April 2003 - openSUSE Security - openSUSE Mailing Lists

sendmail und SMTP-AUTscH
by Roland Hilkenbach 24 Apr '03

24 Apr '03

Hi List, I tried to get two sendmails working together but failed. What did I do wrong? Server A (LAN) is a SuSE 8.0 box with sendmail 8.12.3. It collects mail from the LAN without problems and can deliver them to other servers. If it weren't for SPAM-control of other servers... Server B is a SuSE 7.2 root-server with sendmail-tls (latest patches implemented). This box should become my relay for all mails from the LAN. If I send mail from my kmail-program, I can use authentication methods plain and login without problems. Encryption will be the next step. I setup LAN-Server A to relay mail to root-server B (SMARTHOST=...), to use Authentication method PLAIN (SMTP_AUTH_MECHANISMS="PLAIN") and I edited the auth-info file. I double checked correct spelling of servername, username and password. I let SuSEconfig do the dirty job and restarted the server - all corresponding to the article in the SDB. It simply doesn't work here! Regardless of the authentication method, every try ends up with an "authentication failed". I installed a SuSE 8.1 sendmail also but got the same result. To sum it up: kmail -> sendmail-tls works while sendmail -> sendmail-tls does not! Any hints and tipps greatly appreciated - thank You Roland Hilkenbach

2 3

Re: [suse-security] ver7.2 server was hacked - pls help
by GentooRulez 24 Apr '03

24 Apr '03

>> I'm afraid i have to reinstall the machine, but before i do it want to >> know what and how happened. > > With that kind of access you could try to see what happened, but there > are a lot of possibilities... Thats it. > now that you mentions Samba, in my LUG I > am an user was hacked, and the main suspect is samba, he don't has it > patched, and had no firewall, so the latest samba vulnerability could > have been exploited (the intruder seems to have applied the patch to fix > samba, and then installed backdoors and things like that... but left all > logged in the /root/.bash_history). That kind of things could be what > happened in your machine, but really clever guys don't left that kind of > traces. Or many other things, because according to another mail in this threat he seems to run a normal 7.2 with a lot of services bound, even finger did work. > But I think that the best is reformat/reinstall the machine, you can't > be sure what have been changed in your disk. This and nothing else. But this time harden the box. Disable all services you dont need. Use scripts like harden_suse and SuSEfirewall2 to harden and protect your system. Think on kernel patches like openwall to prevent buffer overflows and privilege escalation. Simply ask google how 2 harden a linux box. Check e.g. what the guys from http://www.trusteddebian.org/ do for the security of their distri. Cheers Michael

1 0

Vulnerability in PoPToP?
by Sven Euteneuer 23 Apr '03

23 Apr '03

Hi everybody, after seeing exploits of a security vulnerability in PoPToP pop up on Bugtraq, I'm wondering whether the version that shipped with SuSE Linux 8.0 is actually vulnerable and if yes whether there is anything in the pipeline to fix this? I wasn't able to find anything in either the security announcements or the list archives? Sven See below for the exact version: venkman:~ #rpm -qi pptpd-1.1.2-226 Name : pptpd Relocations: (not relocateable) Version : 1.1.2 Vendor: SuSE AG, Nuernberg, Germany Release : 226 Build Date: Sat Mar 23 20:18:00 2002

1 0

qpopper and OpenSSL
by Vukasin Ciric 23 Apr '03

23 Apr '03

I compiled and configured qpopper from the guide.pdf from qpopper homepage, and from the same guide I created CA. When I try to check mail, I get this: Apr 23 19:36:29 kolubara popper[10830]: OpenSSL error during handshake Apr 23 19:36:29 kolubara popper[10830]: ...SSL error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Apr 23 19:36:29 kolubara popper[10830]: TLS/SSL Handshake failed: -1 What to do?

1 0

Re: [suse-security] ver7.2 server was hacked - pls help
by Michael Ryan 23 Apr '03

23 Apr '03

Hi Istvan, Sorry to hear about your problems ... off the bat, I'd look at Samba as a possible route the hacker(s) used to compromise your server (have you been using YOU to maintain your patch levels?) All I can suggest at this point is taking the server off-line, replacing the hard drive(s) [if you want to try and do an analysis of the hack later] and building a new server using SuSE 8.1 if possible - be VERY careful about transferring ANYTHING from the compromised server to the new server as these guys no doubt have installed a rootkit and trojanised other files on the system. Try to re-install web sites, etc from known good backups or other trusted sources. There is an open source tool out there call the Coronors toolkit which you can use to investigate the hacked platform but whether you want to take the time and trouble is up to you. Hope this is of some help. Regards, Michael

1 0

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

1 0

Suse 8.2 und Cisco VPN
by Mike.Hollaebder 23 Apr '03

23 Apr '03

Hallo, leider bekomme ich den Cisco-VPN-Client nicht zum Laufen Suse 8.2 , Cisco VPN 3.6.2 Das Kernelmodul kompiliert, aber anschliessend meckert der vpnclient, dass er nicht auf das VPN-Subsystem zugreifen kann (The VPN sub-system is busy or has failed.) ... Best regards Mike Hollaender

3 2

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Thomas: I tested several configurations within ipsec.conf: (basically I do the same as on GW1) interfaces=%defaultroute interfaces="ipsec0=ppp0" interfaces="ipsec0=eth0 ipsec1=%defaultroute" interfaces="ipsec0=eth0 ipsec1=ppp0" And the only thing I see is (dropped packets): ipsec1 Link encap:IPIP Tunnel HWaddr inet addr:217.235.200.173 Mask:255.255.255.255 UP RUNNING NOARP MTU:1412 Metric:1 RX packets:34 errors:0 dropped:0 overruns:0 frame:0 TX packets:32 errors:0 dropped:32 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:2395 (2.3 Kb) TX bytes:3440 (3.3 Kb) I also test with a wide open Firewall without sucess.... :( Here is my basic configuration: # basic configuration config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; # %defaultroute is okay for most simple cases. interfaces="ipsec0=eth0 ipsec1=ppp0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=yes overridemtu=1412 conn %default keyingtries=0 disablearrivalcheck=no authby=rsasig conn MUCWIL left=tsfwwillich.dyndns.org leftsubnet=192.168.100.0/24 leftrsasigkey=%cert leftcert=gw.wil.cert.pem leftid="/C=DE/ST=GER/O=Teleconnect und Service GmbH/OU=TSD/CN=GATEWAY VPN WILLICH/Email=info(a)teleconnect-service.de" # Right security gateway, subnet behind it, next hop toward left. right=tsfwmuenchen.dyndns.org rightsubnet=192.168.101.0/24 rightnexthop=217.5.98.100 rightcert=gw.muc.cert.pem rightid="/C=DE/ST=GER/O=Teleconnect und Service GmbH/OU=TSD/CN=GATEWAY VPN WILLICH/Email=info(a)teleconnect-service.de" rightrsasigkey=%cert auto=start Ray: How can I verify that forwarding is enabled? Also, make sure forwarding is turned on for that interface. On Wed, 2003-04-23 at 13:02, Thomas Kerkau wrote: > Hi Peter, > > > > |NET2 pings NET1: GW2(eth0) logs an icmp request ? > > on eth0: > > 9 7.631138 192.168.101.239 192.168.100.205 ICMP Echo > > (ping) request > > the paket is entering GW2. > > > > > 192.168.101.0/24 ist net2 internal > > 192.168.100.0/24 ist net1 internal > > > > on ipsec0: > > 3 1.694921 217.235.199.35 192.168.100.205 ICMP > > Echo (ping) request > > the paket is leaving ipsec0 > > > > > on eth1: > > nothing-- > > > > on ppp0 > > nothing-- > > but not forwarded to ppp0/eth1. Just checked this on a 7.3, you will see > ESP-pakets on both. hopfully this was not changed. Is ipsec0 bound to > eth1/ppp0 (interfaces directive in ipsec.conf)? > > > Yes I forgot to paste int the reply. :) > > but basically ipsec0 looks differnent on both machines > > > > GW2:|> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo > > GW1:|> 08:51:05.057368 unknown ip 0 > > Are you shure that these entries are correlated? Do you see ESP-pakets > on the external interface of GW1? > > My feeling at this point is that GW2 doesn't send any paket to GW1. > Check if "ipsec eroute" and "ipsec auto --status" shows the correct > connections, and check "route". > > Greetings, Thomas > > > -- > www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI > -> CyberOne Award > -> Winner Crossroads A-List Award USA > -> IBM Solution Excellence Award winner for Hot Java Solution > -> European Information Society Technologies Prize Winner > -> Made with ArcStyler: http://www.io-software.com/customers > -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com > > ----- < iO > --------------------------------------------------------- > Interactive Objects Software GmbH > mailto:Thomas.Kerkau@io-software.com > http://www.io-software.com > Basler Strasse 65, D-79100 Freiburg, Germany > Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 > ---------------------------------------------------------------------- -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

2 1

WebLog entry
by webmaster 23 Apr '03

23 Apr '03

Hi List, Marc Heuse v2.0 SecCheck started logging recently * Changes (+: new entries, -: removed entries): - httpd root TCP *:80 (LISTEN) - httpd root TCP *:80 (LISTEN) Web server is running, 80/tcp open Any idea what can it be about? Thanks Antal

1 0

pppd sporadically uses ppp1 instead of ppp0
by Peter Karl Müller 23 Apr '03

23 Apr '03

Hi I'm using SuSE 7.3 as a firewall accessing the IN via DSL. By chance I found in the archived /var/message files of the last months that pppd sporadically connects thru ppp1 instead of ppp0: messages:Apr 13 12:11:37 xxxxxx pppd[6215]: Using interface ppp1 messages:Apr 13 12:11:37 xxxxxx pppd[6215]: Connect: ppp1 <--> /dev/pts/1 messages:Jan 18 15:51:36 xxxxxx pppd[2511]: Using interface ppp1 messages:Jan 18 15:51:36 xxxxxx pppd[2511]: Connect: ppp1 <--> /dev/pts/2 Since my firewall rules are bound to ppp0 my firewall box has been unshielded, right? As a workaround I have blocked all traffic thru ppp1, ppp2, ppp3. Questions: a) How do I ensure that pppd only takes ppp0? b) Do ppp2, ppp3 etc. exist? Best regards Peter

3 2

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Hi Thomas, please see below. |-----Ursprüngliche Nachricht----- |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |Gesendet: Mittwoch, 23. April 2003 10:52 |An: telest(a)gmx.net |Cc: suse-security(a)suse.com |Betreff: Re: [suse-security] IP Tunnel in only one direction possible | | |Hi Peter, | |I'm a little cofused. to get things right: | |> tcpdump told me: |> eth0 (internal) ping request was send (from machine net2 to |machine net1) | |NET2 pings NET1: GW2(eth0) logs an icmp request ? on eth0: 9 7.631138 192.168.101.239 192.168.100.205 ICMP Echo (ping) request 192.168.101.0/24 ist net2 internal 192.168.100.0/24 ist net1 internal on ipsec0: 3 1.694921 217.235.199.35 192.168.100.205 ICMP Echo (ping) request on eth1: nothing-- on ppp0 nothing-- | |> ipsec0 ping request (from fw/gw net2 external IP to machine |net1 (internal |> ip)) ! maybe here is the fault!! | |NET2 pings NET1: GW2(ipsec0) logs an icmp request to NET1? | |> ppp0 (nothing) | |what about eth1? It is absolut correct to have tcpdump report pakets on |ipsec0 to some internal ip at NET1. At the same time the physical |Interface with the same ip as the logical ipsec0 should log some |ESP-pakets. | | |> tcpdump example from the not-working GW NET2 - ipsec0 if |> 10:21:04.304526 192.168.100.1 > 192.168.101.239: icmp: echo request |> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo |reply -> this is |> the ping request from net1 to net2 | |The above is NET1 pings NET2, which works. What does it show for NET2 |pings Net1. From the above I would guess only the icmp: echo |request but |no echo reply? Yes I forgot to paste int the reply. :) but basically ipsec0 looks differnent on both machines GW2:|> 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo GW1:|> 08:51:05.057368 unknown ip 0 | | |> tcpdump example from the working GW NET1 - ipsec0 if |> 08:51:05.057368 unknown ip 0 |> 08:51:05.185805 unknown ip 0 |> 08:51:05.256899 unknown ip 0 |> 08:51:05.386109 unknown ip 0 |> 08:51:05.458005 unknown ip 0 |> 08:51:05.586372 unknown ip 0 |> 08:51:05.659086 unknown ip 0 |> 08:51:05.786648 unknown ip 0 | |This is NET2 pings NET1? | |The Post/Prerouting tabel is viewd by iptables -t nat -L | |Maybe you take a look at your ipsec: |ipsec eroute lists your ipsec routings |ipsec auto --status lists the status of your connections | | |Greetings, Thomas | | |> |> |-----Ursprüngliche Nachricht----- |> |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |> |Gesendet: Mittwoch, 23. April 2003 09:07 |> |An: telest(a)gmx.net |> |Cc: suse-security(a)suse.com |> |Betreff: Re: [suse-security] IP Tunnel in only one |direction possible |> | |> | |> |Hi Peter, |> | |> |this midght be due to yout iptables configuration. It is |unlikley to be |> |due to your ipsec or routing config, cause it works in one |direction. I |> |would try to take down iptables, if possible. This is not |secure but a |> |quick test. Maybe you take a look at your iptables |configuration first, |> |and compare FW1 and FW2, keeping in mind that FW2 has an |external ethX |> |and a pppX interface. |> |Some further ideas: |> |Maybe you try to use tcpdump on FW2, looking for the pakets |> |from Net2 or |> |enable loging for all pakets with iptables. |> | |> |Hope this helps a little but it is very dificult to guess |what might be |> |wrong, |> | |> |Thomas |> | |> | |> |> I have a big problem, that today the VPN tunnel is only |usable in one |> |> direction. |> |> |> |> NET(1) --- FW1/VPN Gateway ---- internet ---- FW2 / VPN |> |Gateway ---- NET(2) |> |> |> |> I can ping from NET1 to NET2 and get replies. ( I also can |> |use different |> |> other thinks like pcanywhere, file access to the pc's on net2,...) |> |> |> |> I cannot ping from NET2 to NET1. There is nothing in the |> |logfiles. I can |> |> only see on the interface statistik that the 4 ping packets |> |are dropped. |> |> |> |> I use on both sides: |> |> Freeswan 1.98b |> |> iptables |> |> Suse Linux 8.0 |> |> |> |> FW1: static IP Adresses , SDSL Connection |> |> FW2: dynamic IP Adresses, SDSL PPPoE Connection |> |> |> |> I'm really stucked and help will be appreaciated. |> |> |> |> Thanks |> |> |> |> Peter |> |> |> |> -- |> |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> |> |> -- |> |> Check the headers for your unsubscription address |> |> For additional commands, e-mail: suse-security-help(a)suse.com |> |> Security-related bug reports go to security(a)suse.de, not here |> | |> |-- |> |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI |> | -> CyberOne Award |> | -> Winner Crossroads A-List Award USA |> | -> IBM Solution Excellence Award winner for Hot Java Solution |> | -> European Information Society Technologies Prize Winner |> | -> Made with ArcStyler: http://www.io-software.com/customers |> | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com |> | |> |----- < iO > |--------------------------------------------------------- |> |Interactive Objects Software GmbH |> |mailto:Thomas.Kerkau@io-software.com |> |http://www.io-software.com |> |Basler Strasse 65, D-79100 Freiburg, Germany |> |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |> ||---------------------------------------------------------------------- |> | |> |> -- |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> -- |> Check the headers for your unsubscription address |> For additional commands, e-mail: suse-security-help(a)suse.com |> Security-related bug reports go to security(a)suse.de, not here | |-- |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI | -> CyberOne Award | -> Winner Crossroads A-List Award USA | -> IBM Solution Excellence Award winner for Hot Java Solution | -> European Information Society Technologies Prize Winner | -> Made with ArcStyler: http://www.io-software.com/customers | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com | |----- < iO > --------------------------------------------------------- |Interactive Objects Software GmbH |mailto:Thomas.Kerkau@io-software.com |http://www.io-software.com |Basler Strasse 65, D-79100 Freiburg, Germany |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |---------------------------------------------------------------------- | -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

3 2

Re: AW: [suse-security] IP Tunnel in only one direction possible
by Thomas Kerkau 23 Apr '03

23 Apr '03

Hi Peter, something came to my mind as I read the mail from Ray: maybe its in your MASQ/SNAT rules on GW2. I guess you use Masquerading for outgoing trafic from NET2? In this case you should exclude traffic to 192.168.0.0/16 from this rule. I dont use SuSEFirewall, but the shellcommand for SNAT is something like: iptables -t nat -I POSTROUTING -s $ownnet -d ! 192.168.0.0/16 -j SNAT --to-source $badIP where $ownnet is my internal (something like 192.168.22.0/24) and $badIP is the external IP of the FW. Greetings, Thomas -- www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI -> CyberOne Award -> Winner Crossroads A-List Award USA -> IBM Solution Excellence Award winner for Hot Java Solution -> European Information Society Technologies Prize Winner -> Made with ArcStyler: http://www.io-software.com/customers -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Hi Thomas, thanks for yours suggestions. I try to see if my FW drops packets, but there is not entry in the firewall logfile. The only information I can see is in the link statistics ip -s link there are dropped packets at if ipsec0 tcpdump told me: eth0 (internal) ping request was send (from machine net2 to machine net1) ipsec0 ping request (from fw/gw net2 external IP to machine net1 (internal ip)) ! maybe here is the fault!! ppp0 (nothing) tcpdump example from the not-working GW NET2 - ipsec0 if 10:21:04.304526 192.168.100.1 > 192.168.101.239: icmp: echo request 10:21:04.305584 192.168.101.239 > 192.168.100.1: icmp: echo reply -> this is the ping request from net1 to net2 10:21:04.500970 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 9658 win 64058 (DF) 10:21:04.501566 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 9658:10007(349) ack 0 win 5488 (DF) [tos 0x10] 10:21:04.700379 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10007 win 63709 (DF) 10:21:04.700979 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10007:10221(214) ack 0 win 5488 (DF) [tos 0x10] 10:21:04.901447 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10221 win 63495 (DF) 10:21:04.902043 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10221:10437(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.101170 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10437 win 63279 (DF) 10:21:05.101764 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10437:10653(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.302252 192.168.100.1.cnrprotocol > 192.168.101.223.telnet: . ack 10653 win 64484 (DF) 10:21:05.302872 192.168.101.223.telnet > 192.168.100.1.cnrprotocol: P 10653:10869(216) ack 0 win 5488 (DF) [tos 0x10] 10:21:05.311890 192.168.100.1 > 192.168.101.239: icmp: echo request tcpdump example from the working GW NET1 - ipsec0 if 08:51:04.985548 unknown ip 0 08:51:05.057368 unknown ip 0 08:51:05.185805 unknown ip 0 08:51:05.256899 unknown ip 0 08:51:05.386109 unknown ip 0 08:51:05.458005 unknown ip 0 08:51:05.586372 unknown ip 0 08:51:05.659086 unknown ip 0 08:51:05.786648 unknown ip 0 |-----Ursprüngliche Nachricht----- |Von: Thomas Kerkau [mailto:Thomas.Kerkau@io-software.com] |Gesendet: Mittwoch, 23. April 2003 09:07 |An: telest(a)gmx.net |Cc: suse-security(a)suse.com |Betreff: Re: [suse-security] IP Tunnel in only one direction possible | | |Hi Peter, | |this midght be due to yout iptables configuration. It is unlikley to be |due to your ipsec or routing config, cause it works in one direction. I |would try to take down iptables, if possible. This is not secure but a |quick test. Maybe you take a look at your iptables configuration first, |and compare FW1 and FW2, keeping in mind that FW2 has an external ethX |and a pppX interface. |Some further ideas: |Maybe you try to use tcpdump on FW2, looking for the pakets |from Net2 or |enable loging for all pakets with iptables. | |Hope this helps a little but it is very dificult to guess what might be |wrong, | |Thomas | | |> I have a big problem, that today the VPN tunnel is only usable in one |> direction. |> |> NET(1) --- FW1/VPN Gateway ---- internet ---- FW2 / VPN |Gateway ---- NET(2) |> |> I can ping from NET1 to NET2 and get replies. ( I also can |use different |> other thinks like pcanywhere, file access to the pc's on net2,...) |> |> I cannot ping from NET2 to NET1. There is nothing in the |logfiles. I can |> only see on the interface statistik that the 4 ping packets |are dropped. |> |> I use on both sides: |> Freeswan 1.98b |> iptables |> Suse Linux 8.0 |> |> FW1: static IP Adresses , SDSL Connection |> FW2: dynamic IP Adresses, SDSL PPPoE Connection |> |> I'm really stucked and help will be appreaciated. |> |> Thanks |> |> Peter |> |> -- |> +++ GMX - Mail, Messaging & more http://www.gmx.net +++ |> Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage! |> |> -- |> Check the headers for your unsubscription address |> For additional commands, e-mail: suse-security-help(a)suse.com |> Security-related bug reports go to security(a)suse.de, not here | |-- |www.ArcStyler.com - the Architectural IDE for MDA:J2EE/.NET/EAI | -> CyberOne Award | -> Winner Crossroads A-List Award USA | -> IBM Solution Excellence Award winner for Hot Java Solution | -> European Information Society Technologies Prize Winner | -> Made with ArcStyler: http://www.io-software.com/customers | -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com | |----- < iO > --------------------------------------------------------- |Interactive Objects Software GmbH |mailto:Thomas.Kerkau@io-software.com |http://www.io-software.com |Basler Strasse 65, D-79100 Freiburg, Germany |Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 |---------------------------------------------------------------------- | -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

2 1

ver7.2 server was hacked - pls help
by Istvan Hollo 23 Apr '03

23 Apr '03

Hello Guru's, On the weekend our web server (SuSE 7.2 kernel 2.4.4-4GB) was hacked by some very clever guys. They placed some programs which i can not remove anymore and which is even worse - the root's password also was changed (I can not start in single user mode - init 1 - password is wrong). A "sysadmin" user was created by the hacker and mtab also was changed. When i try to login and type the username than Enter -> the "pasword" question is not coming but the screen is hanging. It means we can not log in anymore. Which is interesting, this is our mail server also and we can send/receive mails but via samba is not possible to connect to the shared drives. I'm afraid i have to reinstall the machine, but before i do it want to know what and how happened. If someone of you experienced with this and could give good advices about what to do and how i can analyse who logged it would be appreciated. TIA, istvan Istvan HOLLO GlobalTech Hungary Informatikai Kft. phone : +36 28 590 500 fax : +36 28 590 501 email : istvan.hollo(a)ija.hu www : www.thegt.com www.ija.hu

4 3

Re: [suse-security] ver7.2 server was hacked - pls help
by GentooRulez 23 Apr '03

23 Apr '03

> I'm afraid i have to reinstall the machine, but before i do it want to > know what and how happened. That is the normal way. Reinstall your box after doing a forensic analysis on what is happen until now. Fix the problem and harden the box. > If someone of you experienced with this and could give good advices about > what to do and how i can analyse who logged it would be appreciated. As above - doing a forensic analysis. The're a lot of documents on it. Try e.g. google: forensic analysis honey pot. Put your hard disc into another box and mount the filesystem(s) r/o too examine what logfiles tell you about some actions of the attacker - but normally they should be cleaned. (apache/mailserver logs too) Do a string analysis on the whole disc and search for log-strings with a date entry related to date of attack in order to identify the way attacker became root. > TIA, > istvan Ciao Michael

1 0

Re: [suse-security] IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

1 0

IP Tunnel in only one direction possible
by telest＠gmx.net 23 Apr '03

23 Apr '03

Hello to everyone, I have a big problem, that today the VPN tunnel is only usable in one direction. NET(1) --- FW1/VPN Gateway ---- internet ---- FW2 / VPN Gateway ---- NET(2) I can ping from NET1 to NET2 and get replies. ( I also can use different other thinks like pcanywhere, file access to the pc's on net2,...) I cannot ping from NET2 to NET1. There is nothing in the logfiles. I can only see on the interface statistik that the 4 ping packets are dropped. I use on both sides: Freeswan 1.98b iptables Suse Linux 8.0 FW1: static IP Adresses , SDSL Connection FW2: dynamic IP Adresses, SDSL PPPoE Connection I'm really stucked and help will be appreaciated. Thanks Peter -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

3 2

Re: [suse-security] running ftp daemon in chrooted jail - how?
by Michael Ryan 22 Apr '03

22 Apr '03

Guys, Thanks for all the help/suggestions, esp to Philippe for taking the time :) will probably go with vsftp Michael

1 0

running ftp daemon in chrooted jail - how?
by Michael Ryan 22 Apr '03

22 Apr '03

Hi list, Anyone point me to a good doc on how to set up ftp daemon in a chrooted environment. (I am running SuSE 8.1 which comes with the BSD FTP daemon ftpd-0.3.2-333 ... should I use this or would something like ProFTP be more 'secure'?) Many thanks, Michael

5 4

Need help with Postfix configuration
by news-it＠hilger-online.com 22 Apr '03

22 Apr '03

Hi folks, i need your held.. I got a Server running SuSE 8.1 Pro which acts as a firewall & proxy. Now i want to set up a mail server on the same machine.. I collect the mails with fetchmail from a pop3 server. But i need some help with the postfix configuration. Maybe someone can help me with that. Thanks a lot. T.

1 0

no KDE/Postscript Updates for SuSE <= 8.0
by Clemens Gesell 22 Apr '03

22 Apr '03

Hello folks, Why isn't there a Security Anouncement for the insecure Postscript handling Bug in KDE from SuSE. I have seen Update Packages for SuSE Linux 8.2 and 8.1, but nothing for <= 8.0 ? Thanks, Clemens

1 0

RE: [suse-security] connection via telnet, XServer, ssh
by Habichtsberg, R. 21 Apr '03

21 Apr '03

That is what I call a fast answer :-). Only 10 Minutes! Thank you, Markus and Stefan. I will try the ssh-clients. What I didn't know is that Cyqwin includes a XServer. Thanks again, Reinhard. > -----Original Message----- > From: Peer Stefan [SMTP:stefan.peer@tiwag.at] > Sent: Wednesday, April 16, 2003 10:57 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] connection via telnet, XServer, ssh > > Hi > > > From: Habichtsberg, R. [mailto:reinhard.habichtsberg@unilux.de] > > Hi all, > > > > how do you estimate the security risk of the following situation: > > > > I log into a linux-server from a windows-client via telnet as > > normal user. > > Why don't you use ssh? There are many nice windows ssh clients out there, putty for example. > > > From the linux-server I start a x-session > > (command: konsole -display windows-client:0,0) > > to a x-server (MIXServer 5.6) on the windows-client. > > > > From this session I open a ssh-session to a second linux-server > > where I have to work as root (su -). > > > > Now, if I would scan the data between the windows PC and the > > linux-servers > > could I read them not coded, particularly could I read the > > root password > > in plaintext? > > Yes. The password is transmitted via X over the network, which isn't encrypted afaik. > But that's relatively easy to check - just sniff the network and try finding the passwort (or any other phrase you have entered on the console, e.g. something like echo "Find me in the sniffer log." > > > > > TIA, > > Reinhard > > regards, > Stefan > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Re: [suse-security] Suse 7.3 Crash
by Nick LeRoy 21 Apr '03

21 Apr '03

> Hi to all! Hi. I know that others have replied, but I don't think that anybody has hit on the most likely causes. The first thing that I'd do is get a modern version of memtest86 (I think they're up to 2.9 now), boot it up, and let it run overnight, or longer. IMHO, it's grown into a pretty good RAM tester. Another great system h/w test is to boot it up into text only mode, and put it in a loop building kernels. Nothing tests RAM and the system h/w as well as gcc.. > I don't know if this subject belongs to this list, but here it goes..... > > I have a Pentium 4 2.4Ghz with 1G of RAM and instaled the SuSe 7.3 Professional distribution. > > The installed system is very unstable and once and a while it just reboots without a warning. > > I installed the stable kernel 2.4.20 and disabled APM in bios and in the kernel configuration. Now only ACPI works. > > The crashes remained. > > The behaviour remains the same if i boot in failsafe mode. > > Any ideas ? > > I also noticed (with top) that the memory used is growing in time. When the system boots there is 126M used and after 3 hours it has > 800M used with the same processes. I also noticed that the biggest RSS process value is 11M. That's most likely just buffers / cache. -Nick -- ______________________________________________ http://www.linuxmail.org/ Now with e-mail forwarding for only US$5.95/yr Powered by Outblaze

4 4

YOU has no notion of update 8.1 -> 8.2
by Arjen de Korte 21 Apr '03

21 Apr '03

After an update from SuSE 8.1 to 8.2, YOU on one of my systems (a mailserver) fails to recognize the update. Although all packages seem to have been updated, YOU still shows "Version 8.1" in the System Information box. BTW, I run YOU though a SSH session from another system, as the server has no screen nor keyboard attached permanently. I'm a litlle worried that it will not be able to locate the correct security updates, without knowledge of the actual installed version. Arjen -- 51 N 25' 05.1" - 05 E 29' 13.3" Key fingerprint - 66 4E 03 2C 9D B5 CB 9B 7A FE 7E C1 EE 88 BC 57

1 0

8.1 Crypto FS (loop_fish2) module with recompiled 2.4.20 kernel for amd
by David M. Fetter 20 Apr '03

20 Apr '03

I recently upgraded my system and in doing so I moved from a PIII Intel processor to an AMD Athlon XP. Currently, I'm running the kernel compiled against the (586/K5/5x86/6x86/6x86MX) Processor family because for some reason when I recompile the kernel against (Athlon/Duron/K7) Processor family the kernel module for loop_fish2 doesn't build. Does anyone know how to resolve this or even if it can? Also, something of note is that I do download the kernel source trees from the mantel dist and not from kernel.org, therefore the module should be present. -- David M. Fetter - http://www.fetterconsulting.com/ "The world is full of power and energy and a person can go far by just skimming off a tiny bit of it." Neal Stephenson - Snow Crash

1 0