January 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Help with Attack/Worm/???
by Peer Stefan 20 Jan '03

20 Jan '03

Hi Thomas > From: Thomas Langfeld [mailto:opa.thomas@fhtw-berlin.de] > Hi, > > we are running suse 7.3 and apache 1.3.20 with mod_ssl > > Last week it happened: > - webserver down > - apache could not be restarted > - error-log: > '[crit] (98)Address already in use: make_sock: could not bind > to port 443' Try "lsof | grep :https". Or use "netstat -anp" to check which binary locks port 443. You can check whether https is working or not with the following command: # openssl s_client -connect localhost:443 -state -debug GET / HTTP/1.0 > So, lets look, what wwwrun is doing: > - a 'ps aux | grep wwwrun' showed nothing > - but: 'top' and 'uwwwrun' showed some processes 'eggdrop' > running by user > 'wwwrun' > -> maybe a rootkit which replaced '/usr/bin/ps' ??? > - a portscan revealed open tcp-port 6667 Eggdrop is an IRC-daemon. Take a look at http://www.eggheads.org/. It would be a very clumsy rootkit leaving out top ... > > 1. question: > Does anybody know, what's the reason for that ?!? > > We suggested, it could by ssl-worm slapper, but it usually > opens udp-ports > and not tcp 6667 Maybe this is not connected to the attack at all. 6667 is IRC: ircd 6667/tcp # Internet Relay Chat ircd 6667/udp # Internet Relay Chat > > 2. question: > In Apache 1.3.27 all known security-holes are fixed. > > But there is no RPM for suse 7.3. > There is only a package with version 1.3.20-77 > So, we don't know, if in this package all that security-holes > are fixed ? SuSE uses the latest patches to close known bugs. They do not change the major and minor release-numbers (or versions) to maintain package-dependencies. If you go with the last packages all known bugs should be fixed. Have a look at http://www.suse.de/de/security/index.html > The same for mod_ssl / OpenSSL ? Yes. > So, we don't know, when we install the latest Suse-RPM's, are > we protected against the above attack?? You will be protected agains known exploits and known hacks. > Anybody who can answer the questions ? Do you use tripwire? Do you have MD5-sums of your files? Check wich files have changed, especially files in /bin, /sbin, /usr/bin and /usr/sbin. > Thx, > Thomas You're welcome. Stefan

2 1

SuSEfirewall2 on multiple servers but no "firewall"
by Peter Romianowski 20 Jan '03

20 Jan '03

Hi, I will have to install several servers all connected only with a switch and no standalone Firewall-Server. Looks like this: ( | ISP ROUTER | ) | | | SWITCH | | ----------------------- ... | | | SERVER #1 | | SERVER #2 | ... I plan to install SuSEfirewall2 on every server and blocking all traffic from other IP-Adresses than my own range. All servers do only have public IP-Adresses. My Question: 1. Is that feasable? 2. Is that total nuts? 3. Has running the firewall on every server a hard performance impact? 4. If 2.) is true, how would I set up a failsafe setup with 2 SuSEfirewall2 Servers? Many thanks for digging into my humble mind :) Peter

1 0

AW: [suse-security] Help with Attack/Worm/???
by Ulrich Roth 20 Jan '03

20 Jan '03

Hi, > - a portscan revealed open tcp-port 6667 Normally IRC servers use this port. You could try to install ircii and configure your machine as an IRC server and see if you can connect to it. But I think there are also programs that can tell you which executable is bound to which port. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

OT: literature
by mailinglists＠belfin.ch 20 Jan '03

20 Jan '03

Hi this' a little bit OT, so please excuse. I'm looking for a good reading about shell scripting && linux shell commands. Finally I intend to higher the quality of my iptables scripts. Thanks, Philipp

1 0

AW: [suse-security] TIS+Sendmail
by Ulrich Roth 20 Jan '03

20 Jan '03

Hi, > This is my scenario: > > ---------------------------------------------------------(LAN) > | | | > DNS PROXY-SMTP(TIS) EXCHANGE SERVER > 172.16.1.246 172.16.1.247 172.16.1.219 > > > Netperm-table configuration > > # Example smap rules: > # ------------------- > smap, smapd: userid 8 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/fwtk/smapd > smapd: logfile /var/log/smapd > smapd: sendmail /usr/lib/sendmail > smapd: baddir /var/spool/smap/bad > smap: logfile /var/log/tismail > smap: maxrecip 4000 > smap: maxbytes 1048576 > smap: timeout 3600 > > > > DNS configuration > --------------------- > > @ IN SOA sdns.iapser.linux. > hostmaster.sdns.iapser.linux. ( > 29122002 > 86400 > 3600 > 3600000 > > > 86400 > ) > > IN NS sdns.iapser.linux. > IN MX 5 ssmtp.iapser.linux. > > localhost IN A 127.0.0.1 > > sdns IN A 172.16.1.246 > IN MX 5 sdns.iapser.linux. > dns IN CNAME sdns.iapser.linux. > > ssmtp IN A 172.16.1.247 > > servige2 IN A 172.16.1.219 > IN MX 5 servige2.iapser.linux. > exchange IN CNAME servige2.iapser.linux. > > www IN CNAME iapser.linux. > ; > > > mail test > ------------ > > mail.txt= > > To: florenzon(a)ssmtp.iapser.linux ^^^^^^^^^^^^^^^^^^^^^ > From: florenzon(a)sdns.iapser.linux > Subject: Test > > Mail test > Problem: > -------- > SMAP its working, but sendmail not delivery mail to EXCHANGE SERVER, > always delivery to locahost, anyone is the addressee's domain. It looks to me as if you send e-mail to someone whose account exists on a certain host (ssmtp.iapser.linux), and of course then the mail is delivered to that host and not to another one (the Exchange server). Your zone file looks very confusing to me, some things seem not to be okay. And if you send test e-mails, you never should do that as root, because for this special user sendmail normally uses the FQDN after the @ sign and not just only the domain name. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1

Help with Attack/Worm/???
by Thomas Langfeld 20 Jan '03

20 Jan '03

Hi, we are running suse 7.3 and apache 1.3.20 with mod_ssl Last week it happened: - webserver down - apache could not be restarted - error-log: '[crit] (98)Address already in use: make_sock: could not bind to port 443' So, lets look, what wwwrun is doing: - a 'ps aux | grep wwwrun' showed nothing - but: 'top' and 'uwwwrun' showed some processes 'eggdrop' running by user 'wwwrun' -> maybe a rootkit which replaced '/usr/bin/ps' ??? - a portscan revealed open tcp-port 6667 1. question: Does anybody know, what's the reason for that ?!? We suggested, it could by ssl-worm slapper, but it usually opens udp-ports and not tcp 6667 2. question: In Apache 1.3.27 all known security-holes are fixed. But there is no RPM for suse 7.3. There is only a package with version 1.3.20-77 So, we don't know, if in this package all that security-holes are fixed ? The same for mod_ssl / OpenSSL ? So, we don't know, when we install the latest Suse-RPM's, are we protected against the above attack?? Anybody who can answer the questions ? Thx, Thomas

1 0

AW: [suse-security] Re: [OT] [suse-security] Re:[suse-security] SuSEFirewall without NAT
by Ulrich Roth 20 Jan '03

20 Jan '03

Hi, > I set the thread to OT because the thread currently is not > talking about nat. > > > anything similar? Or does Outlook do PGP itself these > > days? Might be worth trying a re-install of Outlook... I'm using Outlook 2000 from Office 2000 SR1 with SP2, and I can't read these mails neither. It gives me some error message, saying something about my security ID. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

splitt inet from the rest..?
by MichaelHoeller＠t-online.de 20 Jan '03

20 Jan '03

Hello, hope that I can bother you with a simlpe question. I would like to make sure that my internet actions can not hurt my system. Would it be helpful when I create a special user for inet and email? Would that help at all b/c this user is in the group users and this group still could hurt my data (ever when I am a different user) or? What would the experts suggest how to setup a system where my private data is save ever when I use the internet and email? I am running SuSE 8.1 with an analog modem and have a callback connection to a differnt server. Thanks a lot for any hint. Michael

2 1

OT: SuSE 7.3 upwards and SecureCRT
by Alexander Bien 19 Jan '03

19 Jan '03

Hi, after years working in the linux/unix administration sector i could never find out how to make SecureCRT use the correct Keymap to fully use Function Keys within SuSE. So here i am, all educated, and still dumb ;) i tried google, i tried the unofficial suse faq, i tried the sdb, i tried the vandyke homepage... i cant belive im the onlyone who cant figure it out :/ Please someone enlighten me, i tried all included keymaps and none work 100%. kind regards, - Alex PS: I know keys work with putty. thx i know my msg is off-topic, please excuse. -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ NEU: Mit GMX ins Internet. Rund um die Uhr für 1 ct/ Min. surfen!

1 0

TIS+Sendmail
by Grupo DIGNITAS 19 Jan '03

19 Jan '03

Friends: This is my scenario: ---------------------------------------------------------(LAN) | | | DNS PROXY-SMTP(TIS) EXCHANGE SERVER 172.16.1.246 172.16.1.247 172.16.1.219 Netperm-table configuration # Example smap rules: # ------------------- smap, smapd: userid 8 smap, smapd: directory /var/spool/smap smapd: executable /usr/local/fwtk/smapd smapd: logfile /var/log/smapd smapd: sendmail /usr/lib/sendmail smapd: baddir /var/spool/smap/bad smap: logfile /var/log/tismail smap: maxrecip 4000 smap: maxbytes 1048576 smap: timeout 3600 DNS configuration --------------------- @ IN SOA sdns.iapser.linux. hostmaster.sdns.iapser.linux. ( 29122002 86400 3600 3600000 86400 ) IN NS sdns.iapser.linux. IN MX 5 ssmtp.iapser.linux. localhost IN A 127.0.0.1 sdns IN A 172.16.1.246 IN MX 5 sdns.iapser.linux. dns IN CNAME sdns.iapser.linux. ssmtp IN A 172.16.1.247 servige2 IN A 172.16.1.219 IN MX 5 servige2.iapser.linux. exchange IN CNAME servige2.iapser.linux. www IN CNAME iapser.linux. ; mail test ------------ mail.txt= To: florenzon(a)ssmtp.iapser.linux From: florenzon(a)sdns.iapser.linux Subject: Test Mail test #> cat mail.txt | /usr/lib/sendmail -bm -t -v verbose florenzon(a)ssmtp.iapser.linux... Connecting to localhost via relay... 220 ssmtp SMTP/smap Ready. >>> EHLO ssmtp.iapser.linux 500 Command unrecognized >>> HELO ssmtp.iapser.linux 250 (ssmtp.iapser.linux) pleased to meet you. >>> MAIL From:<root(a)ssmtp.iapser.linux> 250 <root(a)ssmtp.iapser.linux>... Sender Ok >>> RCPT To:<florenzon(a)ssmtp.iapser.linux> 250 <florenzon(a)ssmtp.iapser.linux> OK >>> DATA 354 Enter mail, end with "." on a line by itself >>> . 250 Mail accepted florenzon(a)ssmtp.iapser.linux... Sent (Mail accepted) Closing connection to localhost >>> QUIT 221 Closing connection This is my /var/log/mail ------------------------- Jan 18 22:10:28 ssmtp sendmail[1116]: h0J1ASs9001116: from=root, size=111, class=0, nrcpts=1, msgid=<200301190110.h0J1ASs9001116(a)ssmtp.iapser.linux>, relay=root@localhost Jan 18 22:10:28 ssmtp sendmail[1116]: h0J1ASs9001116: to=florenzon(a)ssmtp.iapser.linux, ctladdr=root (0/0), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30084, relay=localhost [127.0.0.1], dsn=2.0.0, stat=Sent (Mail accepted) Problem: -------- SMAP its working, but sendmail not delivery mail to EXCHANGE SERVER, always delivery to locahost, anyone is the addressee's domain. Any help? Thanks in advance Ernesto

1 0