December 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SUSE 9.0 and nessus 2.0.9 not working out of the box.
by Klun, Jim 10 Dec '03

10 Dec '03

I personally have abaondoned 9.0 for now and have fallen back to an earlier release for my nessus server. Working as expected. -----Original Message----- From: Adam Daniel [mailto:adamd@forensicdata.com.au] Sent: Tuesday, December 09, 2003 8:10 PM To: suse-security(a)suse.com Subject: Re: [suse-security] SUSE 9.0 and nessus 2.0.9 not working out of the box. Is there any word of a pending fix for this problem? Im hesitent to upgrade to 9.0 if i cant use nessus and nmap properly. Thanks Adam On Sun, Dec 07, 2003 at 01:06:37PM -0800, Alex Zimin wrote: > According to many mailing list posts, Nmap and Nessus are broken under root > user. > Unfortunately Nessus does not work well as a non root. > > Is there any workaround, to change root user settings, to get it working? > > Links: > http://cert.uni-stuttgart.de/archive/suse/security/2003/11/msg00092.html > http://linuxtoday.com/news_story.php3?ltsn=2003-11-25-025-26-NW-SW-SS-0004 > > Thanks, > > Alex Zimin > alex(a)inprotect.com > > > -----Original Message----- > From: Klun, Jim [mailto:Jim_Klun@stercomm.com] > Sent: Friday, December 05, 2003 7:02 PM > To: 'suse-security(a)suse.com' > Subject: [suse-security] SUSE 9.0 and nessus 2.0.9 not working out of the > box. > > > Our group is having problems running nessus with SUSE 9.0. > > > > 8.0 works fine with nessus 2.0.9. > > 9.0 does not. > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here -- Technical Consultant ----------------------------------------------------------------------- FORENSIC DATA SERVICES PTY LIMITED http://www.forensicdata.com.au ------------------------------------------------------------------------ The information contained in this e-mail is confidential and is intended solely for the addressee. If you received this e-mail by mistake please notify us immediately and delete all copies of this message. You must not disclose or use in any way the information in the e-mail. It is the responsibility of the recipient to virus scan this e-mail and any attachments included. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Another NAT Question
by Raymond Leach 10 Dec '03

10 Dec '03

-----Original Message----- From: BLeonhardt(a)analytek.de [mailto:BLeonhardt@analytek.de] Sent: 10 December 2003 14:35 To: suse-sec Subject: [suse-security] Another NAT Question HI all, I'm not sure about the PREROUTING chain .. if I say : iptables -t nat -A PREROUTING -i eth1 -o eth0 -p tcp --dport 80 -j DNAT --to-destination 172.16.15.12:8080 is the real source address present or the source address from the router ? cu bruno -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here Before pre-routing - the real source address After pre-routing when the packet hits the FORWARD chain - the source ip of the router.

1 0

SuSE 9.0/Security updates
by Markus Gaugusch 10 Dec '03

10 Dec '03

I have a little question about SuSE 9.0/RPMv4. As an example, I'll assume that the user has updated his ssh daemon with a new version (security update). In previous versions, the old sshd was renamed by the RPM system and the new version was put in its place. The old version was deleted afterwards. If the application was still running, the deleted file was still shown by lsof and marked as (deleted). From that, I could tell whether an old version was still running or not. With SuSE 9.0 this has changed and I can't see the deleted files anymore (at least not with lsof). Therefore I wonder, how I can find out if an old (vulnerable!) version is still running or not. I really don't want to reboot the whole machine for each update or think about the services that may need to be restarted (I have computers to do the thinking for me - at least in this case!). I don't think that the RPM's have a postinstall script or something similar to restart the services? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

3 6

tripwire problem in Suse 9.0
by Selcuk Ozturk 10 Dec '03

10 Dec '03

Has anybody had any luck in configuring tripwire in Suse 9.0? I have created the site and local keys with the twadmin command but every time I try to create the config file with twadmin -m F -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt I get a Segmentation Fault. Any suggestions?

2 1

SUSE 9.0 and nessus 2.0.9 not working out of the box.
by Klun, Jim 10 Dec '03

10 Dec '03

> . > > > Our group is having problems running nessus with SUSE 9.0. > > 8.0 works fine with nessus 2.0.9. > 9.0 does not. > > With identical setup SUSE 9.0. / nessus 2.0.9 finds only localhost when > doing search for port 22/ssh listeners while > 8.0 finds all local ssh instances and reports on version. This is on same > machine, different root partitions. > > Similar problems with other nessus plugins. > > Nmap as installed in 9.0 works fine by itself. Finds all port 22 listeners > in the example above. ( nmap -P0 -p22 <IP range> ) > > Is anyone out there using SUSE 9.0 with nessus? > > Have you seen problems? > > NOTE: we fell back to nessus 2.0.7 - no change. > > > > >

3 2

SuSEfirewall2 Logging Question
by Sturgis, Grant 10 Dec '03

10 Dec '03

Ok, no responses to this question, let me try a different one. Does anyone know why there are items in brackets []? -----Original Message----- From: Sturgis, Grant Sent: Monday, December 08, 2003 11:00 AM To: suse-security(a)suse.com Subject: SuSEfirewall2 Logging Question Greetings List, I have a question that hopefully someone here can clear up for me. I apologize if this is common knowledge, and if someone knows where this particular documentation resides, I would very much appreciate a link. I am getting the following logs from a SuSEfirewall2: Dec 7 23:01:58 mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29751 DF PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] Dec 7 23:01:58 mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29755 DF PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=111 TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] Dec 7 23:02:02 mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29843 DF PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=72 TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] My questions are: Why is the MAC address what appears to be 2 MAC addresses concatenated together? Why is there SRC and DST inside [] and why are they different from the other IPs mentioned? This system's IP address is 192.168.100.242, which appears as the DST in the non-[] text, but is the SRC in the test inside the []. What gives? Any comments are most welcome. Grant Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

2 1

Kernel update (8.1) breaks iptables owner module
by Roger Hayter 09 Dec '03

09 Dec '03

I just updated to the latest kernel patch on SuSE 8.1. Now using 2.4.21-151-athlon. Iptables rules containing -m owner now give "Invalid Argument" when run. A few experiments suggest this is a general failure of the module, not just a particular filter line. It is successfully loaded, and gives a different error message if, for instance, I use --uid-owner with an invalid userid. Does anyone think I can use an rpm of a later version of iptables without breaking SuSEfirewall2? The rpm version of iptables in 8.1 is 1.2.7a-17. Would it be useful to recompile it? Thanks for any advice. -- Roger Hayter

1 1

FYI: Updated SuSE 8.1 with brk() fix - Wireless stopped working...
by Roger Larsson 09 Dec '03

09 Dec '03

Hi, After I updated SuSE 8.1 with the patch I lost my internet connection (802.11b) - that is what I call a security fix! :-) I did a lot of investigations on this - I suspected that my old setting was not completely correct, so it took some time... One really interesting thing is that the interface can receive ping but not send [ipconfig reports TX errors] (I have no firewall on this box). What I found out was that I got updated from a 2.4.19 - it got updated and I think it was not 2.4.19... But since I got SuSE 9.0 in the mail yesterday I tried with it instead, it is 2.4.21 based, still got the same problem... Downgraded the kernel to 8.1 (2.4.19) got it to work again by manually configuring the device. Other info: Earlier attempts did not work with 2.4.22-mh1 since I was on my own I gave up. I got GigaFast 720-AEX (Prism II using orinoco drivers at both ends, the peer is not updated - I am using ad-hoc mode with set_parm3) vers_1 5.0, "INTERSIL", "HFA384x/IEEE", "Version 01.02", "" manfid 0x0156, 0x0002 My suspicion is that the update brought some WLAN updates with it that destroys the send part. /RogerL -- Roger Larsson Skellefteå Sweden

1 0

Firewall blocks strange ports
by Gert Seidl 09 Dec '03

09 Dec '03

Hi list, on my machine (SuSE 8.1, up-to-date by fou4s) SuSE-Firewall2 blocks connections to UDP-services 2742 and 8777 (about 20-30 per minute). 2742 udp/tcp is named tsb2 in /etc/services, 8777 is not listed. Googling showed - tsb2 for port 2742 - "thaliana tryptophan synthase beta-subunit" for tsb2 and - nothing but phone-numbers for 8777 Does anyone know what the hell they are searching for on my machine ?? thx, gert. -- "Es gibt kaum etwas auf der Welt, das nicht irgend jemand etwas schlechter machen und etwas billiger verkaufen könnte. Die Menschen, die sich nur am Preis orientieren, werden die gerechte Beute solcher Machenschaften." (John Ruskin)

1 0

Dial-on-demand
by Giuseppe Potenza 09 Dec '03

09 Dec '03

Hallo, kann mir jemand sagen, ob und wie ich die Einstellungen für dod konfiguriere.. bzw. ob ich mir in den logs die dod-reason anzeigen lassen kann ? gruss giuseppe

1 0