August 2002 - openSUSE Security - openSUSE Mailing Lists

Problem post YOU
by Jim Westbrook 27 Aug '02

27 Aug '02

This past weekend I used YOU to update all four of the SuSE 7.3 machines on my network. Everything seemed to run to completion without error during the download and install phases. However, once YOU had finished, I logged root off, logged in as my regular user and launched KDE2 which was one of the packages updated by YOU. The instant the mouse pointer touched an icon on the desktop - the entire desktop crashed. The only exit at that point was Ctrl-Alt-Bkspc to kill the X server. This was true on all four systems, for all users including root. I finally gave up trying to determine just what was wrong and re-installed kde2 from the SuSE CD's, but I would really like to know what went wrong and how to avoid the hassle in the future. Plus, I'd like to ensure that future YOU updates don't cause a similar problem in other packages. JimW

3 3

mgetty
by Thomas Wheeler 27 Aug '02

27 Aug '02

Hi all I just installed mgetty and done all the necessary steps how ever the suse 8.0 box refuses to pick up the modem.. any ideas or pointers were I can look in resolving this matter?.. Regards, Thomas Wheeler -=No Trees Were Harmed By Sending This Email, Only A Few Electrons Were Seriously Discomforted =-

2 1

AW: [suse-security] mgetty
by Ulrich Roth 26 Aug '02

26 Aug '02

Hello Thomas, > I just installed mgetty and done all the necessary steps how > ever the suse > 8.0 box refuses to pick up the modem.. any ideas or pointers > were I can look in resolving this matter?.. Does your modem go off-hook when you call it by normal phone? Maybe you have to tell your modem to go off-hook when it is called. Then you have to store this in your modem's default profile. See your modem's manual which AT commands to use to achieve this aim. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Re Activating personel firewall
by Thomas Beasley 26 Aug '02

26 Aug '02

Hi all, I have personal firewall installed on my SuSE 7.2 box. It's not activated, though. How do I activate it? I'm still a newbie, so please know that in your counseling. Still in one Peace, Tom , in _ usually _ sunny, balmy Florida's First Coast. ><> <>< With enough eyes, all bugs are shallow.~Linus Torvalds ><> <>< ___________________________________________________________________________

2 1

I think i got "hacked" (german)
by Mario Ohnewald 26 Aug '02

26 Aug '02

Hi! As i came back from my holiday my sister showed me this email she got: < START > Received: from [172.20.1.104] (helo=mailgate6.cinetic.de) by mx06.web.de with esmtp (WEB.DE(Exim) 4.75 #2) id 17hHVy-0004sp-01 for grundwasser16(a)web.de; Wed, 21 Aug 2002 00:30:18 +0200 Received: from hotmail.com (f176.law11.hotmail.com [64.4.17.176]) by mailgate6.cinetic.de (8.11.2/8.11.2/WEBDE Linux 8.11.0-0.2) with ESMTP id g7KLA2w06138 for <grundwasser16(a)web.de>; Tue, 20 Aug 2002 23:10:02 +0200 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 20 Aug 2002 14:09:58 -0700 Received: from 217.233.67.236 by lw11fd.law11.hotmail.msn.com with HTTP; Tue, 20 Aug 2002 21:09:58 GMT X-Originating-IP: [217.233.67.236] From: "R K" <jetli63(a)hotmail.com> To: grundwasser16(a)web.de Subject: Hallo Sissy... !!!! Date: Tue, 20 Aug 2002 23:09:58 +0200 Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Message-ID: <F176eBj0Ny4jmF24OLO00012e5f(a)hotmail.com> X-OriginalArrivalTime: 20 Aug 2002 21:09:58.0686 (UTC) FILETIME=[F0C583E0:01C2488D] Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mailgate6.cinetic.de id g7KLA2w06138 Na, wie geht´s dem Freund??? Na ja, egal, mit 17 ist ja noch alles offen, und vielleicht findet sich beim chatten ja was richtiges. Oder ist bei Euch in Lorch nix los?? Kann ja mal anrufen bei Dir: 071xx/9155xx Was machst Du so, wenn du mal nicht im Internet surfst und deine Spuren hinterlässt??? Wie sieht´s mit der Mittleren Reife aus? Alles gut überstanden?? Na ja, wer immer "Wer wird Millionär" schaut, kann ja gar nicht schlecht sein... grins... Du solltest Dich mal ERNSTHAFT mit Mario unterhalten, schliesslich sollte er ja "vom Fach" sein... Vielleicht weiss er ja, WOHER ICH ALL DEINE DATEN HABE, OBWOHL ICH HUNDERTE KM ENTFERNT BIN!!!!!! THINK SAFE!!! KEEP YOUR PC SAFE!!!! Greetzzzz vom HACKerKinG PS ich habe weder mit dir jemals gechatted noch kenne ich dich in irgendeiner form ... UND TROZDEM IST NICHTS FIKTIV! Bedenke BIG BROTHER IS WATCHING YOU!! Ask for more!!!!! ... and youll get the answer _________________________________________________________________ Mit MSN Fotos können Sie kinderleicht Ihre Fotos ausdrucken und Freunden zur Verfügung stellen: http://photos.msn.de </jump.htm?goto=http://photos.msn.de> < STOP > I am running 2 PCs, SuSE7.3 (PDC, Web, Mail, edonkey, ircd. Not updated for 23days) and SuSE7.2 (SuSEfirewall2. not updated for 13days). I could not find anything interesing in my logfiles. Seems like he never touched my server, but if he really got in i would not find the tracks anyway, her will have removed them. But i doubt that he is a professional. His name does look like a script kiddy, his mailaddress at hotmail is a sign for a scriptkiddy, too. Not logs from a network scanner, nothing. I hope that he just got in contact with the w2k client, not with my servers. The w2k SP2 workstation where my sister works on was not infected by a trojan (Scanned by norton anti virus 2002). What do i do next, how can i dected my security hole? I want to find the hole, before i install my Servers again. Any tip, hint, would be great! Thanks! Mario Ohnewald p.s. I hope i have told you everything you have to know.

3 2

Why MY DNS is not working" FTP never works]
by sambit 26 Aug '02

26 Aug '02

Hi , I am trying to configure my server as DNS i am never able to figure it out what is the error my files looks like the attahcment i have enclosed but it when i do nslookup on my local system and try to resolve my hostname it never work. i did not find any bind program like 'ndc' supported by other unix OS. like nslookup *** Can't find server name for address 64.252.31.94 : No response from server set type=SOA > sambitnanda.com Server: ns2.snet.net Address: 204.60.0.3 *** ns2.snet.net can't find sambitnanda.com: Non-existent host/domain which should work from my local system Question 2 what is the way i can open my ftp , i changed my inetd.conf to like ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -a # ftp stream tcp nowait root /usr/sbin/tcpd proftpd # ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd but it never works. thanks Sambit $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400) ; Minimum TTL NS sambitnanda.com. 1 PTR localhost. $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400) ; Minimum TTL NS sambitnanda.com. 4 PTR sambitnanda.com. ; ; There might be opening comments here if you already have this file. ; If not don't worry. ; . 6D IN NS G.ROOT-SERVERS.NET. . 6D IN NS J.ROOT-SERVERS.NET. . 6D IN NS K.ROOT-SERVERS.NET. . 6D IN NS L.ROOT-SERVERS.NET. . 6D IN NS M.ROOT-SERVERS.NET. . 6D IN NS A.ROOT-SERVERS.NET. . 6D IN NS H.ROOT-SERVERS.NET. . 6D IN NS B.ROOT-SERVERS.NET. . 6D IN NS C.ROOT-SERVERS.NET. . 6D IN NS D.ROOT-SERVERS.NET. . 6D IN NS E.ROOT-SERVERS.NET. . 6D IN NS I.ROOT-SERVERS.NET. . 6D IN NS F.ROOT-SERVERS.NET. G.ROOT-SERVERS.NET. 5w6d16h IN A 192.112.36.4 J.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.10 K.ROOT-SERVERS.NET. 5w6d16h IN A 193.0.14.129 L.ROOT-SERVERS.NET. 5w6d16h IN A 198.32.64.12 M.ROOT-SERVERS.NET. 5w6d16h IN A 202.12.27.33 A.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.4 H.ROOT-SERVERS.NET. 5w6d16h IN A 128.63.2.53 B.ROOT-SERVERS.NET. 5w6d16h IN A 128.9.0.107 C.ROOT-SERVERS.NET. 5w6d16h IN A 192.33.4.12 D.ROOT-SERVERS.NET. 5w6d16h IN A 128.8.10.90 E.ROOT-SERVERS.NET. 5w6d16h IN A 192.203.230.10 I.ROOT-SERVERS.NET. 5w6d16h IN A 192.36.148.17 F.ROOT-SERVERS.NET. 5w6d16h IN A 192.5.5.241 $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400 ; Minimum TTL ) @ IN NS sambitnanda.com. IN A 64.252.31.94 IN MX 10 sambitnanda.com. TXT "Sambit Nanda Org " localhost A 127.0.0.1 sambitnanda.com. A 64.252.31.94 ns A 64.252.31.94 www A 64.252.31.94 mail CNAME sambitnanda.com. ftp CNAME sambitnanda.com. options { directory "/var/named"; datasize 20M; listen-on { 64.252.31.94 } // Uncommenting this might help if you have to go through a // firewall and things are not working out: // query-source port 53; }; zone "." { type hint; file "root.hints"; }; zone "0.0.127.in-addr.arpa" { type master; file "127.0.0"; }; zone "31.252.64.in-addr.arpa" { type master; file "64.252.31"; }; # zone "50.10.10.in-addr.arpa" { # type master; # file "64.252.31"; # }; zone "sambitnanda.com" { type master; notify no; file "sambitnanda.com"; }; search sambitnand.com 64.252.31.94 204.60.0.3 203.60.0.2 nameserver 64.252.31.94 nameserver 204.60.0.3 nameserver 204.60.0.2

1 0

freeswan and init.d
by Glenn Remstedt 26 Aug '02

26 Aug '02

hi list I'm new here, but how do you config so that "ipsec" is running also after reboot ? Thanks in advance ! // glenn

2 1

RE: [suse-security] I think i got "hacked" (german)
by Mario Ohnewald 26 Aug '02

26 Aug '02

Hi, > > from your description I get that one of your Linux boxes is a > router. yes > I dont think that a possible attacker got into the W2k Box of > your sister. > And a professional would not spend much time into "hacking" > your sisters box. > In my opinion, its whether someone who knows your sister and wants to > joke on her, or he probably guessed the password of her > Webmail account. True, all i could think of was that it must be a chatting buddy who was able to guess her account password, which is/was really stupid!! > > Best regards, > > Daniel Schulz > Thank you guys! I have/had to face the worst case ;)

1 0

RE: [suse-security] I think i got "hacked" (german)
by Daniel Schulz 26 Aug '02

26 Aug '02

-----Ursprüngliche Nachricht----- Von: Daniel Schulz [i-smo] [mailto:daniel@i-smo.de] Gesendet: Montag, 26. August 2002 11:02 An: 'Mario Ohnewald'; 'suse-security(a)suse.com' Betreff: AW: [suse-security] I think i got "hacked" (german) Hi, from your description I get that one of your Linux boxes is a router. I dont think that a possible attacker got into the W2k Box of your sister. And a professional would not spend much time into "hacking" your sisters box. In my opinion, its whether someone who knows your sister and wants to joke on her, or he probably guessed the password of her Webmail account. Best regards, Daniel Schulz -----Ursprüngliche Nachricht----- Von: Mario Ohnewald [mailto:mario.ohnewald@gmx.de] Gesendet: Montag, 26. August 2002 10:46 An: suse-security(a)suse.com Betreff: [suse-security] I think i got "hacked" (german) Hi! As i came back from my holiday my sister showed me this email she got: < START > Received: from [172.20.1.104] (helo=mailgate6.cinetic.de) by mx06.web.de with esmtp (WEB.DE(Exim) 4.75 #2) id 17hHVy-0004sp-01 for grundwasser16(a)web.de; Wed, 21 Aug 2002 00:30:18 +0200 Received: from hotmail.com (f176.law11.hotmail.com [64.4.17.176]) by mailgate6.cinetic.de (8.11.2/8.11.2/WEBDE Linux 8.11.0-0.2) with ESMTP id g7KLA2w06138 for <grundwasser16(a)web.de>; Tue, 20 Aug 2002 23:10:02 +0200 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Tue, 20 Aug 2002 14:09:58 -0700 Received: from 217.233.67.236 by lw11fd.law11.hotmail.msn.com with HTTP; Tue, 20 Aug 2002 21:09:58 GMT X-Originating-IP: [217.233.67.236] From: "R K" <jetli63(a)hotmail.com> To: grundwasser16(a)web.de Subject: Hallo Sissy... !!!! Date: Tue, 20 Aug 2002 23:09:58 +0200 Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1; format=flowed Message-ID: <F176eBj0Ny4jmF24OLO00012e5f(a)hotmail.com> X-OriginalArrivalTime: 20 Aug 2002 21:09:58.0686 (UTC) FILETIME=[F0C583E0:01C2488D] Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by mailgate6.cinetic.de id g7KLA2w06138 Na, wie geht´s dem Freund??? Na ja, egal, mit 17 ist ja noch alles offen, und vielleicht findet sich beim chatten ja was richtiges. Oder ist bei Euch in Lorch nix los?? Kann ja mal anrufen bei Dir: 071xx/9155xx Was machst Du so, wenn du mal nicht im Internet surfst und deine Spuren hinterlässt??? Wie sieht´s mit der Mittleren Reife aus? Alles gut überstanden?? Na ja, wer immer "Wer wird Millionär" schaut, kann ja gar nicht schlecht sein... grins... Du solltest Dich mal ERNSTHAFT mit Mario unterhalten, schliesslich sollte er ja "vom Fach" sein... Vielleicht weiss er ja, WOHER ICH ALL DEINE DATEN HABE, OBWOHL ICH HUNDERTE KM ENTFERNT BIN!!!!!! THINK SAFE!!! KEEP YOUR PC SAFE!!!! Greetzzzz vom HACKerKinG PS ich habe weder mit dir jemals gechatted noch kenne ich dich in irgendeiner form ... UND TROZDEM IST NICHTS FIKTIV! Bedenke BIG BROTHER IS WATCHING YOU!! Ask for more!!!!! ... and youll get the answer _________________________________________________________________ Mit MSN Fotos können Sie kinderleicht Ihre Fotos ausdrucken und Freunden zur Verfügung stellen: http://photos.msn.de </jump.htm?goto=http://photos.msn.de> < STOP > I am running 2 PCs, SuSE7.3 (PDC, Web, Mail, edonkey, ircd. Not updated for 23days) and SuSE7.2 (SuSEfirewall2. not updated for 13days). I could not find anything interesing in my logfiles. Seems like he never touched my server, but if he really got in i would not find the tracks anyway, her will have removed them. But i doubt that he is a professional. His name does look like a script kiddy, his mailaddress at hotmail is a sign for a scriptkiddy, too. Not logs from a network scanner, nothing. I hope that he just got in contact with the w2k client, not with my servers. The w2k SP2 workstation where my sister works on was not infected by a trojan (Scanned by norton anti virus 2002). What do i do next, how can i dected my security hole? I want to find the hole, before i install my Servers again. Any tip, hint, would be great! Thanks! Mario Ohnewald p.s. I hope i have told you everything you have to know. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

shrinkwrap 8.0 revision levels
by m3047＠inwa.net 25 Aug '02

25 Aug '02

On the premise that the chief reason for buying CDs (other than being nice, of course) is to be able to do a "slap it in and have it all" installation; and given that there are now a number of downloadable security patches for 8.0; and given that SuSE seems to have pretty good revision control: Are the CD box sets labeled in such a way as to indicate what date the software therein is patched up to, and if so what is the current date/cut number that one would expect to see if purchasing from SuSE's web site, as well as in the retail channel? Couldn't find this information on the web site. I am in the USA. -- Fred Morris m3047(a)inwa.net

3 2