

Hello, Not to sound biased; we have plenty of SuSE and Redhat. Is Redhat also affected by this or is there any other documentation to account for this SSH issue other than the account from SuSE; in particuliar any advisories? Redhat SA told me they use the Redhat OpenSSH 3.1 patched version which is not vulnerable to this and does not have priv seperation or chroot support. Ryan S. -

5 4

Re: [suse-security-announce] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by defunct＠urbanyellow.com 26 Jun '02

26 Jun '02

>>> Solution: >>> Get yourself a static name for your dynamic IP. >> >> >> Is that available from all providers? >> Martin > > www.dyndns.org > Ah, but unless I'm mistaken, tcp wrappers does a reverse lookup of the requesting ip before a lookup of the dynamic dns hostname. I.E. you have foo.dyndns.org, which points to 1.2.3.4. You have sshd: foo.dyndns.org : ALLOW in /etc/hosts.allow On login, sshd looks up 1.2.3.4, finds xxx123.foo.your-isp.dialup.com. Denies access. You will see: "sshd[18529]: refused connect from xxx123.foo.your-isp.dialup.com (1.2.3.4)" in your logs. It never looks up the ip for your dyndns hostname. Anyone have more/better info? I have tested this and found the sequence of events to be as I described. Thanks! -gabriel

1 0

OpenSSH update and Putty
by Torsten Mueller 25 Jun '02

25 Jun '02

Hey, only a small note. If you connected to your linux machine with Putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/) i had to change in my Putty configuration to SSH Protocol Version 2 and Blowfish else i got incorrect CRC while trying to connect. ... only my 2 euro-cents Greetings Torsten

1 0

OpenSSH Update
by Heiko Ordelt 25 Jun '02

25 Jun '02

Hi List! I tried to install the newest OpenSSH package (ID: SuSE-SA:2002:023). The installation script aborted due to duplicate group id. The group haclient from package heartbeat has the same id (65). To handle this problem i changed the group id of haclient to 66. After this change the installation completed successfully. cu! Heiko Ordelt

1 0