July 2002 - openSUSE Security - openSUSE Mailing Lists

OpenSSH-Update: port 22 ... Address already in use.
by Andreas Schamanek 04 Jul '02

04 Jul '02

Hi there, I've updated OpenSSH as recommended on several hosts, some SuSE 7.2, some 7.3. On most of them I got the following entries in /var/log/ messages after _rcsshd stop ; rcsshd start_ (which, BTW, worked fine): Jul 4 10:24:00 host sshd[205]: Received signal 15; terminating. Jul 4 10:24:04 host sshd[21127]: Server listening on :: port 22. Jul 4 10:24:04 host sshd[21127]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use. Is this 'Address in use' because of still running children of the old and terminated sshd parent? Or does this indicate that there is another process running which I do not know of? TIA, -- -- Andreas

7 9

HELO with too long argument crashes sendmail
by Konrad Klein 04 Jul '02

04 Jul '02

Hi everybody, I have the following problem. I installed a box with SuSE 7.2, updated all packages und then checked the security of the server with Nessus. The result of the scan is, that Nessus could crash sendmail, because of a HELO command with a long argument. Is there a way to prevent this, or is this a problem of the installed SuSE rpm sendmail-8.11.3-68.rpm ? Thanks for your help Have a nice evening Konrad

3 3

Add user
by Ricardo Javier Aranibar León 04 Jul '02

04 Jul '02

Hi list, I don't know what happend with this. I created a new user in my box with this command as root #useradd armando #passwd armando but when I try to connect with armando I have this message... su: warning: cannot change directory to /home/armando:No such file or directory and when I execute ls /home I don't see the directory armando If somebody can help me I will thankfull _________________________________________________________________ Únase al mayor servicio mundial de correo electrónico: http://www.hotmail.com/es

7 6

Fw: [suse-security] Add user
by Victor Reyes 04 Jul '02

04 Jul '02

Try 1. man useradd or 2. useradd --help and 3. check this parameters -s "shells" -g "groups" -G "many groups" -h "directory" -p "user password" or use YAST2 (you can use on Konsole) Bye.... Victor Reyes ----- Original Message ----- From: "Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> To: <suse-security(a)suse.com> Cc: <security-discuss(a)linuxsecurity.com> Sent: Thursday, July 04, 2002 11:46 AM Subject: [suse-security] Add user > > > Hi list, > > I don't know what happend with this. > I created a new user in my box with this command as root > #useradd armando > #passwd armando > > but when I try to connect with armando I have this message... > su: warning: cannot change directory to /home/armando:No such file or > directory > > and when I execute ls /home I don't see the directory armando > > If somebody can help me I will thankfull > > > _________________________________________________________________ > Únase al mayor servicio mundial de correo electrónico: > http://www.hotmail.com/es > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Help needed: no remote login
by Wilfried Philippi 04 Jul '02

04 Jul '02

Hello, i have a problem with SuSe 8.0 and sshd or telnet. On the Serverconsole a login as root or user is possible and i can login but over the Network it doesn't work and I get the Message: Access denied. This is when i work with Telnet and also when i work with ssh. What is wrong? I use Putty as Client on the Windows site. Is there a Variable who denies remote login? Thanks for your Help. Wilfried

3 2

RE: [suse-security] Help needed: no remote login
by Peer Stefan 04 Jul '02

04 Jul '02

hi > From: Wilfried Philippi [mailto:philippi@madex.com] > Hello, > i have a problem with SuSe 8.0 and sshd or telnet. On the > Serverconsole a login as root or user is possible and i > can login but over the Network it doesn't work and I get > the Message: Access denied. This is when i work with Telnet you shouldn't use telnet anyways ... > and also when i work with ssh. What is wrong? I use Putty as > Client on the Windows site. Is there a Variable who denies > remote login? in /etc/ssh/sshd_config there's a directive called 'PermitRootLogin'. set it to yes and restart your sshd. if you cannot connect to your system via ssh as non-privileged user, have a look at /etc/hosts.allow and /etc/hosts.deny, check your firewall-rules, try to ssh localhost ... another thing is: have a look at /var/log/messages, which is your syslog-file. it should give you a hint where you should look for enabling ssh. if you have PermitRootLogin set to no you should find something like "Jul 4 17:22:06 hostname sshd[6524]: ROOT LOGIN REFUSED FROM ::ffff:xxx.xxx.xxx.xxx" in there. > Thanks for your Help. > Wilfried regards, stefan

1 0

Re: [suse-security] Re: SSL logs 'ok', but no open port 443
by Ulrich Klaus (listaccount) 04 Jul '02

04 Jul '02

Hello Roman, > See the Listen and Bind directives in the config files. If you > want it to listen on port 443, you have to tell it so at least. that was it. Shame on me. Thanks a lot!! Uli

1 0

Re: SSL logs 'ok', but no open port 443
by Ulrich Klaus (listaccount) 04 Jul '02

04 Jul '02

Hello Peter, thanks for your reply. > I suppose that you need to set the SSLEngine directive to On. The > default was Off in SuSE Linux 7.0. This directive is already set to 'on'. I think, otherwise the SSL-engine would not tell to have taken up the virtual host correctly (?). What else could I try? Greetings Uli

2 1

RE: [suse-security] Bind9 & resolver libs
by Reckhard, Tobias 04 Jul '02

04 Jul '02

> if set in resolv.conf to 127.0.0.1 and in named.conf > recursion no; it should be fine ? > afaik the problem is that querries on > bind8 is > answered from the resolver libs and bind9 only answers > from cache ? Disclaimer: I've got all of the following from the DNS mailing list, none of it is my own (except the wording). However, the sources are pretty much experts at DNS (and coding). The problem lies in the resolver libs. That's where it should be fixed. The current BIND resolver lib vulnerability is triggered by perfectly fine DNS datagrams. If an intermediate party between the attacker's DNS server and the target, such as a DNS proxy, reconstructs answers instead of just piping them through unmodified, then the attacker just needs to analyse that party's behaviour and modify his attack payload accordingly. This sounds a little complicated, I'll try to clarify. The attacker knows that payload A will root the target. If the target contacts his DNS server directly, he simply sends it A and is done. If the target accesses the DNS server through a 'constructing' DNS proxy, the attacker needs to find out how the proxy constructs packets, pick a payload B that will root the target (this may be A, but must be different, if the proxy will never construct A) and reverse the construction process to get B'. So the use of a DNS proxy doesn't really solve the problem. Updating the buggy libraries does. Cheers Tobias

2 1

RE: [suse-security] IPsec (FreeS/WAN) and SuSEfirewall2
by Andreas Marbet 04 Jul '02

04 Jul '02

Hi Stefan, > From: Stefan Nilsen [mailto:stefan.nilsen@millnet.se] > Sent: Wednesday, July 03, 2002 3:00 PM > > My goals is the following: > > #1. Allow the users on the subnets to reach each other > > #2. The GW computers should be able to reach the opposite subnet > > #3. The GW computers should be able to talk to each other. > (Does not *have* to > be IPsec, SSH is enough). > > I have managed to fullfill #1 together with #3, but not > without troubles. I > had to make minor changes in /etc/init.d/SuSEfirewall2_setup, > adding ipsec to > the row containing Required-Start: I have a similar setup, but I never had to tweak the starting script of SuSEfirewall. In my case, ipsec starts after phase 2 of SuSEfirewall. Btw: do you use FreeS/WAN in the version included with SuSE 8 (1.95) or did you compile it yourself? > Then I went into yast2, runlevel editor and made a reset of > the runlevels. I > am sure this could also be done from the cmdline... Here again I didn't do any changes except enabling the needed services. > The reason I did this was because ipsec has to be loaded > before the firewall, > otherwise it would not load the rules correctly for the > ipsec0 interface. Do you talk about additional rules or just the built-in ones of SuSEfirewall2? > The following tunnel was set up in /etc/ipsec.conf on both > GW's to get this > tunnel to work: > ---------------- > conn xpfwlsn-xpfwnsn > # Subnet to subnet > # Left security gateway, subnet behind it, next hop > left=193.193.193.200 > leftsubnet=192.168.1.0/24 > leftnexthop=193.193.193.193 > # Right security gateway, subnet behind it, next hop > right=194.194.194.200 > rightsubnet=192.168.3.0/24 > rightnexthop=194.194.194.194 > # To authorize this connection, but not actually > # uncomment this. > #auto=add > auto=start > ----------------- Try the following: On leftgateway's ipsec.conf change the rightnexthopvalue to the internal IP of rightgateway and vice versa. It's now a few months since I tried it myself, but then I had to set it up that way. Don't know exactly why, but its worth a try. With my setup, I can fulfill all your requirements. 'internal' connections from gw to gw are of course not working by design. > To manage to fulfill #2 i also added the following tunnels in > ipsec.conf: > ----------------- > conn xpfwlsn-xpfwn > # Subnet to gateway > > conn xpfwl-xpfwnsn > # Gateway to subnet Is it really neccesary to add these connections as well? I think FreeS/WAN will be confused because it doesn't know how to differ the incoming connection requests. Could you perhaps post the log-entries when starting FreeS/WAN? > ... but it does not work. I suspect SuSEfirewall2 to be the > reason (or more > correctly, my configuration of the firewall). > > My /etc/sysconfig/SuSEfirewall2 config (only diff's from > /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf): > ----------------- > FW_DEV_EXT="eth0 ipsec0" > FW_DEV_INT="eth1" > FW_ROUTE="yes" > FW_MASQUERADE="yes" > FW_MASQ_DEV="eth0" > FW_MASQ_NETS="0/0" > FW_PROTECT_FROM_INTERNAL="no" > FW_AUTOPROTECT_SERVICES="no" > FW_SERVICES_EXT_TCP="ssh" > FW_SERVICES_EXT_UDP="500" > FW_SERVICES_EXT_IP="50" Don't know if IP-Protocol 51 is needed as well? > FW_FORWARD="192.168.1.0/24,192.168.3.0/24 > 192.168.3.0/24,192.168.1.0/24" > FW_KERNEL_SECURITY="no" > FW_STOP_KEEP_ROUTING_STATE="yes" > ----------------- > > If I ping a computer on subnet 192.168.1.0/24 from the > opposite network GW i > get this in /var/log/messages on the recieving GW: > > Jul 3 14:31:42 xpfwl kernel: SuSE-FW-DROP-DEFAULT IN=ipsec0 OUT=eth1 > SRC=194.194.194.200 DST=192.168.1.10 LEN=84 TOS=0x00 Why does it arrive on ipsec0, should be eth0. Taking the wrong tunnel? Hope this helps a bit. Andreas

5 6