February 2003 - openSUSE Security - openSUSE Mailing Lists

(OT) RUXCON - 12/13 April, 2003. SYDNEY, Australia
by Adam Daniel 26 Feb '03

26 Feb '03

Anyone in Australia or the asia pacific region may want to check out this, I'll be there for sure. ----- Forwarded message from RuxCon <announce-con(a)ruxcon.org> ----- RUXCON - 12/13 April, 2003. SYDNEY, Australia. http://www.ruxcon.org RUXCON is a conference organized by the (sometimes underground) Australian security community. It is an attempt to bring together the individual talents of the Australian computer security sector, through live presentations, workshops and demonstrations, free of charge to the larger public community. RUXCON will be a two day conference. Live presentations and workshops will cover a full range of defensive and offensive security issues, varying from unpublished research to required reading for the public community. The presentation track will allocate one hour time slots per speaker. The workshops will be more hands-on, interactive, and in a less formal format. Activities and competitions will be available for entry by the public participants present at the conference. The venue of the conference is hosted by the UNIVERSITY OF TECHNOLOGY, SYDNEY [1]. It is for this reason in conjunction with the Australian computer security community, that the public has access, at no charge, to a world class security conference. For more information please visit http://www.ruxcon.org A call for papers is currently in progress. The speaker list will be finalized on the 1st March, 2003. All presentation submissions or inquiries should be sent to staff-con(a)ruxcon.org. Workshops are currently being organised, however members of the public are able to propose their own workshops. To do so, please send an e-mail to staff-con(a)ruxcon.org with your proposal. Before sending an inquiry please view the FAQ page for presentations and workshops at http://www.ruxcon.org/faq/ [1] http://www.uts.edu.au UTS is the venue, RUXCON is the conference. RUXCON is independent of UTS. The views expressed by RUXCON or at RUXCON are not endorsed or representing the views of UTS. -- RUXCON ----- End forwarded message ----- -- Technical Consultant ----------------------------------------------------------------------- FORENSIC DATA SERVICES PTY LIMITED http://www.forensicdata.com.au ------------------------------------------------------------------------ The information contained in this e-mail is confidential and is intended solely for the addressee. If you received this e-mail by mistake please notify us immediately and delete all copies of this message. You must not disclose or use in any way the information in the e-mail. It is the responsibility of the recipient to virus scan this e-mail and any attachments included.

1 0

installed 8.1 Kernel Update - System crashs KDE/X11
by Philipp Rusch 25 Feb '03

25 Feb '03

Hello list, I installed a kernel update for my 8.1 system as recommended last week by my YOU, when I did check for ISDN-updates because of my AVM card problems (timeouts and so on) I did change from k_athlon-i586-2.4.19.56 to something like k-athlon-i586-2.4.19.167 (?) (not at the system at the moment). My system is bootiung, ok, but I can't get any X11-config to run again. It blinks three times and that's it ! I exchanged my VGA card, put in an old Matrox, reconfigured, again - nothing else than three blinks. Do I have to reinstall ? Change back to the old kernel ? Whats going on here ? TIA, Philipp

2 2

R: [suse-security] SuSEfirewall2 errors on SuSE linux 8.1
by Fiorenza Meini 25 Feb '03

25 Feb '03

here is my conf. file: FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="10.10.0.0/16,0/0,tcp,110 10.10.0.0/16,0/0,tcp,21 10.10.0.0/16,0/0,tcp,80 10.10.0.0/16,0/0,tcp,25" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="no" # Autodetect the services below when starting FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" -----Messaggio originale----- Da: Peer Stefan [mailto:stefan.peer@tiwag.at] Inviato: martedì 25 febbraio 2003 14.46 A: Fiorenza Meini; Suse Security (E-mail) Oggetto: RE: [suse-security] SuSEfirewall2 errors on SuSE linux 8.1 Hi Fiorenza, > From: Fiorenza Meini [mailto:fmeini@robinson.it] > Hi there! > On my SuSE Linux 8.1 professional box I configured the > firewall and when I > run SuSEfirewall2 I receive this kind of message: > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > iptables v1.2.7a: Maximum prefix length 29 for --log-prefix > > Please, what does it mean? > > My firewall configuration is attached. No it's not - please include your configuration in the text (run 'cat /etc/sysconfig/SuSEfirewall2|grep -v "^#" | grep -v "^$"' to leave out all comments and empty lines). The last error "iptables v1.2.7a: Maximum prefix length 29 for --log-prefix" means that you cannot assign more than 29 characters as your log-prefix (a short description included in your log-message). Have a look at the directive FW_LOG="...." and especially check for the second ". Sounds like it got lost somewhere. > Thanks > Fiorenza > <<SuSEfirewall2>> regards, Stefan

3 2

RE: [suse-security] SuSEfirewall2 errors on SuSE linux 8.1
by Peer Stefan 25 Feb '03

25 Feb '03

Hi Fiorenza, > From: Fiorenza Meini [mailto:fmeini@robinson.it] > Hi there! > On my SuSE Linux 8.1 professional box I configured the > firewall and when I > run SuSEfirewall2 I receive this kind of message: > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > /sbin/SuSEfirewall2: line 696: test: 10.10.0.0/16: integer expression > expected > iptables v1.2.7a: Maximum prefix length 29 for --log-prefix > > Please, what does it mean? > > My firewall configuration is attached. No it's not - please include your configuration in the text (run 'cat /etc/sysconfig/SuSEfirewall2|grep -v "^#" | grep -v "^$"' to leave out all comments and empty lines). The last error "iptables v1.2.7a: Maximum prefix length 29 for --log-prefix" means that you cannot assign more than 29 characters as your log-prefix (a short description included in your log-message). Have a look at the directive FW_LOG="...." and especially check for the second ". Sounds like it got lost somewhere. > Thanks > Fiorenza > <<SuSEfirewall2>> regards, Stefan

1 0

Problem with SuSEfirewall2 configuration
by Christian Schneider 25 Feb '03

25 Feb '03

Hello, I have recently installed SuSE Linux 8.1 on an "old" computer to run as a Windows (and Linux) File- and Print-Server and to have access to the internet (ISDN card on server: no!!! dial on demand). Everything (samba, squid, bind9, ssh) seems to work correctly without the firewall running. But when the firewall is started, only working with ssh is possible. Perhaps these messages are interesting while the computer is booting: Starting Firewall Initialization (phase 3 of 3): No chain/target/match by that name iptables v1.2.7a: host/network 'ippp0' not found [...] iptables v1.2.7a: Maximum prefix length 29 for --log-prefix [...] Warning: FW_SERVICES_DNS defined, but no DNS server found running! Warning: FW_SERVICES_SQUID defined, but no Squid server found running! (DNS and Squid server are started a few seconds later.) Changes in /etc/sysconfig/SuSEfirewall2: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_SERVICES_INT_TCP="domain 22 25 110 443 3128 137 138 139 901" FW_SERVICES_INT_UDP="domain 22 25 110 443 3128 137 138 139 901" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_DNS="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" Is there a problem with the kind of internet connection I use (manual dialing)? Are all neccessary ports accessible from the clients (especially the samba ports)? Thank you for help. Cheers, Christian Schneider __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Bis zu 100 MB Speicher bei http://premiummail.yahoo.de

4 3

Spam/Bounce-Mail
by Joerg Frings-Fuerst 24 Feb '03

24 Feb '03

Hallo, first I say sorry for your trouble with my bounce-mails. This weekend I setup my new Mail-Backupserver. After this work I test a new version of my Spamcheck-script. In this script I call "rblcheck". My mistake was the test via list.dsbl.org. The big prob by my was that the powerline from my Primaryserver going offline. So the Backup-Server works with the bad script. Sorry Joerg -- Jörg Frings-Fürst 54526 Landscheid http://www.fixundfoxi.dyndns.info -- Registered Linux User # 280687 ICQ 170365098 GPG Key ID : 9E5F BE06 E208 BAA3

1 0

Re: [suse-security] OpenSesamMe
by GentooRulez 24 Feb '03

24 Feb '03

> Hi, > > To be honest, you'd be better off using PPTP if coming from Windoze or IPSEC > (FreeSWAN) if Linux. You can then firewall the resulting ppp* or ipsec* device > to control access. I wont a bidirectional communication to get the hole. My actual idea is to play with the source-ports and simulate a connection to the server on a often used destination port, e.g. tcp 80, dont care a httpd is runing there. This should look like "normal" traffic, not know where the advantage is, yet :O) > Your proposal begs the question "when do I close the hole?". We solved this by > establishing a connection that was open for the duration. It works as follows: When I logout myself via .bash_logout e.g. > Nominate a port. can be udp but tcp preferred. The port should be one that > should not attract much attention. > Client calls server > Server issues challenge > Client responds > Server opens firewall eg you drop into a jump to a pre-defined chain. > After a timeout (60s/5m/or what you want) Server issues a new challenge > Client responds. If no response, Server closes firewall > If tcp is used, you can also close firewall when connection drops. A time-out can be a good idea, e.g. my connection died before i closed the hole again. regards Michael

1 0

OpenSesamMe
by GentooRulez 24 Feb '03

24 Feb '03

OpenSesamMe is there a tool outthere that work as follows: 1. I'll send a sequence of small ip packets (udp|tcp) to certain ports in a certain order to a server destination. e.g. udp 213,tcp 112,udp 443,udp 4500,tcp 1200 2. The servers has got a daemon that sniffs all incoming packets, filtered too, on certain interface and waits for udp 213. If such a packet arrives, the daemon checks whether the other packets arrives in a certain time in that order or not. 3. If daemon check succeeded, a whole hole will be poked into the firewall for this incoming ip to allow access to e.g. ssh. or any other suggestions for that. And YES, somebody might name this security through obscurity. Thx in advance Michael

4 4

Re: [suse-security] OpenSesamMe
by John Trickey 22 Feb '03

22 Feb '03

Oops, forgot the reply behavior of this list! Michael, Don't reply to the direct mail as it will drop down a spam trap. John ----- Forwarded message from John Trickey <lists(a)g4rev.supanet.com> ----- Date: Sat, 22 Feb 2003 15:55:42 +0000 From: John Trickey <lists(a)g4rev.supanet.com> Reply-To: John Trickey <lists(a)g4rev.supanet.com> Subject: Re: [suse-security] OpenSesamMe To: GentooRulez <paranoiac_user(a)freenet.de> Quoting GentooRulez <paranoiac_user(a)freenet.de>: > OpenSesamMe > > is there a tool outthere that work as follows: > > ...etc... Hi, To be honest, you'd be better off using PPTP if coming from Windoze or IPSEC (FreeSWAN) if Linux. You can then firewall the resulting ppp* or ipsec* device to control access. I have implemented something similar but regretably the code is copyright a former employer :-( However in those days secure tunnels were not cheaply available. Your proposal begs the question "when do I close the hole?". We solved this by establishing a connection that was open for the duration. It works as follows: Nominate a port. can be udp but tcp preferred. The port should be one that should not attract much attention. Client calls server Server issues challenge Client responds Server opens firewall eg you drop into a jump to a pre-defined chain. After a timeout (60s/5m/or what you want) Server issues a new challenge Client responds. If no response, Server closes firewall If tcp is used, you can also close firewall when connection drops. Sorry, but I cannot release the port choice and challenge/response algorithm. HTH John ----- End forwarded message -----

1 0

openssl vulnerability
by Konstantin (Kastus) Shchuka 21 Feb '03

21 Feb '03

Are SuSE openssl packages vulnerable to this: http://www.openssl.org/news/secadv_20030219.txt If they are, when we might expect to see SuSE patches? Thanks, -Kastus

4 3