January 2003 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

problem with SQUID
by payam payami 02 Apr '03

02 Apr '03

Hi, I use suse 7.3 Internal network connect to internet by setting port 3128 in IE but when i set in squid.conf for authenticate_program that get windows login for users, IE don't get any windows and Internal network (clients) connect to internet normally without login I set these options in squid.conf: authenticate_program /usr/sbin/pam_auth acl password proxy_auth payam acl users src 192.168.1.0/255.255.252.0 http_access allow users http_access allow password Is here any problem with this configuration that IE can't get windows login when want to browsing? Thanks for your help, Payam __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

7 6

Login Problems
by Richard Ibbotson 03 Feb '03

03 Feb '03

Hi Got a problem with an SuSE 8.1server which is runing in console mode. No X-windows. After running harden_suse I find that I cannot change the password and log back in again. I followed Roman Drahtmueller's advice which appeared on the SuSE security list back on the 9th of October last year.... >Please "touch /etc/rc.config" to work around this. >This is a bug - depending on the selection of packages on your system >it can happen that said file does not exist any more. It slipped >through last time. This worked for me and I was able to run ./harden_suse. However, on re-booting I now find that I can't log back in again. The password is rejected and if I become a user and then try to do 'su root' I find that once again the root password is rejected. Looking in /var/log/messages I see that my login messages which tell me that someone has tried to login reveal this .... "cannot open login.defs [Permission denied]" Anyone suggest a way out of this ? Perhaps I need to remove harden_suse and start again ? -- Thanks Richard www.sheflug.co.uk

4 5

I need vulnerability analysis tool, help me.
by 정정모 02 Feb '03

02 Feb '03

Hello, First, I'm very sorry for my poor English. We are building internet banking system with IBM zSeries and SuSE Linux. But Now, We need internal vulnerability analysis tool such as ISS Internet Scanner, Symantec ESM. But they did not support SuSE Linux for IBM zSeries. Do you know any other commercial vulnerability analysis tool support SuSE linux for zSeries? If any, Please help me with your advice. I'm very sorry for bothering you with this and looking forward to hearing from you soon. With my best wishes for your prosperity. Thank you in advance. --------------------------------------- Jeongl, Jeong-Mo Solution Service LAC Korea, Inc. Tel: +82-2-3444-2355 Fax: +82-2-3444-6945

3 2

SuSEfirewall2 & Checkpoint software
by T. Ermlich 01 Feb '03

01 Feb '03

Hello there, I've got a question, and I found no answer related to this topic - or maybe I'm simply too stupid and didn't get it .... Short story: Home LAN - SuSEfirewall2 System (SuSE 8.1 via DSL) - internet - Checkpoint FW - Companies LAN Long story: Well, my employer has a Checkpoit FW running to protect the companies LAN. We all got so called tokens (looks like an calculator) and some software to be installed on our PCs. The software is called SecuRemote. At home I have a small LAN (one SuSE 8.1 acting as a gateway, 3 MS based clients). I installed the software, checked the Checkpoint website for information how to configure an iptables fw, and I think I did it: the neccessary ports are udp 50, udp 51, udp 500 & udp 2746. So I added the lines: FW_FORWARD="212.212.212.212/32,192.168.10.100/24,udp,50 212.212.212.212/32,192.168.10.100/24,udp,51 \ 212.212.212.212/32,192.168.10.100/24,udp,500 212.212.212.212/32,192.168.10.100/24,udp,2746" FW_FORWARD_MASQ="212.212.212.212/32,192.168.10.100/24,udp,50 212.212.212.212/32,192.168.10.100/24,udp,51 \ 212.212.212.212/32,192.168.10.100/24,udp,500 212.212.212.212/32,192.168.10.100/24,udp,2746" (In both cases 212.212.212.212 is just a place holder!!! ... not the real ip adress.) But it does not work ...... no VPN connection is established between my MS client and a system on the companies LAN. When I connect to the internet directly (eg. via an ISDN dial-up connection) it works fine. Well, one of my thoughts was to modify the MTU/MRU values - but setting them eg. to 1404 didn't solve it. Has anyone around there an idea? Can I use the SuSEfirewall2 for this? Thanks in advance!!!! c y Torsten

2 2

rbash and sftp
by Thorsten Marquardt 31 Jan '03

31 Jan '03

Hi, I tried to use rbash to restrict a users capabilities but need to allow filetransfer (sftp). Unfortunatly the sftp-session is termianated immediately. Is there a chance to enable this combination? Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

5 5

FTP and firewall
by Wouter 31 Jan '03

31 Jan '03

Hi, I have a FTP running. and now i have a problem now whit it. . I can login to my FP server i see this: ftp ftp.server.com Connected to ftp.server.com (62.216.9.174). 220 ProFTPD 1.2.8rc1 Server (ftp.server.com) [phyton.addrenaline.com] Name (ftp.server.com:wouter): wouter 331 Password required for wouter. Password: 230 User wouter logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (62,216,9,174,9,218). receive aborted waiting for remote to finish abort ftp> bye 221- bye 221 When i stop my firewall then is there now problem. /var/log/messages say the follow: Jan 31 11:02:12 phyton proftpd[19269]: phyton.addrenaline.com (sonic.nl3gta.nl[217.67.230.34]) - FTP session opened. Jan 31 11:02:18 phyton proftpd[19269]: phyton.addrenaline.com (sonic.nl3gta.nl[217.67.230.34]) - USER wouter: Login successful. Jan 31 11:02:18 phyton kernel: filtered on OUTPUT IN= OUT=eth1 SRC=62.216.9.174 DST=194.109.5.241 LEN=100 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=41 Jan 31 11:02:20 phyton kernel: filtered on INPUT IN=eth1 OUT= MAC=00:a0:d2:16:f7:93:00:10:67:00:f8:8e:08:00 SRC=217.67.230.34 DST=62.216.9.174 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=24022 DF PROTO=TCP SPT=47561 DPT=2531 WINDOW=5840 RES=0x00 SYN URGP=0 Jan 31 11:02:26 phyton proftpd[19269]: phyton.addrenaline.com (sonic.nl3gta.nl[217.67.230.34]) - FTP session closed. and /var/log/proftpd.paranoid_log sonic.nl3gta.nl UNKNOWN nobody [31/Jan/2003:11:03:39 +0100] "USER wouter" 331 - sonic.nl3gta.nl UNKNOWN wouter [31/Jan/2003:11:03:42 +0100] "PASS (hidden)" 230 - sonic.nl3gta.nl UNKNOWN wouter [31/Jan/2003:11:03:42 +0100] "SYST " 215 - sonic.nl3gta.nl UNKNOWN wouter [31/Jan/2003:11:03:44 +0100] "PASV " 227 - sonic.nl3gta.nl UNKNOWN wouter [31/Jan/2003:11:03:54 +0100] "QUIT " 221 - Then here my firewall settings to open the ftp poorts here is $FTP_SERVER set to yes somewhere else in the config file ;) ## ftp server openstellen voor buitenwereld if [ $FTP_SERVER = yes ] ; then $IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp \ -s $ANYWHERE -d $IPADDR -m state --state NEW,ESTABLISHED \ --source-port $UNPRIVPORTS --destination-port 21 -j ACCEPT $IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \ --source-port 21 --destination-port $UNPRIVPORTS -j ACCEPT ## ftp server - active $IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp \ -s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED ! --syn \ --destination-port 20 -j ACCEPT $IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \ --source-port 20 -j ACCEPT ## ftp server - passive $IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp \ -s $ANYWHERE -d $IPADDR -m state --state ESTABLISHED,RELATED \ --destination-port $UNPRIVPORTS -j ACCEPT $IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \ -s $IPADDR -d $ANYWHERE -m state --state ESTABLISHED,RELATED \ --source-port $UNPRIVPORTS -j ACCEPT fi Have someone a idea what is wrong ? i have no idea he have work for a few moths and i have nothing change in my config or firewall files. Thanks Wouter

1 0

RE: [suse-security] How can I stop the Xserver listening on port 6000?
by try88out＠netscape.net 31 Jan '03

31 Jan '03

try88out(a)netscape.net wrote: >On my Computer I have installed a standard SuSE Linux 8.1 Pro with Grafik-Login. >I want to detach the binding of my X-Server to an IP-Socket or restirct it to some IP-Adresses (localhost, ...) > >In the config-file "/etc/X11/xdm/XServers" I have changed ":0 local /usr/X11R6/bin/X :0 vt07" >to ":0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp". But nothing happens. >After a reboot the X-Server ist still listening on port 6000. > >Does any one knows how I can solve the problem? > >Wolfgang > The solution for my problem is very simple: I have to change the file "/etc/opt/kde3/share/config/kdm/Xservers" and not the file "/etc/X11/xdm/XServers". It works fine! ;-) Does any one know how I can the binding of my X-Server to only some IP-Adresses (localhost, ...)? Wolfgang __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

How can I stop the Xserver listening on port 6000?
by try88out＠netscape.net 30 Jan '03

30 Jan '03

On my Computer I have installed a standard SuSE Linux 8.1 Pro with Grafik-Login. I want to detach the binding of my X-Server to an IP-Socket or restirct it to some IP-Adresses (localhost, ...) In the config-file "/etc/X11/xdm/XServers" I have changed ":0 local /usr/X11R6/bin/X :0 vt07" to ":0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp". But nothing happens. After a reboot the X-Server ist still listening on port 6000. Does any one knows how I can solve the problem? Wolfgang __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

3 2

RE: [suse-security] Apache with mod_frontpage
by Hemsley, Trevor 30 Jan '03

30 Jan '03

Not as easy as that on versions prior to 8.1* since mod_frontpage is all packaged up as part of apache_contrib.rpm so if you want any of the other 26 mod_* packages that are listed as being a part of this then you get frontpage extension installed when you're not looking. Ok, it may not be enabled in the config file but it's installed and on the system. * I can't check 8.1 since I don't have that release but this is true for 8.0 and 7.3 that I have checked. Is it different in 8.1? -----Original Message----- From: Steffen Dettmer [mailto:steffen@dett.de] Sent: Thu 1/30/2003 12:49 AM To: suse-security(a)suse.com Cc: Subject: Re: [suse-security] Apache with mod_frontpage * Olsson Mattias wrote on Wed, Jan 29, 2003 at 16:17 +0100: > Can somebody pls tell me how to enable the mod_frontpage for > apache within SuSE 8.1. You ask how to *enable* frontpage on a security list?! "rpm -e mod_frontpage" *may* be sufficient to *disable* it, BTW :) SCNR. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Help with Attack/Worm/???
by Thomas Langfeld 30 Jan '03

30 Jan '03

Hi, > Hi Thomas, > > Something very similair happended to me some weeks ago. We traced it to > be a vicious trojan, that replaced my system ls, ps and other such vital > commands. > > If I guess right your www process is running, but the 'ps aux' that you > run won't show it. No. httpd did NOT run -> and we couldn't restart it. Thats why we looked for suspucious activitites in our system. If httpd would have run as usual, propaply till today we wouldn't know, whats going on. > The www process is probably supplying data to the > hacker through the trojan. Yes, an irc-daemon was started as user wwwrun. And "top" revealed this. > > In my particular attack the hacker had a keyboard sniffer, which > tranmitted my root passwd etc through a tcp connection to a site > somewhere in Russia. Also sited was an ftp host in Belgium which was > getting some of the data that was being sniffed out. I also found some hints. In /var/tmp/ the attacker created two directories: "..." and " " (one blank) there i found many tools and sources. - many irc-tools - a scanner, which scans other hosts for apache/ssl-vulnerabilities - apache/ssl-exploit - some tools to hide processes and a .bash_history for user wwwrun, so i was able to reconstruct many of the activities. if somebody ist interested in receiving the history or the tools, mail me. > > I was running suse 7.3 w/ apache+mod_ssl, and disregarded to apply the > security patch to cover a known vulnerability. yeah, shit happens ... > > Ended up changing the hard-drive and rebuilding the server! yes. Thomas > > pm > > Thomas Langfeld wrote: > > >Hi, > > > >we are running suse 7.3 and apache 1.3.20 with mod_ssl > > > >Last week it happened: > >- webserver down > >- apache could not be restarted > >- error-log: > >'[crit] (98)Address already in use: make_sock: could not bind to > port 443' > > > >So, lets look, what wwwrun is doing: > >- a 'ps aux | grep wwwrun' showed nothing > >- but: 'top' and 'uwwwrun' showed some processes 'eggdrop' > running by user > >'wwwrun' > >-> maybe a rootkit which replaced '/usr/bin/ps' ??? > >- a portscan revealed open tcp-port 6667 > > > >1. question: > >Does anybody know, what's the reason for that ?!? > > > >We suggested, it could by ssl-worm slapper, but it usually opens > udp-ports > >and not tcp 6667 > > > >2. question: > >In Apache 1.3.27 all known security-holes are fixed. > > > >But there is no RPM for suse 7.3. > >There is only a package with version 1.3.20-77 > >So, we don't know, if in this package all that security-holes are fixed ? > > > >The same for mod_ssl / OpenSSL ? > > > >So, we don't know, when we install the latest Suse-RPM's, are we > protected > >against the above attack?? > > > >Anybody who can answer the questions ? > > > >Thx, > >Thomas > > > > > > > > > > >

1 0

Apache with mod_frontpage
by Olsson Mattias 30 Jan '03

30 Jan '03

Hi all! Can somebody pls tell me how to enable the mod_frontpage for apache within SuSE 8.1. I have apache installed, and the mod_frontpage, and /usr/local/frontpage .... I rather have the MS ppl run there stuff on an real OS:) Mattias Olsson IT Consultant Communication Solutions mattias.olsson(a)siemens.com Phone: +46 8 730 6573 Mobile: +46 70 629 1071

3 2

SuSEfirewall2 config question
by Jaap Noordzij 29 Jan '03

29 Jan '03

Hi, How do I get access to my own webserver from internal via the normal DNS lookup http://mydomain.com ? My setup: FW_DEV_EXT="eth2" is external, masqueraded to my IP adress FW_DEV_DMZ="eth1" is dmz, 10.0.0.0/8 with a webserver in the dmz FW_DEV_INT="eth0" is internal 192.168.1.0/24 FW_ROUTE=yes FW_MASQUERADE="yes" Internal network has full access to internet: FW_MASQ_NETS="192.168.1.0/24" External traffic is allowed to the webserver: FW_FORWARD_MASQ="0/0,10.0.0.2,tcp,80 When I add a rule to FW_FORWARD="192.168.1.0/24,10.0.0.2,tcp,80" as suggested with option 14 I can get access from internal to webserver by going directoy to the 10.0.0.2 addres but this is not what I want. The explanation with Conf option 14 does not help me out here . Log says: SuSE-FW-ACCCESS_DENIED_INT - jaap noordzij smokejumper at chello.nl

2 1

RE: [suse-security] MSSQL-Attack: What can I do?
by GarUlbricht7＠netscape.net 29 Jan '03

29 Jan '03

Hi Mario: I just tried some downloads (10:00 PM PTZ) and all SuSE mirrors that I tried "timed out." Internet health Report <http://www.internetpulse.net/> now shows a number of US backbone providers including At&T going critical (in the red zone - ) so you are not alone. SQLsecurity.com is recommending blocking access to TCP 1433 and UDP 1434 from all un-trusted clients which it appears you are doing by your rules. You didn't say if you have a SQL Server inside your firewall. Do you? If so you might look at SQLsecurity.com Sorry I can't be more helpfull :(( ************* "Mario Neubert" <mario_neubert(a)gmx.de> wrote: >Hello List, > >Just I have seen the graphics of my server with MRTG. >This fu..... crackers. My system is stable but the trafic is very high. >The rules with udp/tcp - 1433/1434 does blocking the unicast traffic but >also multicast trafic comes in and I don't know what can I do against >this. >It seems to be the MSSQL-Worm on a multicast adress. > >List, have anyone any idea? Many thanks.... > >Mario > > > > >PS: > >tcpdump> 217.175.233.161.1181 > 224.41.16.185.1434: udp 376 > >I have inserted following rules to SuSEfirewall > >DROP all -- 0.0.0.0/0 224.0.0.0/8 >DROP all -- 217.175.233.161 0.0.0.0/0 >DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1433 >DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1434 >DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1433 >DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1434 > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

5 6

SuSEfirewall2 - outgoing traffic
by Dominik Sk?adanowski 29 Jan '03

29 Jan '03

Hello. I have firewall installed on server, incoming traffic is filtering very good. I have everything clear written in logs. But, last time I thought about my outgoing traffic. How can I check/log which packets outgo my server and which server proccesses communicate with Internet? I have one eth0 - external device. -- ----------------------------------------------------------------- Dominik Skladanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl -----------------------------------------------------------------

2 1

Chroot services
by Brett Stevens 29 Jan '03

29 Jan '03

Hi all, Firstly sorry if this has been covered earlier. I could not find any informaiton previously posted. Im trying to find out info on chrooting both named bind and postfix. on suse 8 I notice that both services have a chroot sysconfig variable which has been set to yes but there appears to be no actual call to the chroot binary. I have tried this using dhcpd which works a treat with the process list clearly showing that the daemon is running under a chroot env etc this does not occur for both named and postfix. Any ideas thanks Brett Stevens

4 4

MSSQL-Attack: What can I do?
by Mario Neubert 29 Jan '03

29 Jan '03

Hello List, Just I have seen the graphics of my server with MRTG. This fu..... crackers. My system is stable but the trafic is very high. The rules with udp/tcp - 1433/1434 does blocking the unicast traffic but also multicast trafic comes in and I don't know what can I do against this. It seems to be the MSSQL-Worm on a multicast adress. List, have anyone any idea? Many thanks.... Mario PS: tcpdump> 217.175.233.161.1181 > 224.41.16.185.1434: udp 376 I have inserted following rules to SuSEfirewall DROP all -- 0.0.0.0/0 224.0.0.0/8 DROP all -- 217.175.233.161 0.0.0.0/0 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1433 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1434 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1433 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1434

1 0

Blocking IP addresses
by Jaap Noordzij 28 Jan '03

28 Jan '03

Hi, How can I block IP addresses completely from accessing my fw in SuSEfirewall2 configuration ? -- jaap noordzij smokejumper at chello.nl

3 4

AW: [suse-security] Strange behaviour ...
by Stingl, Martin 28 Jan '03

28 Jan '03

Hi, > I have a SUSE 7.2 machine, with running samba and mysql. > > And as the machine did not make any move this morning (but was still > running)I had to (hard-)reboot it. > which kernel version do you use? I've got a similar problem some months ago using the originial kernel of SuSE 7.2. I've compiled a new kernel from kernel.org and everything was okay. Bye, Martin Stingl

1 0

Strange behaviour ...
by Martin Schichl 28 Jan '03

28 Jan '03

Hi! Has anyone had something similar before? I have a SUSE 7.2 machine, with running samba and mysql. And as the machine did not make any move this morning (but was still running)I had to (hard-)reboot it. Now I've found, that there has not been written anything to the harddisks since Friday noon, although there have been opened, changed and saved some files from the Windows-Boxes and there have been changes to the MySQL databases ... (!!! even yesterday and even one file saved on saturday have been opend and changed yesterday !!!) But after the reboot today everything since Friday noon has been gone ... The message-logfile stopped on Friday with a line of @@@@@@@@ and begins this morning again. Is it possible that the linux box had all this change in the files (and in the SQL database) in its RAM and did not write it back to disk? OK I know this with MySQL, but therefore I do a flush tables 4 times a day ... even this has been ignored ... And the worst thing is, that linux and the windows-boxes did not give any error-messages ... Any idea??? ThanXs, Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

3 3

squid authentication
by Markus Feilner 28 Jan '03

28 Jan '03

Hello List, Sorry for the german mail before - I forgot this is an English list I am running Squid 2.4 with ldap_group_auth in a Windows active Directory Network. It works fine, Clients that are in the WWW_Users group can access the proxy, others can't. What we don't like is: Every user has to authenticate himself actively before accessing the proxy with login/password in a small authentication window. Can't Squid use the authentication data that windows provides? because the user is already logged in in the network, and even windoze sends login/password data, or doesn't it? Thanks! Markus -- Mit freundlichen Grüßen Markus Feilner May you always grok in fullness! Beachten Sie bitte unsere neue Email-Adresse! ------------------------------------------------------------------------------------------------- Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

5 4

Re: [suse-security] squid authentication
by GarUlbricht7＠netscape.net 28 Jan '03

28 Jan '03

Markus: Steffen Dettmer <steffen(a)dett.de> when he wrote the following (see below) said it better than me, but I agree with him. Users tend to complain, but if they use their passwords a lot they memorize them, and just like showing your passport when you cross a border it becomes no big deal (Oh, and my System Admin makes me re-enter mine for similar reasons to what Steffen wrote.) ~Gar >* Raymond Leach wrote on Mon, Jan 27, 2003 at 16:02 +0200: >> Squid supports authentication via helper programs. I'm sure if you look >> hard enough on the net you can find one that will do SMB (windows) >> authentication. > >I don't think that this was the question. He told, the >authentication works, but the users needs to reenter the >password. Well, and maybe the users enter their windows password >in the standard proxy authentication window with basic >authentication - which is transmitted in clear text - even worse, >now there is no need to attack a DC server but a simple traffic >logger can retrieve passwords (you may take a look at >http://sws.dett.de/squid-IP_AUTH.shtml for details ;)). > >Anyway, I cannot answer the question, but I would recommended not >to try so. If a browser can get such important information, >browser attacks like XSS and such would become much more >efficient (but maybe Windows even supports such insecure doing >:)). I would better look how this could be prevented and I >suggest not to transfer such sensitive information in clear to >the proxy. > > >oki, > >Steffen > -- __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

3 2

How can you be sure ...
by Martin Schichl 28 Jan '03

28 Jan '03

Hi - once again ... Sorry, but I want to argue this theme once more, as I think it IS a security problem ... How can you be sure, that the data you have sent to your machine (- the files you have changed on your machine -) are REALLY (not just virtually) written to the harddisk? How can you proof whether your data is on your HDD physically or are just kept in your RAM, because your system cannot write to the HDD for an longer period of time? Is there any command like flush in mysql where you can be sure all data are written to your HDD? Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

2 1

Firewall with Iptables
by Roland T�rk 27 Jan '03

27 Jan '03

Hello, Sorry, my English is not so good! I have write my Firewall with Iptables.I can connect an FTP Server but not make a ls or dir. linux:~ # ftp ftp.suse.com Connected to ftp.suse.com (217.9.113.66). 220 "Welcome to the SuSE ftp server: Please login as user 'ftp'" Name (ftp.suse.com:root): ftp 331 Please send your email address as a password. Password: 230-+----------------------------------------------------------------+ 230-| Welcome to the SuSE Linux FTP archives in Nürnberg Germany | 230-+----------------------------------------------------------------+ 230-+------------------------------+ +------------------------------+ 230-| SuSE Inc. | | SuSE GmbH | 230-| 318 Harrison St. | | Deutschherrnstr. 15-19 | 230-| Oakland, CA 94607 | | 90429 Nuernberg | 230-| USA | | Germany | 230-+------------------------------+ +------------------------------+ 230-| Tel: +1-510-628-3380 | | Tel: +49-911-740530 | 230-| FAX: +1-510-628-3381 | | FAX: +49-911-7417755 | 230-+------------------------------+ +------------------------------+ 230-| http://www.suse.com/ | | http://www.suse.de/ | 230-+------------------------------+ +------------------------------+ 230-Please make sure to read pub/INDEX before sending mail to 230-ftpadmin(a)suse.com 230- 230-User limit: 600 - consider using a mirror-site: 230-http://www.suse.de/en/support/download/ftp/int_mirrors.html (Int.) 230-http://www.suse.de/en/support/download/ftp/germ_mirrors.html (DE) 230- 230-Users from Europe (in particular German universities): 230-ftp://ftp.gwdg.de/pub/linux/suse/ 230-ftp://ftp.leo.org/pub/comp/os/unix/linux/suse/suse/ 230-ftp://ftp.uni-kl.de/pub/linux/suse/ 230- 230-If you are experiencing any problems with this server, please email 230-ftpadmin(a)suse.com. 230- 230 Login successful. Have a lot of fun. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 200 PORT command successful. Consider using PASV. -------------------------------------------------- -------------------------------------------------- -----snip------ #My Firewall config for FTP # FTP OUT Control-Connection iptables -A OUTPUT -p TCP --sport $p_high --dport ftp -j ACCEPT iptables -A INPUT -p TCP --dport $p_high --sport ftp ! --syn -j ACCEPT # FTP OUT Passive Data-Connection iptables -A OUTPUT -p TCP --sport $p_high --dport $p_high -j ACCEPT iptables -A INPUT -p TCP --dport $p_high --sport $p_high ! --syn -j ACCEPT # MASQUERADING iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE echo "1" > /proc/sys/net/ipv4/ip_forward echo "1" > /proc/sys/net/ipv4/ip_dynaddr iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INT -o $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p ICMP --icmp-type echo-request -j ACCEPT iptables -A FORWARD -o $EXT -p ICMP --icmp-type echo-request -j ACCEPT iptables -A FORWARD -o $EXT -m state --state NEW -p TCP --sport $p_high --dport ftp -j ACCEPT iptables -A FORWARD -o $EXT -m state --state NEW -p TCP --sport $p_high --dport $p_high -j ACCEPT -----snap----- ---------------------------------------------------------------------- ---------------------------------------------------------------------- tcpdump -i ippp0 19:59:13.290242 217.4.250.8.filenet-tms > 213.95.15.193.domain: 2909 A? ftp.suse.com. (30) (DF) 19:59:13.345807 213.95.15.193.domain > 217.4.250.8.filenet-tms: 2909* 1/2/2 A 217.9.113.66 (132) [tos 0x10] 19:59:13.347190 217.4.250.8.35608 > 217.9.113.66.ftp: S 926670463:926670463(0) win 5840 <mss 1460,sackOK,timestamp 52220628 0, 19:59:13.447849 217.9.113.66.ftp > 217.4.250.8.35608: S 840322402:840322402(0) ack 926670464 win 32120 <mss 1460,sackOK,timest 19:59:13.447945 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 1 win 5840 <nop,nop,timestamp 52220638 2286511272> (DF) 19:59:13.518270 217.9.113.66.ftp > 217.4.250.8.35608: P 1:249(248) ack 1 win 32120 <nop,nop,timestamp 2286511282 52220638> (DF 19:59:13.518367 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 249 win 6432 <nop,nop,timestamp 52220645 2286511282> (DF) [tos 0x1 19:59:13.518817 217.4.250.8.35608 > 217.9.113.66.ftp: F 1:1(0) ack 249 win 6432 <nop,nop,timestamp 52220645 2286511282> (DF) [ 19:59:13.525785 217.9.113.66.ftp > 217.4.250.8.35608: F 249:249(0) ack 1 win 32120 <nop,nop,timestamp 2286511282 52220638> (DF 19:59:13.526164 217.4.250.8.35608 > 217.9.113.66.ftp: . ack 250 win 6432 <nop,nop,timestamp 52220646 2286511282> (DF) [tos 0x1 19:59:13.572175 217.9.113.66.ftp > 217.4.250.8.35608: . ack 2 win 32120 <nop,nop,timestamp 2286511290 52220645> (DF) 19:59:20.501533 217.4.250.8.35609 > 217.9.113.66.ftp: S 933158888:933158888(0) win 5840 <mss 1460,sackOK,timestamp 52221343 0, 19:59:20.551516 217.9.113.66.ftp > 217.4.250.8.35609: S 856735184:856735184(0) ack 933158889 win 32120 <mss 1460,sackOK,timest 19:59:20.551613 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1 win 5840 <nop,nop,timestamp 52221348 2286511987> (DF) 19:59:20.650476 217.9.113.66.ftp > 217.4.250.8.35609: P 1:67(66) ack 1 win 32120 <nop,nop,timestamp 2286511993 52221348> (DF) 19:59:20.650579 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 67 win 5840 <nop,nop,timestamp 52221358 2286511993> (DF) [tos 0x10 19:59:24.856106 217.4.250.8.35609 > 217.9.113.66.ftp: P 1:11(10) ack 67 win 5840 <nop,nop,timestamp 52221778 2286511993> (DF) 19:59:24.896293 217.9.113.66.ftp > 217.4.250.8.35609: . ack 11 win 32120 <nop,nop,timestamp 2286512422 52221778> (DF) 19:59:24.910156 217.9.113.66.ftp > 217.4.250.8.35609: P 67:118(51) ack 11 win 32120 <nop,nop,timestamp 2286512422 52221778> (D 19:59:24.910224 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 118 win 5840 <nop,nop,timestamp 52221784 2286512422> (DF) [tos 0x1 19:59:26.198941 217.4.250.8.35609 > 217.9.113.66.ftp: P 11:25(14) ack 118 win 5840 <nop,nop,timestamp 52221913 2286512422> (DF 19:59:26.261343 217.9.113.66.ftp > 217.4.250.8.35609: P 118:190(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.261425 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 190 win 5840 <nop,nop,timestamp 52221919 2286512557> (DF) [tos 0x1 19:59:26.277847 217.9.113.66.ftp > 217.4.250.8.35609: P 190:262(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.277920 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 262 win 5840 <nop,nop,timestamp 52221920 2286512557> (DF) [tos 0x1 19:59:26.294356 217.9.113.66.ftp > 217.4.250.8.35609: P 262:334(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.294424 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 334 win 5840 <nop,nop,timestamp 52221922 2286512557> (DF) [tos 0x1 19:59:26.310864 217.9.113.66.ftp > 217.4.250.8.35609: P 334:406(72) ack 25 win 32120 <nop,nop,timestamp 2286512557 52221913> ( 19:59:26.310932 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 406 win 5840 <nop,nop,timestamp 52221924 2286512557> (DF) [tos 0x1 19:59:26.521730 217.9.113.66.ftp > 217.4.250.8.35609: P 406:1771(1365) ack 25 win 32120 <nop,nop,timestamp 2286512563 52221919 19:59:26.521806 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1771 win 8190 <nop,nop,timestamp 52221945 2286512563> (DF) [tos 0x 19:59:26.523495 217.4.250.8.35609 > 217.9.113.66.ftp: P 25:31(6) ack 1771 win 8190 <nop,nop,timestamp 52221945 2286512563> (DF 19:59:26.599132 217.9.113.66.ftp > 217.4.250.8.35609: P 1771:1790(19) ack 31 win 32120 <nop,nop,timestamp 2286512590 52221945> 19:59:26.638231 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1790 win 8190 <nop,nop,timestamp 52221957 2286512590> (DF) [tos 0x 19:59:29.151684 217.4.250.8.35609 > 217.9.113.66.ftp: P 31:56(25) ack 1790 win 8190 <nop,nop,timestamp 52222208 2286512590> (D 19:59:29.208498 217.9.113.66.ftp > 217.4.250.8.35609: P 1790:1841(51) ack 56 win 32120 <nop,nop,timestamp 2286512852 52222208> 19:59:29.208584 217.4.250.8.35609 > 217.9.113.66.ftp: . ack 1841 win 8190 <nop,nop,timestamp 52222213 2286512852> (DF) [tos 0x 19:59:29.208840 217.4.250.8.35609 > 217.9.113.66.ftp: P 56:62(6) ack 1841 win 8190 <nop,nop,timestamp 52222213 2286512852> (DF 19:59:29.257378 217.9.113.66.ftp-data > 217.4.250.8.35610: S 870057160:870057160(0) win 32120 <mss 1460,sackOK,timestamp 22865 19:59:29.325064 217.9.113.66.ftp > 217.4.250.8.35609: . ack 62 win 32120 <nop,nop,timestamp 2286512860 52222213> (DF) 19:59:32.304569 217.9.113.66.ftp-data > 217.4.250.8.35610: S 870057160:870057160(0) win 32120 <mss 1460,sackOK,timestamp 22865 Which Ports must I open? Thanks for Your config or Help Roland

4 3

Secure root alias logins
by keith.anthony.roberts＠bigfoot.com 27 Jan '03

27 Jan '03

Hi again everyone! Thanks to ALL that responded to my query on changing the name for the root user. Some very interesting replies indeed! I have a new installation of SuSE 8.1 professional to do ASAP. May try some of your suggestions then, with a clean installation. I'll keep you posted (if you'll pardon the pun!) Thanks again Keith Roberts Surely it would be more difficult for any attacker to break into Linux if they did not know the username for the root account? I just wondered if it was possible to make root logins MUCH more secure with the following suggestions. When a NEW installation of Linux is done, allow the root user to select their -*OWN*- unique username for the root account in YaST, instead of the default 'root' username. Disallow the use of username 'root' for ALL root superuser logins. When a superuser logs-in they provide their unique username that they choose when installing Linux eg. under YaST. Each login program would need to be modified to reject the username of 'root'. The login program then checks say, password file for the unique root alias name (provided by superuser at installation time) and matches this up with the root account. If a matching root alias and a valid password for that alias name are present, then the superuser gets logged into the root account. The root account need not be touched in any way. The superuser alias name is just used as a 'WRAPPER' to protect the username of root for login purposes only. Would this be feasable to implement? This may have been implemented already. If it has - please let me know. Thankyou - Keith Roberts.

3 4