August 2002 - openSUSE Security - openSUSE Mailing Lists

Re: Re: [suse-security] Still probs with DansGuardian and Squid2.4-Stable7 (HELP NEEDED!)
by BLeonhardt＠analytek.de 14 Aug '02

14 Aug '02

Hi, now it's working : set the poxyip = ( nic1 - ip ) ( not 127.0.0.1 ) and set iptables rules to allow connections to port 3128 only from localhost and nic1-ip-adr. ... ... don't know why cannot connect via 127.0.0.1 , but so it's working and can't load pages with setting 3128 as proxy-port ... only over 8080 ( DansGuardian ) So, hope it's working quite correctly now ... ... thank's all and have a nice evening ! -bye- bruno

2 1

Dumme Frage
by Jochen.Rothstein＠its-intl.com 14 Aug '02

14 Aug '02

Hallo, kann ich, wenn ich zwei Subnets, z.B. - 192.168.0.0/24 | Internet VPN mit Frees WAN | - 172.26.0.0./24 über Frees/Wan mit shared keys verbinde, auf Windows 98 Clients in der jeweiligen Netzwerk- umgebung ohne weiteres die Ressourcen der Maschinen im anderen Subnet sehen, bzw. mit den Dateien arbeiten und sie drucken? Oder brauche ich bei dieser Site-to-site Struktur auch eine spezielle Software auf den Windows 98 Maschinen wie z.B. SSH Sentinel? Im voraus vielen Dank für die Antwort. Grüsse, Jochen Rothstein ----- Information Technology Solutions Tel: +34-91-806.21.60 Avda. Viñuelas, 4 Fax: +34-91-804.48.13 email: Jochen.Rothstein(a)its-intl.com 28760 Tres Cantos. Madrid. Spain http://www.its-intl.com

2 1

Still probs with DansGuardian and Squid2.4-Stable7 (HELP NEEDED!)
by BLeonhardt＠analytek.de 14 Aug '02

14 Aug '02

HI, please help with following problem : Versions : DansGuardian 2.4.5-2 Squid Cache: Version 2.4.STABLE7 SquidGuard: 1.1.4 Sleepycat Software: Berkeley DB 2.7.7: (08/20/99) Here a part ot the log from Squid : 1029306401.296 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306403.147 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306408.216 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029306413.925 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308327.375 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308335.963 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308527.158 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308531.888 20 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - Problem : After prevent connections directly to port 3128 for all other ip's (with iptables) and configured DansGuardian to use 127.0.0.1 - I will get following message from Squid : ERROR The requested URL could not be retrieved While trying to retrieve the URL: http://www.linux-it.net/index.php The following error was encountered: Forwarding Denied. This cache will not forward your request because it is trying to enforce a sibling relationship. Perhaps the client at 127.0.0.1 is a cache which has been misconfigured. Your cache administrator is bleonhardt(a)analytek.de. Generated Wed, 14 Aug 2002 06:26:53 GMT by www-cache.analytek.de (Squid/2.4.STABLE7) Have added the configuration-files-entries from squid , squidguard and dansguardian , maybe anybody will see a "mssconfiguration" ... Following Squid-Configuration : --------------------------------------------- http_port 3128 tcp_outgoing_address 192.168.x.x udp_incoming_address 0.0.0.0 udp_outgoing_address 0.0.0.0 cache_peer 127.0.0.1 sibling 8080 7 cache_peer 192.168.1.8 parent 3128 7 cache_mem 32 MB cache_swap_low 10 cache_swap_high 100 maximum_object_size 1024 KB minimum_object_size 0 KB ipcache_size 4096 ipcache_low 90 ipcache_high 95 fqdncache_size 1024 cache_dir ufs /var/squid/cache 100 16 256 cache_access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log /var/squid/logs/store.log pid_filename /var/run/squid.pid debug_options ALL,1 client_netmask 255.255.255.255 # SQUID-GUARD redirect_program /usr/bin/squidGuard redirect_children 5 authenticate_program /usr/sbin/pam_auth /etc/passwd authenticate_children 5 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 reference_age 1 week peer_connect_timeout 120 seconds client_lifetime 1 day half_closed_clients on pconn_timeout 360 seconds acl password proxy_auth REQUIRED acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 21 22 443 563 70 210 1025-65535 acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost all # I will replace "all" if everything is running :-) http_access allow password http_access deny CONNECT !SSL_ports http_access deny manager http_access deny test http_access deny all icp_access allow localhost all miss_access allow localhost manager all proxy_auth_realm Auth-Realm cache_mgr bleonhardt(a)analytek.de cache_effective_user squid cache_effective_group nogroup visible_hostname www-cache.analytek.de announce_period 0 day append_domain .analytek.de forwarded_for on log_icp_queries on icp_hit_stale on client_db on never_direct allow all ident_lookup_access allow all log_fqdn on Following SquidGuard - Rules : -------------------------------------------- logdir /var/squidGuard/logs dbhome /var/squidGuard/db src kids { ip 192.168.x.x/24 } src local { ip 127.0.0.1/24 } dest blacklist { domainlist blacklist/domains urllist blacklist/urls } kids { pass !blacklist all } local { pass !blacklist all } default { pass none redirect http://192.168.1.13/cgi/blocked?clientaddr=%a&clientname=%n&clientuser=%i&c… } } Following DansGuardian - Config : ------------------------------------------------- reportinglevel = 3 htmltemplate = '/etc/dansguardian/template.html' loglevel = 3 logexceptionhits = on logfileformat = 1 filterip = 192.168.x.x filterport = 8080 proxyip = 127.0.0.1 proxyport = 3128 accessdeniedaddress = 'http://host-ip/cgi-bin/dansguardian.pl' bannedphraselist = '/etc/dansguardian/bannedphraselist' exceptionphraselist = '/etc/dansguardian/exceptionphraselist' weightedphraselist = '/etc/dansguardian/weightedphraselist' bannedsitelist = '/etc/dansguardian/bannedsitelist' exceptionsitelist = '/etc/dansguardian/exceptionsitelist' exceptionurllist = '/etc/dansguardian/exceptionurllist' bannedurllist = '/etc/dansguardian/bannedurllist' bannedregexpurllist = '/etc/dansguardian/bannedregexpurllist' bannedextensionlist = '/etc/dansguardian/bannedextensionlist' bannedmimetypelist = '/etc/dansguardian/bannedmimetypelist' bannediplist = '/etc/dansguardian/bannediplist' exceptioniplist = '/etc/dansguardian/exceptioniplist' banneduserlist = '/etc/dansguardian/banneduserlist' exceptionuserlist = '/etc/dansguardian/exceptionuserlist' picsfile = '/etc/dansguardian/pics' weightedphrasemode = 2 naughtynesslimit = 160 showweightedfound = on reverseaddresslookups = on createlistcachefiles = on maxuploadsize = -1 usernameidmethodproxyauth = off usernameidmethodntlm = off # **NOT IMPLEMENTED** usernameidmethodident = off forwardedfor = on maxchildren = 120 logconnectionhandlingerrors = on HOPE ANYBODY CAN HELP ME ?!? Regards / Gruß Bruno

1 0

Apache attack or a new worm
by security＠meteognosis.gr 14 Aug '02

14 Aug '02

Hello everybody. I run Apache/1.3.23 in Suse 8.0 box and i had these logs in my access log file I wonder if this is a new worm or just an attack in my linux box I would appreciate it if somebody helped me xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:38 +0300] "HEAD /cgi-bin/mailnews.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:39 +0300] "HEAD /cgi-bin/newsdesk.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:42 +0300] "HEAD /cgi-bin/pals-cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:43 +0300] "HEAD /ROADS/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:43 +0300] "GET /cgi-bin/sendtemp.pl?templ=../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "HEAD /way-board/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "GET /cgi-bin/webspirs.cgi?sp.nextform=../../../../../../etc/passwd HTTP/1.0" 404 286 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "HEAD /cgi-bin/DCShop/Orders/orders.txt HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:45 +0300] "HEAD /cgi-bin/a1disp3.cgi?/../../../../../../etc/passwd HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:45 +0300] "HEAD /cgi-bin/a1stats/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:46 +0300] "GET /cgi-bin/get32.exe HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:46 +0300] "GET /cgi-bin/auktion.cgi?menue=../../../../../../../../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET ///index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 277 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET /cgi-bin/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET ///edit_image.php?dn=1&userfile=/etc/passwd&userfile_name=%20;ls;%20 HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:51 +0300] "GET /cgi-bin/eshop.pl?seite=;cat%20/etc/passwd| HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:35 +0300] "GET / HTTP/1.1" 200 24306 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:37 +0300] "GET /main.css HTTP/1.1" 200 1567 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:38 +0300] "GET /bAN-NIK.jpg HTTP/1.1" 200 28928 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:39 +0300] "GET /site_map01-copy.jpg HTTP/1.1" 200 22412 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:42 +0300] "GET /site_map02-copy.jpg HTTP/1.1" 200 26944 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:43 +0300] "GET /ems2.gif HTTP/1.1" 200 3873 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:44 +0300] "GET /images/Send_Mail.gif HTTP/1.1" 200 1119 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:46 +0300] "GET /MAPS_SEAS/winds_gr.jpg HTTP/1.1" 200 31832 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" cirrus:/www/db # cat /www/db/awstats_archive.log | grep xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:33 +0300] "HEAD / HTTP\1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:43 +0300] "HEAD /// HTTP/1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:44 +0300] "HEAD ///server-info HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:47 +0300] "HEAD ///server-status HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:51 +0300] "HEAD /site/eg/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:51 +0300] "HEAD /doc/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:51 +0300] "HEAD /~nobody/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:52 +0300] "HEAD ///manual/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:52 +0300] "HEAD /cgi-bin/ HTTP/1.0" 403 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:53 +0300] "HEAD /cgi-bin/ad.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:53 +0300] "HEAD /cgi-bin/aglimpse HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:53 +0300] "HEAD /cgi-bin/AnyForm2 HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:54 +0300] "HEAD /cgi-bin/bbs_forum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:54 +0300] "HEAD /cgi-bin/bsguest.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:55 +0300] "HEAD /cgi-bin/bslist.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:55 +0300] "HEAD /cgi-bin/campas HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:56 +0300] "HEAD /// HTTP/1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:56 +0300] "HEAD ///carbo.ddl HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:56 +0300] "HEAD /cgi-bin/count.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:16:57 +0300] "HEAD /cgi-bin/cgforum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:00 +0300] "HEAD /cgi-bin/gbook.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:00 +0300] "HEAD /cgi-bin/htsearch HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:04 +0300] "HEAD /cgi-bin/htmlscript HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:07 +0300] "HEAD /cgi-bin/jj HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:07 +0300] "HEAD /technote/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:08 +0300] "HEAD /cgi-bin/mmstdod.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:08 +0300] "HEAD /cgi-bin/newdesk HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:09 +0300] "HEAD /cgi-bin/register.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:13 +0300] "HEAD /cgi-bin/simplestguest.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:13 +0300] "HEAD /cgi-bin/statusconfig.pl HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:14 +0300] "HEAD /cgi-bin/webgais HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:15 +0300] "HEAD /iisadmpwd/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:18 +0300] "HEAD /cgi-bin/webgais HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:19 +0300] "HEAD /cgi-bin/perl.exe HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:19 +0300] "HEAD /cgi-dos/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:20 +0300] "HEAD /scripts/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:20 +0300] "HEAD /cgi-bin/infosrch.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:21 +0300] "HEAD /cgi-bin/rguest.exe HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:22 +0300] "HEAD /mall_log_files/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:22 +0300] "HEAD /cgi-bin/ezshopper2/loadpage.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:23 +0300] "HEAD /Admin_files/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:23 +0300] "GET ///quote.html HTTP/1.0" 404 278 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:24 +0300] "GET /cgi-bin/cal_make.pl?p0=../../../../../../../../../../../../etc/passwd%00 HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:24 +0300] "HEAD /cgi-bin/dcboard.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:25 +0300] "GET /cgi-bin/nph-maillist.pl HTTP/1.0" 404 289 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:25 +0300] "GET /cgi-bin/talkback.cgi?article=../../../../../../../../etc/passwd%00&action=view&matchview=1 HTTP/1.0" 404 286 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:26 +0300] "GET /cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd HTTP/1.0" 404 289 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:26 +0300] "HEAD /cgi-bin/ikonboard/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:26 +0300] "HEAD /foldoc/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:27 +0300] "HEAD /cgi-bin/adcycle/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:27 +0300] "GET /cgi-bin/store.cgi?StartID=../etc/passwd%00.html HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:28 +0300] "HEAD /cgi-bin/bbs_forum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:28 +0300] "HEAD /cgi-bin/commerce.cgi?page=../../../../etc/hosts%00index.html HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:28 +0300] "GET /cgi-bin/auktion.pl?menue=../../../../../../../../../../../../../etc/passwd HTTP/1.0" 404 284 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:32 +0300] "GET /cgi-bin/hsx.cgi?show=../../../../../../etc/passwd%00 HTTP/1.0" 404 281 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:32 +0300] "HEAD /cgi-bin/mailnews.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:33 +0300] "HEAD /cgi-bin/newsdesk.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:33 +0300] "HEAD /cgi-bin/pals-cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:34 +0300] "HEAD /ROADS/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:34 +0300] "GET /cgi-bin/sendtemp.pl?templ=../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:34 +0300] "HEAD /way-board/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:35 +0300] "GET /cgi-bin/webspirs.cgi?sp.nextform=../../../../../../etc/passwd HTTP/1.0" 404 286 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:35 +0300] "HEAD /cgi-bin/DCShop/Orders/orders.txt HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:36 +0300] "HEAD /cgi-bin/a1disp3.cgi?/../../../../../../etc/passwd HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:37 +0300] "HEAD /cgi-bin/a1stats/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:37 +0300] "GET /cgi-bin/get32.exe HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:38 +0300] "GET /cgi-bin/auktion.cgi?menue=../../../../../../../../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:38 +0300] "GET ///index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 277 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:42 +0300] "GET /cgi-bin/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:42 +0300] "GET ///edit_image.php?dn=1&userfile=/etc/passwd&userfile_name=%20;ls;%20 HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:42 +0300] "GET /cgi-bin/eshop.pl?seite=;cat%20/etc/passwd| HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:17:49 +0300] "HEAD / HTTP\1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:02 +0300] "HEAD /// HTTP/1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:03 +0300] "HEAD ///server-info HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:03 +0300] "HEAD ///server-status HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:04 +0300] "HEAD /site/eg/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:07 +0300] "HEAD /doc/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:07 +0300] "HEAD /~nobody/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:11 +0300] "HEAD ///manual/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:11 +0300] "HEAD /cgi-bin/ HTTP/1.0" 403 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:12 +0300] "HEAD /cgi-bin/ad.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:12 +0300] "HEAD /cgi-bin/aglimpse HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:13 +0300] "HEAD /cgi-bin/AnyForm2 HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:13 +0300] "HEAD /cgi-bin/bbs_forum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:14 +0300] "HEAD /cgi-bin/bsguest.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:14 +0300] "HEAD /cgi-bin/bslist.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:14 +0300] "HEAD /cgi-bin/campas HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:15 +0300] "HEAD /// HTTP/1.0" 200 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:15 +0300] "HEAD ///carbo.ddl HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:16 +0300] "HEAD /cgi-bin/count.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:19 +0300] "HEAD /cgi-bin/cgforum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:20 +0300] "HEAD /cgi-bin/faxsurvey HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:20 +0300] "HEAD /cgi-bin/gbook.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:21 +0300] "HEAD /cgi-bin/htsearch HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:21 +0300] "HEAD /cgi-bin/htmlscript HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:21 +0300] "HEAD /cgi-bin/jj HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:22 +0300] "HEAD /technote/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:22 +0300] "HEAD /cgi-bin/mmstdod.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:23 +0300] "HEAD /cgi-bin/newdesk HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:23 +0300] "HEAD /cgi-bin/register.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:23 +0300] "HEAD /cgi-bin/simplestguest.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:24 +0300] "HEAD /cgi-bin/statusconfig.pl HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:24 +0300] "HEAD /cgi-bin/webgais HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:25 +0300] "HEAD /iisadmpwd/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:25 +0300] "HEAD /cgi-bin/webgais HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:28 +0300] "HEAD /cgi-bin/perl.exe HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:29 +0300] "HEAD /cgi-dos/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:29 +0300] "HEAD /scripts/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:30 +0300] "HEAD /cgi-bin/infosrch.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:30 +0300] "HEAD /cgi-bin/rguest.exe HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:30 +0300] "HEAD /mall_log_files/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:31 +0300] "HEAD /cgi-bin/ezshopper2/loadpage.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:31 +0300] "HEAD /Admin_files/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:32 +0300] "GET ///quote.html HTTP/1.0" 404 278 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:32 +0300] "GET /cgi-bin/cal_make.pl?p0=../../../../../../../../../../../../etc/passwd%00 HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:33 +0300] "HEAD /cgi-bin/dcboard.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:33 +0300] "GET /cgi-bin/nph-maillist.pl HTTP/1.0" 404 289 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:33 +0300] "GET /cgi-bin/talkback.cgi?article=../../../../../../../../etc/passwd%00&action=view&matchview=1 HTTP/1.0" 404 286 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:34 +0300] "GET /cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd HTTP/1.0" 404 289 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:34 +0300] "HEAD /cgi-bin/ikonboard/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:35 +0300] "HEAD /foldoc/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:35 +0300] "HEAD /cgi-bin/adcycle/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:35 +0300] "GET /cgi-bin/store.cgi?StartID=../etc/passwd%00.html HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:36 +0300] "HEAD /cgi-bin/bbs_forum.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:36 +0300] "HEAD /cgi-bin/commerce.cgi?page=../../../../etc/hosts%00index.html HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:37 +0300] "GET /cgi-bin/auktion.pl?menue=../../../../../../../../../../../../../etc/passwd HTTP/1.0" 404 284 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:37 +0300] "GET /cgi-bin/hsx.cgi?show=../../../../../../etc/passwd%00 HTTP/1.0" 404 281 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:38 +0300] "HEAD /cgi-bin/mailnews.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:39 +0300] "HEAD /cgi-bin/newsdesk.cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:42 +0300] "HEAD /cgi-bin/pals-cgi HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:43 +0300] "HEAD /ROADS/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:43 +0300] "GET /cgi-bin/sendtemp.pl?templ=../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "HEAD /way-board/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "GET /cgi-bin/webspirs.cgi?sp.nextform=../../../../../../etc/passwd HTTP/1.0" 404 286 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:44 +0300] "HEAD /cgi-bin/DCShop/Orders/orders.txt HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:45 +0300] "HEAD /cgi-bin/a1disp3.cgi?/../../../../../../etc/passwd HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:45 +0300] "HEAD /cgi-bin/a1stats/ HTTP/1.0" 404 0 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:46 +0300] "GET /cgi-bin/get32.exe HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:46 +0300] "GET /cgi-bin/auktion.cgi?menue=../../../../../../../../../etc/passwd HTTP/1.0" 404 285 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET ///index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 277 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET /cgi-bin/index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 404 283 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:50 +0300] "GET ///edit_image.php?dn=1&userfile=/etc/passwd&userfile_name=%20;ls;%20 HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:18:51 +0300] "GET /cgi-bin/eshop.pl?seite=;cat%20/etc/passwd| HTTP/1.0" 404 282 "-" "-" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:35 +0300] "GET / HTTP/1.1" 200 24306 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:37 +0300] "GET /main.css HTTP/1.1" 200 1567 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:38 +0300] "GET /bAN-NIK.jpg HTTP/1.1" 200 28928 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:39 +0300] "GET /site_map01-copy.jpg HTTP/1.1" 200 22412 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:42 +0300] "GET /site_map02-copy.jpg HTTP/1.1" 200 26944 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:43 +0300] "GET /ems2.gif HTTP/1.1" 200 3873 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:44 +0300] "GET /images/Send_Mail.gif HTTP/1.1" 200 1119 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)" xxx.xxx.xxx.xxx - - [13/Aug/2002:18:20:46 +0300] "GET /MAPS_SEAS/winds_gr.jpg HTTP/1.1" 200 31832 "http://194.219.59.131/" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)"

3 2

RE: [suse-security] Apache 1.3.20 release 66
by Peer Stefan 14 Aug '02

14 Aug '02

hi > From: Fabrizio Di Meo [mailto:fabriziodimeo@yahoo.it] > Hi, > > I've just a question about Apache 1.3.20 release 66 which > should fix the last vulnerability (at least the last one I > knew about). > > Despite my package updating I go on to check continuos > crashes of my web server due to some tcp scanning to the port 80. > > Has someone checked this problem or ... I'm in error? I have had some similar problems. I use a self-compiled Apache 1.3.26 with PHP 4.2.2, which used to crash every now and then. That's why I set up a cronjob to survey the Apache processes and, in case of Apache not running, restarting Apache. I know it's fighting symptoms, but I don't have the time right now to search for the cause. It's on my TODO-list for the next 2 months ... > Thank you, > > Fabrizio. regards, Stefan The crontab-entry: 0-59/5 * * * * /my_tools/processchecker.sh /usr/local/apache/bin/httpd Here's the script I use: webserver:~ # cat /my_tools/processchecker.sh #!/bin/sh BINARY=$1; LOGFILE="/var/log/processchecker.log"; DATE=`/bin/date`; MAILTO=stefan.peer(a)tiwag.at CC=XXXXX(a)somwhere.in.the.net HOST=`hostname -f`; RCDIR="/etc/init.d"; if [ -z $BINARY ] ; then echo "Usage: $0 <binary>"; exit 1; fi RCSCRIPT=`find $RCDIR -type f -exec grep -H "$BINARY" {} \; | awk -F":" '{print $1}' | uniq` #if [ -z $RCSCRIPT ]; then # RCSCRIPT=/etc/rc.d/`basename $BINARY`; #fi START_CMD="$RCSCRIPT start"; STOP_CMD="$RCSCRIPT stop"; STATUS_CMD="/sbin/checkproc $BINARY"; if $STATUS_CMD ; then echo "$DATE: $BINARY is up and running" >> $LOGFILE; else echo -n "$DATE: $BINARY not running. Starting $BINARY ...." >> $LOGFILE; if $START_CMD ; then echo "done." >> $LOGFILE; MESSAGE="$BINARY started successfully" else echo "failed." >> $LOGFILE; echo "Yikes, $BINARY could not be started on $HOST!"; MESSAGE="Yikes, $BINARY could not be started on $HOST!" fi echo $MESSAGE | mail -s "$0 - $BINARY not running on $HOST" $MAILTO -c $CC fi exit 0;

1 0

Cipe and Kernel 2.4.19
by ts 14 Aug '02

14 Aug '02

Is anybody using cipe (1.5x) with the newest stable kernel? Can anybody comment on whether they are having any difficulties or known issues? It seems to broken compared to 2.4.14. I can send specifics(strace,gdb steppings..) if they are needed.

2 1

Re: [suse-security] Still probs with DansGuardian and Squid2.4-Stable7 (Versions)
by BLeonhardt＠analytek.de 14 Aug '02

14 Aug '02

Versions : DansGuardian 2.4.5-2 Squid Cache: Version 2.4.STABLE7 SquidGuard: 1.1.4 Sleepycat Software: Berkeley DB 2.7.7: (08/20/99) Hi again, here a part ot the log from Squid : 1029306401.296 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306403.147 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306408.216 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029306413.925 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308327.375 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308335.963 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308527.158 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308531.888 20 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - Hi, after prevent connections directly to port 3128 for all other ip's (with iptables) and configured DansGuardian to use 127.0.0.1 - I will get following message from Squid : ERROR The requested URL could not be retrieved While trying to retrieve the URL: http://www.linux-it.net/index.php The following error was encountered: Forwarding Denied. This cache will not forward your request because it is trying to enforce a sibling relationship. Perhaps the client at 127.0.0.1 is a cache which has been misconfigured. Your cache administrator is bleonhardt(a)analytek.de. Generated Wed, 14 Aug 2002 06:26:53 GMT by www-cache.analytek.de (Squid/2.4.STABLE7) ---------------------- Have added the configuration-files-entries from squid , squidguard and dansguardian , maybe anybody will see a "mssconfiguration" ... Following Squid-Configuration : http_port 3128 tcp_outgoing_address 192.168.x.x udp_incoming_address 0.0.0.0 udp_outgoing_address 0.0.0.0 cache_peer 127.0.0.1 sibling 8080 7 cache_peer 192.168.1.8 parent 3128 7 cache_mem 32 MB cache_swap_low 10 cache_swap_high 100 maximum_object_size 1024 KB minimum_object_size 0 KB ipcache_size 4096 ipcache_low 90 ipcache_high 95 fqdncache_size 1024 cache_dir ufs /var/squid/cache 100 16 256 cache_access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log /var/squid/logs/store.log pid_filename /var/run/squid.pid debug_options ALL,1 client_netmask 255.255.255.255 # SQUID-GUARD redirect_program /usr/bin/squidGuard redirect_children 5 authenticate_program /usr/sbin/pam_auth /etc/passwd authenticate_children 5 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 reference_age 1 week peer_connect_timeout 120 seconds client_lifetime 1 day half_closed_clients on pconn_timeout 360 seconds acl password proxy_auth REQUIRED acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 21 22 443 563 70 210 1025-65535 acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost all # I will replace "all" if everything is running :-) http_access allow password http_access deny CONNECT !SSL_ports http_access deny manager http_access deny test http_access deny all icp_access allow localhost all miss_access allow localhost manager all proxy_auth_realm Auth-Realm cache_mgr bleonhardt(a)analytek.de cache_effective_user squid cache_effective_group nogroup visible_hostname www-cache.analytek.de announce_period 0 day append_domain .analytek.de forwarded_for on log_icp_queries on icp_hit_stale on client_db on never_direct allow all ident_lookup_access allow all log_fqdn on -------------- Following SquidGuard - Rules : logdir /var/squidGuard/logs dbhome /var/squidGuard/db src kids { ip 192.168.x.x/24 } src local { ip 127.0.0.1/24 } dest blacklist { domainlist blacklist/domains urllist blacklist/urls } kids { pass !blacklist all } local { pass !blacklist all } default { pass none redirect http://192.168.1.13/cgi/blocked?clientaddr=%a&clientname=%n&clientuser=%i&c… } } -------- Following DansGuardian - Config : reportinglevel = 3 htmltemplate = '/etc/dansguardian/template.html' loglevel = 3 logexceptionhits = on logfileformat = 1 filterip = 192.168.x.x filterport = 8080 proxyip = 127.0.0.1 proxyport = 3128 accessdeniedaddress = 'http://host-ip/cgi-bin/dansguardian.pl' bannedphraselist = '/etc/dansguardian/bannedphraselist' exceptionphraselist = '/etc/dansguardian/exceptionphraselist' weightedphraselist = '/etc/dansguardian/weightedphraselist' bannedsitelist = '/etc/dansguardian/bannedsitelist' exceptionsitelist = '/etc/dansguardian/exceptionsitelist' exceptionurllist = '/etc/dansguardian/exceptionurllist' bannedurllist = '/etc/dansguardian/bannedurllist' bannedregexpurllist = '/etc/dansguardian/bannedregexpurllist' bannedextensionlist = '/etc/dansguardian/bannedextensionlist' bannedmimetypelist = '/etc/dansguardian/bannedmimetypelist' bannediplist = '/etc/dansguardian/bannediplist' exceptioniplist = '/etc/dansguardian/exceptioniplist' banneduserlist = '/etc/dansguardian/banneduserlist' exceptionuserlist = '/etc/dansguardian/exceptionuserlist' picsfile = '/etc/dansguardian/pics' weightedphrasemode = 2 naughtynesslimit = 160 showweightedfound = on reverseaddresslookups = on createlistcachefiles = on maxuploadsize = -1 usernameidmethodproxyauth = off usernameidmethodntlm = off # **NOT IMPLEMENTED** usernameidmethodident = off forwardedfor = on maxchildren = 120 logconnectionhandlingerrors = on HOPE ANYBODY CAN HELP ME ! Regards / Gruß Bruno -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Antwort: [suse-security] Still probs with DansGuardian and Squid2.4-Stable7
by BLeonhardt＠analytek.de 14 Aug '02

14 Aug '02

Hi again, here a part ot the log from Squid : 1029306401.296 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306403.147 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029306408.216 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029306413.925 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308327.375 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308335.963 1 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - 1029308527.158 1 localhost TCP_DENIED/407 1397 GET http://www.linux-it.net/index.php - NONE/- - 1029308531.888 20 localhost TCP_MISS/403 1091 GET http://www.linux-it.net/index.php user10 NONE/- - Hi, after prevent connections directly to port 3128 for all other ip's (with iptables) and configured DansGuardian to use 127.0.0.1 - I will get following message from Squid : ERROR The requested URL could not be retrieved While trying to retrieve the URL: http://www.linux-it.net/index.php The following error was encountered: Forwarding Denied. This cache will not forward your request because it is trying to enforce a sibling relationship. Perhaps the client at 127.0.0.1 is a cache which has been misconfigured. Your cache administrator is bleonhardt(a)analytek.de. Generated Wed, 14 Aug 2002 06:26:53 GMT by www-cache.analytek.de (Squid/2.4.STABLE7) ---------------------- Have added the configuration-files-entries from squid , squidguard and dansguardian , maybe anybody will see a "mssconfiguration" ... Following Squid-Configuration : http_port 3128 tcp_outgoing_address 192.168.x.x udp_incoming_address 0.0.0.0 udp_outgoing_address 0.0.0.0 cache_peer 127.0.0.1 sibling 8080 7 cache_peer 192.168.1.8 parent 3128 7 cache_mem 32 MB cache_swap_low 10 cache_swap_high 100 maximum_object_size 1024 KB minimum_object_size 0 KB ipcache_size 4096 ipcache_low 90 ipcache_high 95 fqdncache_size 1024 cache_dir ufs /var/squid/cache 100 16 256 cache_access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log /var/squid/logs/store.log pid_filename /var/run/squid.pid debug_options ALL,1 client_netmask 255.255.255.255 # SQUID-GUARD redirect_program /usr/bin/squidGuard redirect_children 5 authenticate_program /usr/sbin/pam_auth /etc/passwd authenticate_children 5 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 reference_age 1 week peer_connect_timeout 120 seconds client_lifetime 1 day half_closed_clients on pconn_timeout 360 seconds acl password proxy_auth REQUIRED acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 21 22 443 563 70 210 1025-65535 acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost all # I will replace "all" if everything is running :-) http_access allow password http_access deny CONNECT !SSL_ports http_access deny manager http_access deny test http_access deny all icp_access allow localhost all miss_access allow localhost manager all proxy_auth_realm Auth-Realm cache_mgr bleonhardt(a)analytek.de cache_effective_user squid cache_effective_group nogroup visible_hostname www-cache.analytek.de announce_period 0 day append_domain .analytek.de forwarded_for on log_icp_queries on icp_hit_stale on client_db on never_direct allow all ident_lookup_access allow all log_fqdn on -------------- Following SquidGuard - Rules : logdir /var/squidGuard/logs dbhome /var/squidGuard/db src kids { ip 192.168.x.x/24 } src local { ip 127.0.0.1/24 } dest blacklist { domainlist blacklist/domains urllist blacklist/urls } kids { pass !blacklist all } local { pass !blacklist all } default { pass none redirect http://192.168.1.13/cgi/blocked?clientaddr=%a&clientname=%n&clientuser=%i&c… } } -------- Following DansGuardian - Config : reportinglevel = 3 htmltemplate = '/etc/dansguardian/template.html' loglevel = 3 logexceptionhits = on logfileformat = 1 filterip = 192.168.x.x filterport = 8080 proxyip = 127.0.0.1 proxyport = 3128 accessdeniedaddress = 'http://host-ip/cgi-bin/dansguardian.pl' bannedphraselist = '/etc/dansguardian/bannedphraselist' exceptionphraselist = '/etc/dansguardian/exceptionphraselist' weightedphraselist = '/etc/dansguardian/weightedphraselist' bannedsitelist = '/etc/dansguardian/bannedsitelist' exceptionsitelist = '/etc/dansguardian/exceptionsitelist' exceptionurllist = '/etc/dansguardian/exceptionurllist' bannedurllist = '/etc/dansguardian/bannedurllist' bannedregexpurllist = '/etc/dansguardian/bannedregexpurllist' bannedextensionlist = '/etc/dansguardian/bannedextensionlist' bannedmimetypelist = '/etc/dansguardian/bannedmimetypelist' bannediplist = '/etc/dansguardian/bannediplist' exceptioniplist = '/etc/dansguardian/exceptioniplist' banneduserlist = '/etc/dansguardian/banneduserlist' exceptionuserlist = '/etc/dansguardian/exceptionuserlist' picsfile = '/etc/dansguardian/pics' weightedphrasemode = 2 naughtynesslimit = 160 showweightedfound = on reverseaddresslookups = on createlistcachefiles = on maxuploadsize = -1 usernameidmethodproxyauth = off usernameidmethodntlm = off # **NOT IMPLEMENTED** usernameidmethodident = off forwardedfor = on maxchildren = 120 logconnectionhandlingerrors = on HOPE ANYBODY CAN HELP ME ! Regards / Gruß Bruno -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Still probs with DansGuardian and Squid2.4-Stable7
by BLeonhardt＠analytek.de 14 Aug '02

14 Aug '02

Hi, after prevent connections directly to port 3128 for all other ip's (with iptables) and configured DansGuardian to use 127.0.0.1 - I will get following message from Squid : ERROR The requested URL could not be retrieved While trying to retrieve the URL: http://www.linux-it.net/index.php The following error was encountered: Forwarding Denied. This cache will not forward your request because it is trying to enforce a sibling relationship. Perhaps the client at 127.0.0.1 is a cache which has been misconfigured. Your cache administrator is bleonhardt(a)analytek.de. Generated Wed, 14 Aug 2002 06:26:53 GMT by www-cache.analytek.de (Squid/2.4.STABLE7) ---------------------- Have added the configuration-files-entries from squid , squidguard and dansguardian , maybe anybody will see a "mssconfiguration" ... Following Squid-Configuration : http_port 3128 tcp_outgoing_address 192.168.x.x udp_incoming_address 0.0.0.0 udp_outgoing_address 0.0.0.0 cache_peer 127.0.0.1 sibling 8080 7 cache_peer 192.168.1.8 parent 3128 7 cache_mem 32 MB cache_swap_low 10 cache_swap_high 100 maximum_object_size 1024 KB minimum_object_size 0 KB ipcache_size 4096 ipcache_low 90 ipcache_high 95 fqdncache_size 1024 cache_dir ufs /var/squid/cache 100 16 256 cache_access_log /var/squid/logs/access.log cache_log /var/squid/logs/cache.log cache_store_log /var/squid/logs/store.log pid_filename /var/run/squid.pid debug_options ALL,1 client_netmask 255.255.255.255 # SQUID-GUARD redirect_program /usr/bin/squidGuard redirect_children 5 authenticate_program /usr/sbin/pam_auth /etc/passwd authenticate_children 5 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 reference_age 1 week peer_connect_timeout 120 seconds client_lifetime 1 day half_closed_clients on pconn_timeout 360 seconds acl password proxy_auth REQUIRED acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 21 22 443 563 70 210 1025-65535 acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost all # I will replace "all" if everything is running :-) http_access allow password http_access deny CONNECT !SSL_ports http_access deny manager http_access deny test http_access deny all icp_access allow localhost all miss_access allow localhost manager all proxy_auth_realm Auth-Realm cache_mgr bleonhardt(a)analytek.de cache_effective_user squid cache_effective_group nogroup visible_hostname www-cache.analytek.de announce_period 0 day append_domain .analytek.de forwarded_for on log_icp_queries on icp_hit_stale on client_db on never_direct allow all ident_lookup_access allow all log_fqdn on -------------- Following SquidGuard - Rules : logdir /var/squidGuard/logs dbhome /var/squidGuard/db src kids { ip 192.168.x.x/24 } src local { ip 127.0.0.1/24 } dest blacklist { domainlist blacklist/domains urllist blacklist/urls } kids { pass !blacklist all } local { pass !blacklist all } default { pass none redirect http://192.168.1.13/cgi/blocked?clientaddr=%a&clientname=%n&clientuser=%i&c… } } -------- Following DansGuardian - Config : reportinglevel = 3 htmltemplate = '/etc/dansguardian/template.html' loglevel = 3 logexceptionhits = on logfileformat = 1 filterip = 192.168.x.x filterport = 8080 proxyip = 127.0.0.1 proxyport = 3128 accessdeniedaddress = 'http://host-ip/cgi-bin/dansguardian.pl' bannedphraselist = '/etc/dansguardian/bannedphraselist' exceptionphraselist = '/etc/dansguardian/exceptionphraselist' weightedphraselist = '/etc/dansguardian/weightedphraselist' bannedsitelist = '/etc/dansguardian/bannedsitelist' exceptionsitelist = '/etc/dansguardian/exceptionsitelist' exceptionurllist = '/etc/dansguardian/exceptionurllist' bannedurllist = '/etc/dansguardian/bannedurllist' bannedregexpurllist = '/etc/dansguardian/bannedregexpurllist' bannedextensionlist = '/etc/dansguardian/bannedextensionlist' bannedmimetypelist = '/etc/dansguardian/bannedmimetypelist' bannediplist = '/etc/dansguardian/bannediplist' exceptioniplist = '/etc/dansguardian/exceptioniplist' banneduserlist = '/etc/dansguardian/banneduserlist' exceptionuserlist = '/etc/dansguardian/exceptionuserlist' picsfile = '/etc/dansguardian/pics' weightedphrasemode = 2 naughtynesslimit = 160 showweightedfound = on reverseaddresslookups = on createlistcachefiles = on maxuploadsize = -1 usernameidmethodproxyauth = off usernameidmethodntlm = off # **NOT IMPLEMENTED** usernameidmethodident = off forwardedfor = on maxchildren = 120 logconnectionhandlingerrors = on HOPE ANYBODY CAN HELP ME ! Regards / Gruß Bruno

1 0

Apache 1.3.20 release 66
by Fabrizio Di Meo 14 Aug '02

14 Aug '02

Hi, I've just a question about Apache 1.3.20 release 66 which should fix the last vulnerability (at least the last one I knew about). Despite my package updating I go on to check continuos crashes of my web server due to some tcp scanning to the port 80. Has someone checked this problem or ... I'm in error? Thank you, Fabrizio. www.viapanisperna.org --------------------------------- Scarica il nuovo Yahoo! Messenger: con webcam, nuove faccine e tante altre novità!

1 0