August 2002 - openSUSE Security - openSUSE Mailing Lists

Program to check the Security
by Jens.Dinstuehler＠is-ag.com 06 Aug '02

06 Aug '02

Hello, is there any program available for Testing the Security of our Suse Webservers ?? We need a Tool that could be run on a Win32 platform and checks if there are any security holes in our Suse 7.3 and Suse 8.0 Webservers at our Intranet. Greets Jens

3 2

IPTables in the Corporate Environment
by Xunil2002＠aol.com 06 Aug '02

06 Aug '02

Hello List, Can anyone advise me of a company that uses a Linux server with Kernel 2.4.18, patched with IPTables 1.2.6a, as a primary Firewall? I am conducting research for a project I'm working on at the office. Case studies would be of great assistance but are not essential. Kind Regards, Christopher Lucas

1 0

FW: AW: [suse-security] sendmail spam
by rutger 06 Aug '02

06 Aug '02

hello, no we're using sendmail. rutger ---------- Von: "Bob Sprenger" <bobo(a)tub-web.com> Datum: Tue, 6 Aug 2002 11:38:26 +0200 An: "rutger" <rutger(a)screendesign-net.de> Betreff: AW: [suse-security] sendmail spam Are you using formmail ? That is was in our case. Bob Sprenger. -----Ursprüngliche Nachricht----- Von: rutger [mailto:rutger@screendesign-net.de] Gesendet: Dienstag, 6. August 2002 11:48 An: suse-security(a)suse.com Betreff: [suse-security] sendmail spam hello list, someone is using our server to send spams. the log: Aug 5 18:33:33 tms sendmail[618]: g75GXVd00616: to=bennyb911@aol.com,bennybad@aol.com, ctladdr=wwwrun (30/65534), delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=151214, relay=mailin-04.mx.aol.com. [64.12.137.152], dsn=2.0.0, stat=Sent (OK) the received entry in the returned mail: Received: (from wwwrun@localhost) by tms.screendesign-net.de (8.11.2/8.11.2/SuSE Linux 8.11.1-0.5) id g75EvBW32281; any ideas what to do?? thanx, rutger kontakt: | tel.: 06341/9821252 r.frechen | email: r.frechen(a)gmx.de multimediadesign & | programmierung | ·--/\--· alfred-nobel-platz 1 | / \ 76829 landau | \ / germany | ·--\/--· email: r.frechen(a)gmx.de ___________________________________________________________ "We go where WE want." bye bill -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 2

Affected by CA-2002-25?
by Andrew McCall 06 Aug '02

06 Aug '02

Hi All, Does anyone know if glibc-2.2.2-63 is affected by http://www.cert.org/advisories/CA-2002-25.html ? -- Thanks Andrew McCall Internet System Administrator I.C.T. Division Oldham MBC Civic Centre West Street Oldham OL1 1UU Tel : 0161 911 3990 Fax : 0161 911 3998 Email : it.andrew.mccall(a)oldham.gov.uk ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.oldham.gov.uk **********************************************************************

2 1

Re: RE: [suse-security] Open Ports on Webserver - Why
by GentooRulez 06 Aug '02

06 Aug '02

>Hi again ! >When I close the whole Server whith iptables, the portscanner says the >same. >Iptables -P INPUT DROP >Iptables -P OUTPUT DROP >The scanner says, that pop,smtp,http,... And the other mentioned ports >are open? >Häh? Did you flushed all rules with iptables -F INPUT ??? und what says iptables -L -v -v ???? Yours Michael

4 4

Patch desription files for SuSe 7.1 cause double downloads
by Hemsley, Trevor 05 Aug '02

05 Aug '02

Suse people The patch description files that you have online for SuSE 7.1 are broken and cause extra packages to be installed and also extra downloads to take place. For example, the openssl file ~ftp/pub/suse/i386/update/7.1/patches/openssl-3652 contains three InstPath: lines that tell it to patch sec1/openssl-0.9.6a-63, openssl-doc-0.9.6a-63 and openssl-devel-0.9.6a-63. YOU in SuSE 7.1 proceeds to apply all three of these patches if the openssl.rpm is installed. If you only had openssl.rpm installed before, you now also have openssl-doc.rpm and openssl-devel.rpm. If you now run YOU a second time, it finds the patch description files openssl-doc-1 and openssl-devel-1 in ~ftp/pub/suse/i386/update/7.1/patches and checks their status in /var/lib/YaST/patches/i386/update/7.1/patches and sees these files as *.new so then applies them again, redownloading the rpm files for each one. This is not just openssl that's affected by this, it's also apache, apache-contrib, bind8, mod_php4 and possibly others as well. This sort of "multiple files in one patch description file" thing works ok on SuSE 7.3 from what I can see but on Suse 7.1 it does not. Trevor Hemsley, Security Specialist, Atos Origin Ltd, Whyteleafe, +44-(0)1883-628139 [This electronic transmission and any files attached to it are strictly confidential and intended solely for the addressee. If you are not the intended addressee, you must not disclose, copy or take any action in reliance of this transmission. If you have received this transmission in error, please notify us by return and delete the same. The views expressed in this electronic transmission do not necessarily reflect those of Atos Origin or any of its subsidiary companies. Although the sender endeavours to maintain a computer virus free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. Thank You.]

1 0

RE: [suse-security] FreeBSD NIS Server + SuSE Linux Client
by Thomas Schweikle 05 Aug '02

05 Aug '02

Hi! An: <suse-security(a)suse.com> Kopie: (Blindkopie: Thomas Schweikle/FAG/FIDUCIA) Thema: RE: [suse-security] FreeBSD NIS Server + SuSE Linux Client > I thought I'd ask one more time to see if anyone has any > information on making SuSE Linux work with a standard NIS > server before I give up and go back to FreeBSD... There are differences between these two making it a bit complicated to set up a NIS server recognized by both Linux and FreeBSD: 1. FreeBSD uses MD5 for passwords, SuSE uses (if not explicitly adviced) crypt. 2. NIS tables are different for both systems. 3. NIS on Linux does not know about "shadow" maps and doesn't accept "*" for passwords, making it look at another map. If you want to try it nevertheless, setup your FreeBSD NIS server now: - combine passwd and shadow - export the new map make shure passwords are seen on linux side by executing "ypcat passwd". Now switch linux to use MD5 for password entries. You should be off and running now! >> -----Original Message----- >> From: Glen Campbell [mailto:glen@broadpool.com] >> Sent: Friday, July 26, 2002 11:10 AM >> To: suse-security(a)suse.com >> Subject: [suse-security] FreeBSD NIS Server + SuSE Linux Client >> >> >> I hope this is the correct list for this question. Since it >> has to do with login and authentication, I thought "security" >> was the closest match I could find. I've been browsing the >> SuSE list archives for a week (along with everything else I >> could find on Google) with no success. I'm seriously losing >> my hair over this. >> >> I have recently installed SuSE Linux 8.0 on two separate >> machines. My other machines at home are both running FreeBSD >> (4.6-STABLE). They are the NIS master and slave servers, respectively. >> >> I have used YAST2 to initiate an "NIS Client" on the Linux >> boxes. Ypbind and ypwhich are both running successfully and >> returning proper information. I can "finger" all of the NIS >> users and I can ypcat passwd, master.passwd, etc. However, I >> cannot login with an NIS user. I have turned "debug" on in >> security/pam_unix2.conf, and here is the >> >> Jul 26 09:44:25 horace sshd[1449]: pam_unix2: >> pam_sm_authenticate() called Jul 26 09:44:25 horace >> sshd[1449]: pam_unix2: username=[glen] Jul 26 09:44:25 horace >> sshd[1449]: pam_unix2: wrong password, return PAM_AUTH_ERR >> Jul 26 09:44:25 horace sshd[1449]: Failed password for glen >> from ::1 port 32772 ssh2 Looks like you forgot to switch Linux to use MD5 password hashes. >> In this case, it's from sshd, but I get the same results from >> login and kdm as well. >> >> Here's what "ypcat passwd" returns (just a sample): >> >> stephen:*:1013:1001:Stephen XXXX:/home/stephen:/bin/tcsh >> tpecot:*:1016:1001:XXXX Pecot:/home/tpecot:/bin/tcsh >> >> Here's what "ypcat master.passwd.byname" returns (again, a sample): >> >> stephen:$1$z2wACRkf$camGYsMF6OTjTL41gNSCX0:1013:1001::0:0:Stephen >> XXXX:/home/stephen:/bin/tcsh >> tpecot:$1$P3lvmuTE$RRuEzWjhxwwmMOwv0DzvN.:1016:1001::0:0:XXXX >> Pecot:/home/tpecot:/bin/tcsh "master.passwd" isn't supported by Linux! Combine your "/etc/passwd" and "/etc/shadow" maps! If compiled with "--shadow-passwd" (not realy shure about the option) NIS on Linux will support "shadow.byname" for passwords. As far as I know SuSE didn't compile this in. >> (1) it has been suggested that the MD5 encryption used in the >> FreeBSD password file is causing the problem. However, I have >> been able to cut a password from the BSD password file into >> the Linux password file and it worked just fine (for a local >> user). I don't think that's the problem. If this works, both systems work with cript or MD5, what should be OK! >> (2) The BSD password file has "*" in the second field, which >> indicates the password is stored in master.passwd. SuSE Linux >> uses an "x" in the second field to indicate that the password >> is stored in /etc/shadow. Could this be the source of the >> conflict? If so, how do I configure SuSE to recognize the "*" >> instead of the "x"? No. A password consisting of only one character is considered to be stored elsewhere --- normaly "/etc/shadow" on Linux. It is only a convention to use "*" or "x" for passwords stored somewhere else. You could use any other character except ":" and "@". >> [...] -- Thomas

2 1

Open Ports on Webserver - Why
by Florian Schie?l 05 Aug '02

05 Aug '02

Hi I tested my SUSE 7.2 Webserver with two Portscanners and both gave me the same result: 389 Lightweight Directory Access Protocol 1720 h323hostcall The first, LDAP, I don't know why this is open, it's not installed!?. And the 2nd, the H323-protocol which is used by, for example MS Netmeeting, the same question. I searched with 'netstat -ap' for PIDs of some unknown processes and then I had a look at them with 'ps aux | grep <PID>', but there was nothing unusual. Can that be or is there something wrong with the Portscanner? THX Florian

5 5

ot: ifstatus-route eats up all cpu time...
by Gunther Stammwitz 04 Aug '02

04 Aug '02

Hello list, one of my servers hang today with a kernel panic. After rebooting the system I checked the logfiles but couldn't find any hint. Then I've started yast and chose the runlevel-editor. When the runlevel-editor began checking the status of the process listed in init.d the script "ifstatus-route" began eating up all of my cputime. The system almost froze for one or two minutes, but after that I could continue to work with yast (and on the system...). I'm running SuSE 8.0, kernel 2.4.18-4GB with the latest security patches applied. any ideas ??? 9:52pm up 10 min, 2 users, load average: 1.71, 0.88, 0.41 68 processes: 65 sleeping, 3 running, 0 zombie, 0 stopped CPU states: 79.1% user, 20.8% system, 0.0% nice, 0.0% idle Mem: 513448K av, 507708K used, 5740K free, 0K shrd, 11728K buff Swap: 1052248K av, 0K used, 1052248K free 431168K cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME COMMAND 4443 root 0 0 1900 1900 1140 R 99.9 0.3 2:00 ifstatus-route Thanks and bye, Gunther

1 0

AW: [suse-security] SuSE Security Announcement: mod_ssl, mm (SuSE-SA:2002:028)
by Christoph Illnar 04 Aug '02

04 Aug '02

Hi, yes, backing-up my rpm-db and rebuilding it was the solution. now all packages updated as expected. seems that there is a bug or something like that in rpm so that the db got corrupted. mfg ;-) Christoph Illnar GlobalAce.net Internetservice GmbH * WorldStore eCommerce www.globalace.net www.worldstore.at www.schatzmail.com > -----Ursprungliche Nachricht----- > Von: David Huecking [mailto:david@huecking.net] > Gesendet: Freitag, 02. August 2002 09:47 > An: Christoph Illnar > Cc: suse-security(a)suse.com > Betreff: Re: [suse-security] SuSE Security Announcement: mod_ssl, mm > (SuSE-SA:2002:028) > > > I saw this thing happen two times before. I did an update of many > RPM-packages and the hell knows why when processing rpm seemed to stop > working and took around 100% system load. I killed rpm after waiting some > minutes and tried to process explicitly this one package, but rpm showed > just the same behaviour... As a solution I made a backup of my > rpm-database (/var/lib/rpm) and regenerated it with rpm --rebuilddb. After > that the update ran as expected. > > > -- > Eat, sleep and go running! > > David Huecking. > > > On Thu, 1 Aug 2002, Christoph Illnar wrote: > > > Hello, > > > > I installed the recommended updated packages on my suse 7.3. > > Everything worked fine when passed on as a list (command "rpm > -Fhv apache* > > mod_ssl*"). > > mod_php4 worked fine too except mod_php4 that hangs after the > progress bar > > is complete. > > after 30min of high cpu usage of rpm (~90%) I killed it... > > > > any ideas what the problem could be?

3 2