August 2002 - openSUSE Security - openSUSE Mailing Lists

Detailed information about trojaned OpenSSH
by Christoph Wegener 01 Aug '02

01 Aug '02

FYI: http://www.mavetju.org/weblog/weblog.php Greetz Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

2 1

Re: SuSE-FW-NO_ACCESS_INT->FWEXT (last attempt)
by Marcin Gryszczuk 01 Aug '02

01 Aug '02

Hi (sorry for the second post but the subject was gone in the first one) Or the better solution (without keeping your firewall computer fully open for inside word) is: In firewall2-custom.rc.config add something like this (ex about allowing http, https and proxy to external interface from internal word): iptables -I INPUT x+0 -i eth0 -p tcp --dport 80 -j input_int iptables -I INPUT x+1 -i eth0 -p tcp --dport 443 -j input_int iptables -I INPUT x+2 -i eth0 -p tcp --dport 8080 -j input_int Where eth0 is an internal interface.. And x - is a rule number before rule responsible for dropping all traffic between internal and external: 92 6321 DROP all -- eth0 any anywhere 255.255.255.255 24 1542 LOG all -- eth0 any anywhere your.ext.ip.address LOG level warning tcp-options ip-options prefix `SuSE-FW-NO_ACCESS_INT->FWEXT ' Best place for such rules in firewall2-custom.rc.config is function called fw_custom_before_denyall(). Please remember of allowing firewall2-custom.rc.config in firewall2.rc.config ! FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" Best regards Marcin Gryszczuk At 11:54 01-08-2002 +0200, Mathias Homann wrote: > > > > Hi.. > > > > I've got the same, but I think this is an feature ;-) > > > > I have also no solution, but I think it could have someting todo with > > these entries: > > > > FW_PROTECT_FROM_INTERNAL="yes" > > > > Have You tried here an "NO"? > > > >I have the very same problem and I have FW_PROTECT_FROM_INTERNAL="no" >so that is no solution... > > >bye, >MH >-- >Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt >gegen §1 UWG und §823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O >201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten >sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

1 0

Antwort: [suse-security] SuSE-FW-NO_ACCESS_INT->FWEXT (last attempt)
by Stephan.Joerrens＠gad.de 01 Aug '02

01 Aug '02

Hi.. I've got the same, but I think this is an feature ;-) I have also no solution, but I think it could have someting todo with these entries: FW_PROTECT_FROM_INTERNAL="yes" Have You tried here an "NO"? I can't test it now, because I'am just reinstalling my SuSE system..... regards S. Joerrens

3 2

Secure VPS
by Richard Brenner 01 Aug '02

01 Aug '02

Hi! I have a problem, maybe someone can help me. I need the program called "SecureVPS", which is normally located on the server www.strongcrypto.com <http://www.strongcrypto.com/> , but this server is down. Maybe someone knows another server with this tool on it to download. If you know a server with this tool, please tell me about that. Thanks in advance. Greetings, Bart

1 0

openssh trojan (alert)
by Len Rose 01 Aug '02

01 Aug '02

Not implying that SuSE has this problem (it doesn't) but you may wish to read this: http://lists.netsys.com/pipermail/full-disclosure/2002-August/000734.html

5 7

Re: [suse-security] Ipchains in SuSE 8.0
by GentooRulez 01 Aug '02

01 Aug '02

>Someone know how to run Ipchains in SuSE 8.0?, I know that it run in >kernel 2.2.x, I installed the SuSE 8.0 and it is with kernel 2.4.18 >How can I install kernel 2.2.x in SuSE 8 ??, but I should like to use my >own script writen in 2.2 kernel >sorry the mistakes, What about downloading a 2.2.21 from ftp.kernel.org and compiling that one ??? (approx. 20MB) The better idea is to adapt your script to iptables, in order to be able to use netfilter meachnism of connection tracking [stateful firewall]. There are hints on www.netfilter.org. Yours Michael

4 3

RE: [suse-security] openssh trojan (alert)
by Barry Gill 01 Aug '02

01 Aug '02

The version available on freebsd.org is not trojaned. the md5 checksum shows the tarball that FreeBSD is distributing is the correct 1, and OpenBSD's is different. >to be a little more concrete: about 10 minutes ago I downloaded the tarball of openssh-3.4p1 which is actually available on >ftp.openbsd.org. >I untared it, cd'd to openbsd-compat and did a gcc bf-test.c -o bf-test. After this I did sh bftest > bftest.sh and finally >got a shell script which >contains the same as reported on the link below. So there is definitively a connection attempt to this server - but actually >I do not know >waht it is good for. Could there be some legal reaseon for this?!?

1 0