May 2003 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

X Listening
by Richard Ibbotson 19 Jun '03

19 Jun '03

Hi Anyone know how to stop X-windows and port 6000 from listening on SuSE 8.2 ? I've already tried changed the line ... :0 local /usr/X11R6/bin/X :0 vt07 to :0 local /usr/X11R6/bin/X :0 vt07 --nolisten tcp but X-windows is still listening on port 6000. What else do I need to change ? Thanks -- Richard

6 6

SSH and CHROOT alternatives...
by Duncan Carter 12 Jun '03

12 Jun '03

Howdoo all, I've been looking at trying to secure SSH sessions so that specified users can only browse their home diretories. I've found a couple of bodges that can be made to do the trick, but none of them seem particulalry ideal. Has anyone got any suggestions on how I could secure SSH in this fashion, whether using CHROOT or something else entirely I don't mind. Cheers. ----~~~~==oOo==~~~~---- Duncan Carter ----~~~~==oOo==~~~~----

2 1

sshd, Is it safe to use "Password authentication Yes"
by Bo Jacobsen 11 Jun '03

11 Jun '03

I think it's much more convinient to use "Password Authentication" then using keys, but how safe is it. Also should I use ChallengeResponseAuthentication" or not. I use SuSE 8.2. Thanks in advance Bo Jacobsen

3 2

SuSE Security Announcement: glibc (SuSE-SA:2003:027)
by Thomas Biege 04 Jun '03

04 Jun '03

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: glibc Announcement-ID: SuSE-SA:2003:027 Date: Monday, May 26th 2003 16:12 MET Affected products: 7.1, 7.2, 7.3, 8.0, 8.1 SuSE Linux Database Server, SuSE eMail Server III, 3.1 SuSE Linux Enterprise Server 7, SuSE Linux Firewall on CD/Admin host SuSE Linux Connectivity Server SuSE Linux Office Server Vulnerability Type: remote system compromise Severity (1-10): 6 SuSE default package: yes Cross References: CAN-2003-0028 Content of this advisory: 1) security vulnerability resolved: integer overflow in XDR code problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - ethereal - XFree4 - vnc - bitchx - lv 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Another integer overflow was found in glibc' XDR code. This bug is equal to the one described in advisory SuSE-SA:2002:031. The overflow occurs in the function xdrmem_getbytes() and can be used by external attackers to execute arbitrary code. There is no temporary workaround for this security problem other than disabling all RPC based server and client programs. The permanent solution is to update the glibc packages with the update packages listed below. Notes, Special installation instructions: * PRECAUTIONS The shared libraries package of the glibc is the most sensitive part of a running Linux system, and modifications to it should be handled with special care. During the update of the shlibs/glibc package, runtime-linking the shared libraries is likely to fail for processes that execute a new binary with the execve(2) system call. Therefore, we recommend to bring a system to single user mode ("init S") to perform the package update. If this is not applicable for operational reasons, a system receiving the update should be kept as quiet as possible (no shell scripts of any kind, no cron jobs, no incoming email). * After performing the update, you should run the following command on your system: /sbin/ldconfig ldconfig will rebuild the runtime linker cache. If you use YOU (Yast2 Online Update), the ldconfig command will be executed automatically at the end of the update. The shared libraries that were installed on the system before the update have been removed from the filesystem, but they are still in use by the running applications. Therefore, the disk-space as well as the memory will not be freed until the last process that uses these files exits. We recommend to reboot the system to workaround this problem. Listed below you find the URLs for the update packages for the SuSE Linux products. We only list the packages that are relevant for the security update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.r… 1cf549fa52427710c7dc3316fc5df4a6 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.p… f87601fd71edf54928104581684dae8f SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.rpm da51402d30c37dd5dc6d5444c37f4dc3 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.patch.r… 0b5ea57d89c31d923cfb56cb1f951bac source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/glibc-2.2.5-177.src.rpm 6fecec2ed42fb792b6e9cb2a5602fe23 SuSE-7.3: ftp://ftp.suse.com/pub/suse/i386/update/7.3/a1/glibc-2.2.4-78.i386.rpm 11cc1ceb173b18fc82d8500b1528663e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/glibc-2.2.4-78.src.rpm 38527e5f75d94c016659c71028c37c52 SuSE-7.2: ftp://ftp.suse.com/pub/suse/i386/update/7.2/a1/glibc-2.2.2-68.i386.rpm 82f4c3ee8ba0cf3feef5e0ba7321a230 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/glibc-2.2.2-68.src.rpm 34114134cb51d706989c45306f4fdde3 SuSE-7.1: ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/glibc-2.2-26.i386.rpm ffe7c422727ee98b8191facbbf40b9d7 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/glibc-2.2-26.src.rpm 1c5b778ff60a82f03e412239b907671b Sparc Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/a1/glibc-2.2.4-46.sparc.rpm dc577491e13344411462603b6fe83d3f source rpm(s): ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/glibc-2.2.4-46.src.rpm 0a0a5dd6ee76e6b0ef866b500d6537b2 AXP Alpha Platform: SuSE-7.1: ftp://ftp.suse.com/pub/suse/axp/update/7.1/a1/glibc-2.2-34.alpha.rpm d250c254668e02b9f23341903f2f3a5e source rpm(s): ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/glibc-2.2-34.src.rpm d89b4a1ff27227a085e516b48ccdb1cf PPC Power PC Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/a1/glibc-2.2.4-69.ppc.rpm 5bf4edf432c996b3e38ef085122e1e8 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - ethereal Several one-byte buffer overflows and integer overflows are fixed. These bugs lead to remote denial-of-service or even remote code execution. New packages are available on our FTP servers. - XFree4 A buffer overflow in the Xlib code can be triggered while handling the environment variable XLOCALEDIR. The X version affected is 4.2.0 (SuSE Linux 8.0 and 8.1). New packages are available on our FTP servers. - vnc VNC (Virtual Network Computing) uses a weak cookie generation process which can be exploited by an attacker to bypass authentication. New packages are available on our FTP servers. - bitchx Several buffer overflows got fixed that can be exploited remotely by a malicious IRC servers. New packages are available on our FTP servers. - lv lv reads config files from the current directory without verifying the ownership. If lv is called in world-writeable directories like /tmp it can be tricked into executing commands by putting a malicious config- file there. New packages are available on our FTP servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBPtNwVney5gA9JdPZAQGgRwf+Jb5OmG6zuqPPAE9nf31SVOUXKY1aO+D0 eHqEM/7VbSaCQ2TAx28mYfyek1NaGudwyqDBGxyVYrrlwz0z9jkGRP/GUY4h2mBk vff5xnlzSbvetFCnoHtR/RqXXRPvnDe3GDgeJXoPpZtRYnDb/Rw/4UOKnIyev7QP iw8yupuYGEQt6yDHwMatSJAHOT3QOmYbsqy6N8GcQ2KwttaVWmHw8bm5eoJKrAAM HR0YjLAu371ZO4pfV4r3Vl2HhaQ+r+/tm4VHnySqA5YdDyM1QiX1AEi5RXqD3L0U ERYYwSc/h/jG6aqKcqAurFIdoGUqAvzevJv0quQAYRWNwbik8jzv8g== =BUi3 -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege <thomas(a)suse.de> SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | gpg --import" Key fingerprint = 7254 B15D B3C4 943F 485E 0BBD 8ECC D7CB C200 A213 -- Das erste Opfer einer Schlacht ist immer der Schlachtplan.

5 5

obsolete (PF_INET,SOCK_PACKET)
by webmaster 02 Jun '03

02 Jun '03

Hi List, Is the err below harmless? And what a way to cure it? SuSe 7.1 box scanlogd uses obsolete (PF_INET,SOCK_PACKET) Thanks Antal Kreorg Oktatóközpont Grid International Magyarország kreorg(a)kreorg.hu +36-1-321-0031

2 1

SuSEfirewall2
by Greg Jamison 01 Jun '03

01 Jun '03

Hello, I am new to the SuSEfirewall, but have quite a bit of experience with iptables. There are a few rules I used in iptables that I can't seem to find equivalents for with the SuSEfirewall. Specifically the following: -A INPUT -i eth0 -p tcp --syn -j DROP (This drops all TCP syn packets received on eth0) -A INPUT -i eth0 -p tcp -m state --state INVALID,NEW -j DROP (This drops any TCP traffic received on eth0 not generated by my firewall or internal network) Is there any way I can accomplish the same with the SuSEfirewall? Any help is greatly appreciated. Thanks! Greg Jamison

2 1

OT: how to report bugs of AMaViS and samba-vscan
by Rainer Link 31 May '03

31 May '03

Hi, as I received once in a while bug reports/feedback et al wrt AMaViS/samba-vscan from readers of this list (send directly to me), here's a short announcement: * SuSE-related issues (e.g. RPM packaging, YaST/SuSEconfig) should be reported via http://www.suse.com/feedback * general AMaViS issues should be send to the amavis-user mailing list (see http://www.amavis.org) security issues should be directed to security at amavis dot org * general/security issues wrt samba-vscan should be send to rainer at openantivirus dot org Reason: today will be my last day working for SuSE. So, the new RPM maintainer of AMaViS won't be a member of the AMaViS Core Team. Thank you very much for your co-operation. Last but not least I'd like to thank SuSE very much for funding my work for three years. I really enjoyed working for one of the best OSS/Linux company around [1] :-) best regards, Rainer Link R&D, SuSE Labs -- Rainer Link | SuSE Linux AG - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (www.amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

RE: AW: [suse-security] Log/Audit all user commands
by Jeff Harris 30 May '03

30 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > > -----Original Message----- > > From: Eduard Avetisyan [mailto:dich_ed@yahoo.com] > > Sent: Viernes, 30 de Mayo de 2003 06:34 > > > > Dear friends, > > > > I followed this discussion a little bit, and here's my 2 cents: > > > > bash_history logs only commands one typed in bash. What if he changes to > > tcsh or whatever else? "Whatever else" includes also graphical helpers, > > like konqueror or nautilus that give you a lot of freedom to run or > > modify any files, while you can't log any actions... and tty sniffer > > won't help either. > > > > I agree with the statement that you don't have to let any intruder play > > with your machine, since it may well be that he HAS already installed > > sniffers (tty or network) and stuff like that, so any action you take > > now will be well known to him. So better really unplug the network, shut > > off the machine, boot from CD (if you'd like to trace back changes he > > made to your system), and reinstall... > > > > Good luck, > > Eduard > > > > __________________________________ > > Do you Yahoo!? > > > On Fri, 30 May 2003, Ricardo wrote: > > > It's OK that he plays with the network. I am using two net's and that > > one he's using isn't important. This can help me to see what he is > > trying to do, what a hacker does, etc. and more important how to act and > > correct. So, this is just a "demo" for me. It's real, but I can see that > > as a demo. So, if you want to help and participate (I give you all the > > info he is doing)... Thanks again, > > > > Ricardo > > -----Original Message----- > From: Jeff Harris [mailto:linux@rallycentral.us] > Sent: Friday, May 30, 2003 9:34 AM > > IMO, it's never OK that unauthorized users "play with the network." They > might be setting up a grand DOS that when the FBI tracks down, is > originating with your server, and _you_ may spend time in the pokey. > > It would be much more beneficial to unplug the network and reinstall the > OS and all security updates. If you really want to know how a cracker > works, you might want to try a legally cracking into systems: > http://www.happyhacker.org/wargame/index.shtml > > -- On Fri, 30 May 2003, Sturgis, Grant wrote: > But this situation, from what Ricardo wrote, is more like a honeypot than an > exploit. > If you're operating a Honeypot in the US or where other comparable laws exist, you might still spend some time in the pokey: http://www.securityfocus.com/printable/news/4004 (Apparently, there's some naughty text in this message. I keep getting a "content denied" message from someone.) - -- Registered Linux user #304026. "lynx -source http://www.rallycentral.us/~linux/jharris.asc | gpg --import" or "gpg --keyserver pgp.mit.edu --recv-key BD23A31E" Key fingerprint = FB8C 3210 8DE1 78F4 6505 5918 0C34 BE94 BD23 A31E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE+15pADDS+lL0jox4RAkLIAJ9VuPdwMlB3CbIt2ANoE+9xUa57MgCdFbBU RQMVT5GArzwmWzGKOReK7Cc= =4YCi -----END PGP SIGNATURE-----

1 0

AW: [suse-security] Log/Audit all user commands
by Ulrich Roth 30 May '03

30 May '03

Hi Ricardo, > Hi, I am having a little problem I need to solve > quickly. I have one intruder (long to explain now) > which edited the passwd file and set his user with 0 > id (as root). I don't want to block him. I want to log > all his actions, moves, commands, etc. How can I do > that? If he didn't disable it or uses another shell, you can have a look at his ~/.bash_history. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

6 5

AW: [suse-security] securing apache / SSL
by Gerhard Stegmann 30 May '03

30 May '03

hi. chkrootkit says 'not infected' except for "bindshell", on port 465, where the tls secured smpt-server sits. so i think it just gets the wrong string. is this correct ? you does not give the option to update this apache/ssl/php-versions, so they're up to date???!??!? thx for comments, gerhard -----Ursprüngliche Nachricht----- Von: Sven 'Darkman' Michels [mailto:sven@darkman.de] Gesendet: Freitag, 30. Mai 2003 15:41 An: suse-security(a)suse.com Betreff: Re: [suse-security] securing apache / SSL hello, Gerhard Stegmann wrote: > hello all. > what exactly has to be done to secure apache ssl on a 8.1 ? > > my config > > apache 1.3.26 > mod_php 4.2.2 > > openssl 0.9.6g > > > it seems as if some guys are able to drop and execute scripts > via apache, and let them execute. the last one executed locally, > but got caught by iptables, while trying to open local ports > and create a connections to a remote host on the following ports [port list] > the next run, it used a different local port, and used the ports > mentioned above the other way around. > any ideas ?? You should stay in touch with online updates of your software. Apache, modssl and php where lately exploitable for remote users (or et least, possible to exploit). mod_ssl exploit is one of the most used at the moment. So check if your Software is up-to-date and if not, use YOU or FOU4S. IF ppl where on your box without your permission (aka crackers/hackers), you need to reinstall that box cause nearly all software could be compromised. Use chkrootkit (www.chkrootkit.org) to check for intruders and rootkits on your box. Regards, Sven -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

packet mangling
by Daniel Santos 30 May '03

30 May '03

Hello all! I have a Suse 8.2 distribution installed on x86 machine. How do I turn off packet mangling on the /sbin/SuSEfirewall script ? Regards, Daniel Santos

1 1

securing apache / SSL
by Gerhard Stegmann 30 May '03

30 May '03

hello all. what exactly has to be done to secure apache ssl on a 8.1 ? my config apache 1.3.26 mod_php 4.2.2 openssl 0.9.6g it seems as if some guys are able to drop and execute scripts via apache, and let them execute. the last one executed locally, but got caught by iptables, while trying to open local ports and create a connections to a remote host on the following ports : DPT=4045 DPT=3306 DPT=682 DPT=2620 DPT=662 DPT=277 DPT=400 DPT=1422 DPT=638 DPT=1462 DPT=555 DPT=1377 DPT=386 DPT=2003 DPT=2034 DPT=498 DPT=766 DPT=680 DPT=1532 DPT=1000 DPT=1349 DPT=803 DPT=335 DPT=1234 DPT=1427 DPT=7326 DPT=612 DPT=129 DPT=395 DPT=798 the next run, it used a different local port, and used the ports mentioned above the other way around. any ideas ?? -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig-ml@dns.glamus.de] Gesendet: Freitag, 30. Mai 2003 12:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] iptables error Rodel Collado Urani wrote: > > ip_tables.o: init_module: Device or resource busy Check with "lsmod" if a module named "ipchains" is loaded. If so, unload it with "rmmod ipchains" and try again. Peter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

protecting against webspoofing with iptablerules
by Ruprecht Helms 30 May '03

30 May '03

Hi, how have I to write a or some iptablerules to protect a server against webspoofing. Also interessting to me is the spoofing of ftp. How can I test the rules and which securitytools have implemented the modern attacks. Regards, Ruprecht

1 0

statically linked ps / ls
by Gerhard Stegmann 30 May '03

30 May '03

does anybody have these two ? pleas send them to me. thanks. gerhard -----Ursprüngliche Nachricht----- Von: Peter Wiersig [mailto:wiersig-ml@dns.glamus.de] Gesendet: Freitag, 30. Mai 2003 12:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] iptables error Rodel Collado Urani wrote: > > ip_tables.o: init_module: Device or resource busy Check with "lsmod" if a module named "ipchains" is loaded. If so, unload it with "rmmod ipchains" and try again. Peter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

iptables error
by Rodel Collado Urani 30 May '03

30 May '03

Blanki would like to ask this problem i encountered three days ago. i have been doin a lot of things to fix this but i still could make it. i even recompile my kernel type k_deflt. i also did search in the internet but i cant find the solutions there. maybe some of you have done this already. thanks! this is the full details of the error... """/lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: init_module: Device or resource busy Hint: insmod errors can be caused by incorrect module parameters, including invalid IO or IRQ parameters /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: insmod /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o failed /lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: insmod ip_tables failed iptables v1.2.2: can't initialize iptables table `filter': iptables who? (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded."""

2 1

OpenCa Configurtation / Installation
by Junge, Stefan 30 May '03

30 May '03

Hi, i want to install / configure openca from rpm sources for suse 8.1. Which packages do i need and is there documation available ? Thanks for help Greetings...... Stefan

1 0

iptables
by Rodel Collado Urani 29 May '03

29 May '03

Blankhello, how do i know if my server has an open port? how? can i use iptables to restrict ports thats open? tnx! ps anyway, i have a problem with my iptables this is one of the errors..."/lib/modules/2.4.10-4GB/kernel/net/ipv4/netfilter/ip_tables.o: init_module: Device or resource busy" i even recompile my kernel k_deflt and still the problem is occuring.

2 1

Samba server running SuSEFirewall2
by Peter á Rógvu 29 May '03

29 May '03

Hey . I am running a samba server for some windows clients, but i also want to secure the server with SuSEFirewall2. What port on the server do I have to open, to let the windows clients access the samba share ? Thanks. -- Vh Peter á Rógvu

3 2

pptpd and Windows XP client?
by Radko L 29 May '03

29 May '03

Hello guys, I want to ask you one question about VPN server. I have installed and configureted an VPN pptpd server and it seems work OK with Windows 2000 client machine but when I tried to connect with XP client machine user are able to log in and everithink seems OK but when tried to load some site by http a fit part of site loaded and nothink else happned at that time in log messages on VPN server I found: kernel: Not enough space to encrypt packet: 1404<1404+4! have you got any idea about that? How do you make work with windows XP client? __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

4 4

Log/Audit all user commands
by Ricardo Toma 28 May '03

28 May '03

Hi, I am having a little problem I need to solve quickly. I have one intruder (long to explain now) which edited the passwd file and set his user with 0 id (as root). I don't want to block him. I want to log all his actions, moves, commands, etc. How can I do that? Thanks in advance! ------------ Internet GRATIS es Yahoo! Conexión 4004-1010 desde Buenos Aires. Usuario: yahoo; contraseña: yahoo Más ciudades: http://conexion.yahoo.com.ar

3 5

AW: [suse-security] Blocking ports and services
by Jörg Brandenburg 28 May '03

28 May '03

Hello Stefan, I have a similar problem and tried the FW_TRUSTED_NETS to enable www-access to one special client. But the uSe firewall drops the packets. Do you have any idea?? Jörg -----Ursprüngliche Nachricht----- Von: Peer Stefan [mailto:stefan.peer@tiwag.at] Gesendet: Mittwoch, 28. Mai 2003 13:24 An: suse-security(a)suse.com Betreff: RE: [suse-security] Blocking ports and services[Scanned] Hi Dietmar, > From: Dietmar Stein [mailto:DStein@phoenixcontact.com] > Hi > > I am new to the list but I have gone through archives and > several internet > resources before, but I can't find a detailed answer, so I am > asking ... > > I have a machine running SLES7 (fully updated), which has > only one ethernet > interface (eth0). The machine is running SAP and Oracle and I want to > ensure that only some IP addresses can connect to SAP (which > is running on > ports 3200, 3300, 4800, 3600); all other services except ssh should be > unavailable to the local network. FW_DEV_EXT="eth0" FW_EXT_SERVICES="ssh" FW_TRUSTED_NETS="a.b.c.d/0,tcp,3200 a.b.c.d/0,tcp,3300 a.b.c.d/0,tcp,4800 a.b.c.d/0,tcp,3600" If you can find a subnet for all "allowed" ip addresses this will be very easy. E.g. FW_TRUSTED_NETS="10.100.0.0/16,tcp,80" enables HTTP-access for every ip within the 10.100.0.0 subnet. > What do I want? I want to have access to SAP/Oracle from only a few IP > addresses and all other services blocked (except ssh which should be > public). I have tried to use SuSEfirewall without success (it > won't start > if I do not specify an extrenal device and if I specify it, I > lock myself). A trick of not locking oneself out of the box is to add the ip-address to the FW_TRUSTED_NETS variable ;-) > Any suggestions? > > Thanks, Dietmar You're welcome, Stefan -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Blocking ports and services
by Peer Stefan 28 May '03

28 May '03

Hi Dietmar, > From: Dietmar Stein [mailto:DStein@phoenixcontact.com] > Hi > > I am new to the list but I have gone through archives and > several internet > resources before, but I can't find a detailed answer, so I am > asking ... > > I have a machine running SLES7 (fully updated), which has > only one ethernet > interface (eth0). The machine is running SAP and Oracle and I want to > ensure that only some IP addresses can connect to SAP (which > is running on > ports 3200, 3300, 4800, 3600); all other services except ssh should be > unavailable to the local network. FW_DEV_EXT="eth0" FW_EXT_SERVICES="ssh" FW_TRUSTED_NETS="a.b.c.d/0,tcp,3200 a.b.c.d/0,tcp,3300 a.b.c.d/0,tcp,4800 a.b.c.d/0,tcp,3600" If you can find a subnet for all "allowed" ip addresses this will be very easy. E.g. FW_TRUSTED_NETS="10.100.0.0/16,tcp,80" enables HTTP-access for every ip within the 10.100.0.0 subnet. > What do I want? I want to have access to SAP/Oracle from only a few IP > addresses and all other services blocked (except ssh which should be > public). I have tried to use SuSEfirewall without success (it > won't start > if I do not specify an extrenal device and if I specify it, I > lock myself). A trick of not locking oneself out of the box is to add the ip-address to the FW_TRUSTED_NETS variable ;-) > Any suggestions? > > Thanks, Dietmar You're welcome, Stefan

1 0

Blocking ports and services
by Dietmar Stein 28 May '03

28 May '03

Hi I am new to the list but I have gone through archives and several internet resources before, but I can't find a detailed answer, so I am asking ... I have a machine running SLES7 (fully updated), which has only one ethernet interface (eth0). The machine is running SAP and Oracle and I want to ensure that only some IP addresses can connect to SAP (which is running on ports 3200, 3300, 4800, 3600); all other services except ssh should be unavailable to the local network. What do I want? I want to have access to SAP/Oracle from only a few IP addresses and all other services blocked (except ssh which should be public). I have tried to use SuSEfirewall without success (it won't start if I do not specify an extrenal device and if I specify it, I lock myself). Any suggestions? Thanks, Dietmar

1 0

how do I build iptable-protection for scanners like nmap
by Ruprecht Helms 28 May '03

28 May '03

Hi, how have I to write a iptablerule to protect my box against portscanning with tools like nmap. Regards, Ruprecht

6 10

Re: [suse-security] how do I build iptable-protection for scanners like nmap
by Azman Salleh 28 May '03

28 May '03

RE: [suse-security] how do I build iptable-protection for scanners like nmapMichael, Seems to me that ipchains equivalent to "! --syn" is "! -y", but wouldn't "iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP " drop ANY incoming connections from internet? This would even drop valid http requests, not just the stealth portscans. Thank you, Azman Salleh ----- Original Message ----- From: Paxton, Michael To: 'Azman Salleh' Sent: 28 May, 2003 11:41 AM Subject: RE: [suse-security] how do I build iptable-protection for scanners like nmap Hi Azman Basically it says: If you are not establishing a new connection (! --syn) and you are not an established connection (-m state --state NEW) drop the packet. The stateful side of things I dont think you can do with ipchains.. Michael > -----Original Message----- > From: Azman Salleh [mailto:azmansal@nti.com.my] > Sent: Wednesday, 28 May 2003 11:32 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] how do I build iptable-protection for > scanners like nmap > > > Sounds like something I can adapt into my *ipchains* rules. > But why use "!--syn -m state --state"? Anybody can explain? > > Thank you, > Azman Salleh > ----- Original Message ----- > From: "Πλαστήρας Αθανάσιος" <t.plastiras(a)gsis.gov.gr> > To: <suse-security(a)suse.com> > Sent: 27 May, 2003 1:27 PM > Subject: Re: [suse-security] how do I build > iptable-protection for scanners > like nmap > > > > > > Good Mornning... > > > > To Drop Stealth Scan like nmap you can use the following > rules in a simple > > firewall with iptables: > > > > iptables -A INPUT -p tcp ! --syn -m state --state NEW -j > > LOG --log-prefix "Stealth scan" > > iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP > > > > Thanos... > > > > > > Athanasios Plastiras > > Greece > > Athens > > > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

8.2, UW IMAP-2002 and Squirrelmail - SSL...
by Niclas Arndt 27 May '03

27 May '03

This posting concerns how to connect Squirrelmail (imap only) to UW IMAP-2002 (imaps only). Please see the questions further down. I have a fully functioning installation of 8.2 Pro, Postfix, UW IMAP-2002, Apache, OpenSSL and modSSL with self-signed working certificates. All software as included on the CDs and Online Update. I have also followed the instructions given in the mailing lists and on the SuSE support database regarding SSL, certificate and UW IMAP-2002. I can access UW IMAP-2002 with a Netscape 7 mail client using SSL, so everything is set up correctly. Finally, I need webmail and guess that Squirrelmail would be a good solution. However, since UW IMAP-2002 by default is built with imaps only and Squirrelmail only supports imap, I am stuck. Various people have suggested using * UW IMAP-2001 from SuSE 8.1 (I would rather not use an older software) * Building your own IMAP-2002 with imap support (Somebody had had problems building UW IMAP-2002 himself. I have sent a request to SuSE support about them building a second version (including supporting it via Online Update) and am waiting for the reply.) * stunnel (but does it support communication in the desired direction? Isn't it intended to work in the opposite way?) * SSH session ---> Questions: ---> Suggestions/arguments about how to solve or work around this problem? ---> Do you know if stunnel would do the trick and how I would have to configure it? Regards /Niclas Arndt ================ >From: Björn Róbertsson <bjornr(a)iceland2000.com> >To: "'David Soltero-Lugo'" <david(a)cnnet.upr.edu> >CC: <R.Vickers(a)cs.rhul.ac.uk>, <bobv(a)cs.rhul.ac.uk>,<vbru(a)entu.cas.cz>, ><suse-security(a)suse.com> >Subject: RE: [suse-security] IMAP and 8.2 >Date: Sat, 17 May 2003 16:19:07 -0000 > >Just have a look at then config file in /etc/stunnel/stunnel.conf > >It has a [ ] section for imaps, uncomment and start the service, >/etc/init.d/stunnel start > >You should see a listening port on 993, netstat an |grep 993 > >And then you should be able to configure your mail client to use SSLed >imap. > > > >For maximum security you should only allow imap connections from localhost. > > > >Next is to use smtps (secure smtp) to send mail... > > > >Bjorn Robertsson > > > >-----Original Message----- >From: David Soltero-Lugo [mailto:david@cnnet.upr.edu] >Sent: 17. maí 2003 14:20 >To: Björn Róbertsson >Cc: R.Vickers(a)cs.rhul.ac.uk; bobv(a)cs.rhul.ac.uk; vbru(a)entu.cas.cz; >suse-security(a)suse.com >Subject: Re: [suse-security] IMAP and 8.2 > > > > >I tried the inet option (on xinetd) and did not work, can you provide mor >information on the stunnel option?? > >Thanks >David > >Björn Róbertsson wrote: > > > >I also discovered that my ssl'd imapd service had stopped working. I'd >created stunnel connection and I found in /etc/stunnel a config file which >allowed for a very simple configuration... > >This however requires the service stunnel started and you need to remove >the corresponding imap/pop lines from /etc/inetd.conf > >Hope to help :) > >Bjorn Robertsson > >p.s. I use cyrus so the cyrus config does not need to know imaps if you >use stunnel. > > > >Vaclav, > >Yesterday we too upgraded our mail server and discovered this change >that SuSE quietly introduced. It sounds like you have done the hard >part; to configure inetd.conf to support SSL-enabled IMAP and POP you >just need lines > imaps stream tcp nowait root /usr/sbin/tcpd imapd > pop3s stream tcp nowait root /usr/sbin/tcpd ipop3d > >I've found it very hard to find good documentation on how to set up an >IMAP service that does not use plaintext passwords. > >Bob > > >On Wed, 14 May 2003, Vaclav Brunnhofer wrote: > > > >Being prevented here in this group that the support for 7.2 would >finish in the near future (see another thread), I have purchased and >upgraded to 8.2. > >So far, almost everything is working as expected, expect for IMAP (the >same case would be POP3, if I would not use qpopper). >In the mean time, I have found information that the IMAP rpm, shipped >with 8.2 (IMAP 2002) is a major release, enabling to disable fulltext >passwords for identification. Apparently the rpm shipped with 8.2 is >compiled with this in mind. So far it is good, but I cannot find any >information, how to make it work. I have found that it is necessary to >use starttls - a ssl based authentification. > >Just I cannot find (may be I am using incorrect queries in google) how >to setup the IMAP server - I have found how to configure the clients, >how to compile IMAP for disabling authetification by plaintext >passwords, but I am missing information, how to configure inetd (or >even xinetd) to work with this imap daemon. The same applies for >ipop3, just I have installec qpopper and this works fine. > >SuSE installation support claims it is beyond the scope of >installation support. > >Does anyone know how to make the imap over startls or ssl work? >Thanks a lot > >S pozdravem > >Vaclav Brunnhofer > >======================================================== >======= >| Entomologicky ustav e-mail: vbru(a)entu.cas.cz | >| Akademie Ved Ceske Republiky tel.: 038 7775251 >| >| Branisovska 31 fax: 038 5310354 | >| 370 05 Ceske Budejovice mobil: +420 606 632822 | >======================================================== >====== > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > > >============================================================== >Bob Vickers R.Vickers(a)cs.rhul.ac.uk >Dept of Computer Science, Royal Holloway, University of London >WWW: http://www.cs.rhul.ac.uk/home/bobv >Phone: +44 1784 443691 > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > > > ---------------------- > > From: Jethro Cramp <jsc_lists(a)rock-tnsc.com> Reply-To: jsc_lists(a)rock-tnsc.com To: "suse-linux-e(a)suse.com" <suse-linux-e(a)suse.com> Subject: Re: [SLE] Squirrelmail & Imap Login Error, SuSE 8.2 - Authentication Date: Mon, 19 May 2003 10:13:07 +0800 FYI, this is how I setup imap to work on SuSE8.2 so that I could log in. Firstly I added the following section to /etc/xinetd.d/imap # imaps - imap mail daemon with ssl service imaps { socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/imapd flags = IPv4 } # Then I created a new ssl certificate with: openssl req -new -x509 -nodes -out imapd.pem -keyout imapd.pem -days 365 The resulting file is called imapd.pem which I then copied to /etc/ssl/certs. And bingo authentication worked. I'm using Kmail 1.5.1 and I can't make new imap folders, but I can from Mozilla. Anyone know if this is just not yet developed in kmail yet, or we need to do some voodoo to make it work. Thanks, Jethro > _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

KMail - Authorization
by Istvan Hollo 27 May '03

27 May '03

Hello List, SuSE 8.2, KMmail -> Receive mails... I got an error message: "Unknown AUTHORIZATION state command". Can someone of you explain me what could be the problem? thanks, istvan

2 1

host ignores redirects
by Stelios 27 May '03

27 May '03

Hello guys I have a server running SuSE 8.1/Sendmail and squirrelmail for web access on imap mailboxes. The problem is that noone can log on successfully through the squirrelmail, i am taking the error : You must be logged in to access this page and at the same time my logs are showing the following: host 192.0.2.244/if2 ignores redirects for 155.63.247.208 to 155.219.155.161 (examples ips) Any suggestions? Thanks

2 2

question to iptables with ippp0
by Ruprecht Helms 26 May '03

26 May '03

Hi, how can I use a selfdefined iptables ruleset with ippp0. The firewallsetting must be able react by changing the ipaddress of my isdn-card after connecting with my isp and the receipt of the new ipaddress Regards, Ruprecht

3 2

Validity period of GPG-keys
by Jan Dirnberger 26 May '03

26 May '03

Hi! I'm working on a school project, including Public Key Infrastrucure (PKI). We are instructed to get out how long the validity period of a GPG-key should be set in a company or other organisations the info-material we collect is for. First I wanted to advise a unrestricted validity, but then I remembered that organisations or enterprises might have often changing memebers. So I'm caught between the devil and the deep blue sea what to advise... I tried to find out with Google, but there aren't any publications including these information. Thanks for any advises or experiences! Greetings, Jan PS: My english is quite bad but I hope all necessary information can be understood ;)

2 1

KMail and GPG
by Oliver Schwabedissen 26 May '03

26 May '03

Hello, I currently have a problem with signing and encrypting my email and have no idea what went wrong sudeenly... I installed GnuPG v1.2.2 last week, generated a key and configured KMail v1.5 (I'm running SuSE 8.0 with KDE 3.1) to use this key to sign all outgoing mail that has my standard identity in the From field. Two days later I installed "Ägypten" so that KMail is able to support OpenPGP and PGP/MIME. Everything was fine until last weekend, when KMail suddenly started to reject my passphrase saying I entered an invalid passphrase. I have no idea why KMail keeps rejecting it. I can encrypt and decrypt files using gpg on command line without problems, gpg accepts my passphrase. Somebody here with an idea what's wrong with KMail (or gpg)? I don't want to revoke the key and generate a new one... Bye, Oliver

2 2

.rhost everybody access
by Joao Reis 26 May '03

26 May '03

Hi to all. How do i give permission to rlogin to an account by everybody from any host. I tried "* *" and i didn't work Any suggestion? Thanks -- "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

9 10

CA-2003-10 SunRPC XDR glibc updates still missing?
by Herbert Huber 25 May '03

25 May '03

I still have the impression that SuSE has not delivered an update for the Sun RPC XDR bug, which has been posted by CERT on Wed., 19 March 2003. This bug has been fixed by other linux distributors as weel as commercial UNIX flavours like AIX, solaris and IRIX weeks ago. So what's going on here ...? Should the LRZ migrate it's 280 Linux nodes to RedHat, because they are much faster in releasing updates? Or does SuSE propose us to migrate to SLES, because it will in future garantee really fast updates only for it's commercial product lines? Regards, H. Huber

2 1

Re: [SLE] Why does loopback encryption only work when loopback is compiled as a module
by Bo Jacobsen 24 May '03

24 May '03

When "loopback device support" and "Twofish encryption for loopback device" is compiled INTO the kernel, the "losetup -e twofish /dev/loop0 /encrypted-file" command fails with the error: "ioctl: LOOP_SET_STATUS: invalid argument" If they are compiled as modules, everything works OK. I have tred it with many versions of the SuSE kernels, and the result is always the same !. Any suggestions on how to get it to work. Thanks in advance Bo Jacobsen -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq(a)suse.com

1 0

Why does loopback encryption only work when loopback is compiled as a module
by Bo Jacobsen 24 May '03

24 May '03

When "loopback device support" and "Twofish encryption for loopback device" is compiled INTO the kernel, the "losetup -e twofish /dev/loop0 /encrypted-file" command fails with the error: "ioctl: LOOP_SET_STATUS: invalid argument" If they are compiled as modules, everything works OK. I have tred it with many versions of the SuSE kernels, and the result is always the same !. Any suggestions on how to get it to work. Thanks in advance Bo Jacobsen

1 0

Re: [suse-security] What's keeps changing my inet.d sequence (not entirely security related)
by John Andersen 24 May '03

24 May '03

On Wednesday 21 May 2003 01:11, Matt Gibson wrote: > To get it to apply the right sequence, check the "### BEGIN INIT INFO" > section of the script. If you specify in there that it depends on the > firewall (use the Required-Start line to specify whatever's in the Provides > line in the firewall script) then it should get automatically shuffled into > the right place. Check out the init.d and insserv man pages for more > details. Ah, now if that works it would be great. The man pages left the impression that only those services mentioned in the /etc/insserv.conf could be mentioned there And my tests with the following in the firewall script: # Provides: shorewall # Required-Start: $network vmware # Required-Stop: # Default-Start: 2 3 5 # Default-Stop: 0 1 6 # Description: starts and stops the shorewall firewall Were unsuccessfull in getting the thing to force vmware to load first. Infact the insserv -d command halted saying vmware was not enabled, yet chkconfig said it was. Maddening. If i manually set it and stay away from insserv it will stay put, but one trip thru yast and I have to adjust it again. thx anyway. -- _____________________________________ John Andersen

3 4

DMZ egress access problem
by maarten van den Berg 23 May '03

23 May '03

Hi, I have a bit of a problem connecting from DMZ to the outside world. I have a DMZ with real IP numbers (not masqueraded) and the corresponding routing setup (which is working just fine). I allow port 80 and 22 to the DMZ, which is working great too. But... The problem is that from a DMZ host one cannot download patches; no DMZ -> internet connection is allowed at all and I cannot find a (safe) solution. These are my settings: Outside net X.Y.Z.144/28 DMZ net X.Y.Z.160/28 LAN 192.168.1.0/24 My outside I/F is X.Y.Z.146. DMZ I/F is X.Y.Z.161 These are the relevant sections of SuSEfirewall I have configured FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth0 eth2" FW_FORWARD="0/0,X.Y.Z.160/28,tcp,80 0/0,X.Y.Z.160/28,tcp,22 X.Y.Z.160/28,0/0" That last rule should allow access to internet, right ? But it doesn't. With a sniffer I see packets leaving the firewall and they come back to eth0 whereafter they disappear. So probably the rule that should allow it back (I mean the smart <established,related> rule) doesn't apply or it has a bug. If I add this bit it works,but then I open up the entire DMZ again (evil) 0/0,X.Y.Z.160/28 And since I cannot define SOURCE portnumbers in FW_FORWARD, only DEST portnumbers, I see no workaround. Because obviously the destination ports are random >1024 ports. The construct 0/0,tcp,80,X.Y.Z.160/28 is not allowed according to the docs. Or is it...? (And besides, that is not very safe since anyone could then spoof that source port number anyway) I can probably solve it by patching some things around inside the real firewallscript but that is not why I'm writing this... I wonder how you are _supposed_ to solve this in the proper way. Are my rules wrong, or do you all disregard the FW_FORWARD line entirely and do it all from one of the hooks in the FW_CUSTOMRULES file ? I searched these mailarchives but a solution is not easy to find. For one, just looking for "DMZ" obviously gives thousands of hits and more importantly everyone seems to use a masqueraded DMZ anyway (As do the SuSE examples) so that does not really apply to my situation. Any insights ? Maarten

3 3

Re: [suse-security] What's keeps changing my inet.d sequence
by John Andersen 23 May '03

23 May '03

On Thursday 22 May 2003 09:57, Arjen de Korte wrote: > On Thursday 22 May 2003 10:08, John Andersen wrote: > > I'm taking this off-list, since I can't find anything security related to > this thread... > > [ > ...] > > > I have a similar case. > > > > In my case, insserv insists on starting Shorewall AFTER vmware > > in spite of my having vmware as a pre-requsite to shorewall. > > So? This is correct. If you put vmware in the list of Required-Start, it > will place the link to the shorewall startup script AFTER the link to the > vmware startup script. Provided that you have used insserv to enter vmware > in the runlevel directories as well. I mis-typed. I meant to say that shorewall starts BEFORE vmware even though I have this in the Shorewall script: #### BEGIN INIT INFO # Provides: shorewall # Required-Start: $network vmware # Required-Stop: # Default-Start: 2 3 5 # Default-Stop: 0 1 6 # Description: starts and stops the shorewall firewall ### END INIT INFO ---- > > But the METHOD of changing the names (hence the order) of the > > runlevel scripts is all we are discussing, the fact that you MUST > > change the script name to change the order is a given. > > The name of the script has nothing to do with it. See for yourself in the > /var/log/boot.msg file. It is the (alphabetical) order of the links to the > scripts in /etc/init.d/rc?.d that matters. Yes, of course, I was referring to the names of the links, as I mentioned in the part you clipped where I said: As you know, the alphabetical order of the links in the /etc/init.d/rc?.d directory sets the order they are run. If those are wrong the Optimum way you make them right is setting the Required-Start list to include network and running insserv. I originally thought your first post implied that these orders should never be changed because of what you said: "I'm still not convinced of a valid reason to change the startup order." It now seems that we fully agree that changing the start up order is necessary and the method to do so involves manipulating the names of the links, either manually or via insserv My problem remains that insserv was failing to honor the Required-Start as listed in the above snip of my shorewall script However, while putting together this message I noticed that the vmware script has these lines in it... ### BEGIN INIT INFO # Provides: VMware # Required-Start: $network $syslog # Required-Stop: # Default-Start: 3 5 # Default-Stop: # Description: Manages the services needed to run VMware software ### END INIT INFO The name of the script is "vmware" and thats the name I used inside my shorewall script for the "Required-Start". But I just noticed that the CaPiTaLiZaTiOn of the vmware script name differs with its "Provides" list. Running some tests with the capitalization corrected shows that it does indeed work. Grep-ing the scripts, I see that the vmware script is the ONLY one where the "Provides" differs in capitilzation from the script name. A trap for the unwary. I stand corrected. I hope you don't mind me putting this BACK on the security list, because a) that's where I badmouthed insserv and so should post my retraction there, b) it has a chance of being picked up by google there and that might help the next guy, and c) one's firewall failing to start because of a capitalization error is a security issue in my eyes. -- _____________________________________ John Andersen

2 1

Routing table DOS: Can someone from SuSE comment on this?
by Frank Steiner 23 May '03

23 May '03

Hi, sorry that I ask again (like some other mails did before)! I know that the SuSE security people always have a lot of work. But it would be nice if we could get at least a short comment like "we are working on a bugfix" or "we are investigating if our kernel is vulnerable". Just to know if this is a problem in the SuSE kernel or not and if a fix is developed... Best regards, Frank -- Dipl.-Inform. Frank Steiner Mail: fst(a)bio.informatik.uni-muenchen.de Lehrstuhl f. Bioinformatik Mail: frank(a)familiesteiner.de LMU, Theresienstrasse 39 Phone: +49 89 2180-4049, Fax: -4054 80333 Muenchen, Germany http://www.informatik.uni-kiel.de/~fst/ * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

2 1

Problems Understanding SuSEfirewall2
by remote 22 May '03

22 May '03

Hi ! I seem to have a problem with SuSEfirewall2. I administrate a Linux router (SuSE 8.0) for a small network. This router serves as a gateway to the Internet as well as a firewall between the Net and my LAN. The LAN`s mail server is also located on this machine, while the web server ist on 100.120.55.2. Every PC in the LAN has a public IP, so I have to use routing without masquerading. The firewall is supposed to block all traffic between the Internet and the LAN except for the following protocols/ports : pop3, pop3s, http, https, ftp, ftps, smtp, ssh, domain. I also have to keep the port 7271 open for licensing purposes. Following the example files I built the Config-file listed below. However, I am not really satisfied with its performance. For example, it should not be possible to establish a ftp- connection from the outside to one of my LAN computers, but the firewall doesn´t prevent this at all. Also I want only certain outside machines to be able to connect to port 7271 on a certain computer within the LAN, yet it seems everybody can. What did I do wrong ??? BTW, the IPs in the config-file below were changed, just to be on the safe side. Please help ! Thanks in advance, Jörg PS : Please reply to JLeicher(a)gmx.de, since I have not subscribed to this mailing list. Here comes /etc/sysconfig/SuSEfirewall2 : FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="no" FW_MASQ_DEV="" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="20 21 22 25 53 80 110 995" FW_SERVICES_EXT_UDP="53" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="20 21 22 25 53 80 110 995" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="100.120.55.0/6,0/0,tcp,80 / 100.120.55.0/6,0/0,tcp,110 / 100.120.55.0/6,0/0,tcp,22 / 100.120.55.0/6,0/0,tcp,25 / 100.120.55.0/6,0/0,udp,53 / 100.120.55.0/6,0/0,tcp,53 / 100.120.55.0/6,0/0,tcp,995 / 0/0,100.120.55.2,tcp,80 / 100.120.204.51,100.120.55.18,tcp,7127 / 100.120.204.56,100.120.55.18,tcp,7127 / 100.120.204.58,100.120.55.18,tcp,7127 " FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"

3 4

Re: [suse-security] SSH and CHROOT alternatives...
by jonathanneto＠indg.com.br 22 May '03

22 May '03

Hi, I never did what you mean but here is what I have in mind. The problem with chroot with ssh (if it really can be run this way), seems to be that the users could not access /bin /usr/bin,etc so they can not even list files using ls. Of course you can copy this directories to the chrooted directory. To access the home you could use a workaround mounting the homes with nfs and using iptables to allow only localhost to use nfs at all. I think the easiest way is to get another machine just for ssh, and mount the home using nfs as soon as user logs in. You can also replace nfs for another network file system like samba. You can also forget about chroot and treat with the filesystem permission, puttin 700 mode on the directories you dont want users to access. Eg. you can let users access /usr, but not /var. In this case care must be taken on directories like /etc. Hope it helps Regards Jonathan > Howdoo all, > > I've been looking at trying to secure SSH sessions so that specified users > can > only browse their home diretories. > > I've found a couple of bodges that can be made to do the trick, but none of > them seem particulalry ideal. > > Has anyone got any suggestions on how I could secure SSH in this fashion, > whether using CHROOT or something else entirely I don't mind. > > Cheers. > > > > ----~~~~==oOo==~~~~---- > Duncan Carter > ----~~~~==oOo==~~~~---- > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

4 3

SuSEfirewall2 DMZ, FW_FORWARD, POSTROUTING & PREROUTING
by Radko L 22 May '03

22 May '03

Hi I have some question connected with SuSEfirewall2 if I have real IP for DMZ network and in DMZ network used squid server is needed to allow connections from DMZ to public internet and respons for them request in FW_FORWARD if I have to do it I can to allow DMZ to internet conncetion but how to do firewall not to block response on DNZ squid server request? /the prblem are there that connections from squid server comming form diferent ports/ The second question is when SuSEfirewall2 loaded and running if I made iptables -L -n there no POSTROUTING and PREROUTING chain? I thought that this chains exist by default in iptables? __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

1 0

glibc update
by Graham Murray 22 May '03

22 May '03

What architecture is the 2.2.5-177 glibc update for 8.1? Currently I am running the i686 version and do not want to 'downgrade' to a 386 or 586.

3 3

SuSEfirewall2 and trusted nets
by Jörg Brandenburg 22 May '03

22 May '03

My linux box runs with SuSe 8.2, SuSEfirewall2 and one NIC (eth0). I want to restrict the access to the web server to only one allowed client. But the web server is only accessible to the trusted client (and the whole world) if I add the web-service to FW_SERVICES_EXT_TCP. Has anybody out there an idea? My configuration is: FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="<ip-of-trusted-client>,tcp,80" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS ntp" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

1 0

rcsshd reload
by Hofmann Informatik 22 May '03

22 May '03

Hello, I updated to mod_php4 4.2.2-215/mod_php4-core 4.2.2-215 Now when a user loggs in he's forced to relogin after each click. I guess that it has something to do with php.ini but...... Any clues are welcome. btw: register_globals = On Thanks Best regards Sandro Trinkler

1 0

What's keeps changing my inet.d sequence
by John Andersen 22 May '03

22 May '03

Something in SuSE 8.1 insists on changing the sequence of my start scripts in /etc/init.d/rc3.d and /etc/init.d/rc5.d to its idea of the perfect start order. What is it, where can I change it, and how can I get it to leave my sequence alone? It insists on starting my shorewall firewall before vmware, which causes a failure. -- _____________________________________ John Andersen

7 12

SuSEFirewall long lines
by Jeff Harris 21 May '03

21 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As I work on my firewall, I'm getting some long lines in the /etc/sysconfig firewall file. What is the correct way to wrap the lines? Thanks, Jeff - -- Registered Linux user #304026. "lynx -source http://www.rallycentral.us/~linux/jharris.asc | gpg --import" or "gpg --keyserver pgp.mit.edu --recv-key BD23A31E" Key fingerprint = FB8C 3210 8DE1 78F4 6505 5918 0C34 BE94 BD23 A31E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE+y802DDS+lL0jox4RAo3WAJoCuMlyHsolZ3vaHnOvYiuo0RDZWACdHfOk mJgJaCF0TWfwKetNqfROiWw= =dp1W -----END PGP SIGNATURE-----

2 1

CA-2003-10 SunRPC XDR glibc
by Helge Hansemann 21 May '03

21 May '03

Hi, without the attention to annoy anyone, I would like to ask for some information about the current status of the fixed glibc. Is there a release date ? Thanks and greetings, Helge Hansemann

1 0

Re: IMAP and 8.2
by Peter Hinterseer 21 May '03

21 May '03

> David, > > stunnel does not work with the imap-2000 package supplied by SuSE 8.2. > You have to find an imapd implentation that supports plain text logins. > > The point of stunnel is to convert an insecure imap server into a secure > one. SuSE blew this apart by building imapd in such a way that it would > not support this. > > Bob Hi! This is not entirely true. SuSE's imap-2002 package released with 8.2 has to be enabled to accept plaintext passwords. This is easily done by creating a file '/etc/c-client.cf' with the following content: -- I accept the risk set disable-plaintext 0 -- WIthout the '--' of course... ;-) Have fun, Peter

2 1

A fax problem...
by Chris Bek 21 May '03

21 May '03

Hi there SuSErs, I don't really know if this list is apropriate for such a question so please correct me if I am wrong. I have installed HylaFax (on my SuSE 7.2 machine which acts as a server for 5 Win9X machines) and everything is working fine, the program is sending and receiving faxes, upon reception, it sends an e-mail to the FaxMaster etc.... All is ok. The problem is that the received files cannot be viewed by any user due to the fact that the permissions are set for root only. Can anyone tell me how can I change this so that everyone can view these faxes? Thank you in advance! Chris

1 0

AW: [suse-security] What's keeps changing my inet.d sequence
by Schreiner, Dirk 21 May '03

21 May '03

This evil thing called yast.... Dirk -----Ursprüngliche Nachricht----- Von: John Andersen [mailto:jsa@pen.homeip.net] Gesendet: Mi 21.05.2003 10:39 An: James Ogley; Security List Cc: Betreff: Re: [suse-security] What's keeps changing my inet.d sequence On Wednesday 21 May 2003 00:32, James Ogley wrote: > > Something in SuSE 8.1 insists on changing the sequence > > of my start scripts in /etc/init.d/rc3.d and /etc/init.d/rc5.d > > to its idea of the perfect start order. > > What is it, where can I change it, and how can I get > > it to leave my sequence alone? > > Read man insserv But I never run it, (because I've discovered running it specifying a specific service file STILL causes it to adjust all files - Bug I think). So who/what is running insserv? -- _____________________________________ John Andersen -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here TRIA IT-consulting GmbH Rosenkavalierplatz 4 81925 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Hubertus Wagenhäuser -------------------------------------------------------- Nachricht von: Dirk.Schreiner(a)tria.de Nachricht an: jsa(a)pen.homeip.net, james.ogley(a)pinnacle.co.uk, suse-security(a)suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

1 0

update openssh
by patrick thempel 21 May '03

21 May '03

hi evryone, heres my question, i want to update my openssh , the original one that came with suse8.0 tried to download the patch or the full rpm, from the security annoncement page ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-4.i386.patch… only downloaded 0 bytes ( several times) updating with the new openssh from 8.2 didnt work, needs libraries.so6 and insserv that are not part of 8.0. didnt want to go into a session of rpm.what provides what , cause most of the times i ended up with needing to install most of my system . didnt want to say f... the dependencies just update. any solutions? where can i get the patch, or is it save to just rpm --nodeps openssh3.5.something? thanx in advance ===== Mit freundlichen Gruessen Patrick Thempel mail:patrick_thempel@yahoo.com __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

5 5

QPopper 4.0.3.-178 + dracd + "Relay access denied"
by Manfred Rebentisch 20 May '03

20 May '03

I installed the patch for SuSE 8.0-Qpopper: linuso:/var/cache/fou4s/packages/ftp.gwdg.de/i386/update/8.0/n4 # popper -v Qpopper Modified by SuSE version 4.0.3 (non-standalone) linuso:~ # rpm -qa | grep popper qpopper-4.0.3-178 linuso:/var/cache/fou4s/packages/ftp.gwdg.de/i386/update/8.0/n4 # popauth -version popauth v4.0.3 After this it is not possible for the external users to authentificate with smtp. The mail.log shows like this: May 19 18:03:28 linuso postfix/smtpd[1638]: connect from unknown[195.243.195.231] May 19 18:03:28 linuso postfix/smtpd[1638]: 743BCCF4: client=unknown[195.243.195.231] May 19 18:03:28 linuso postfix/smtpd[1638]: reject: RCPT from unknown[195.243.195.231]: 554 <MRebentisch(a)comparat.de>: Recipient address rejected: Relay access denied; from=<ingo(a)net-market.de> to=<MRebentisch(a)comparat.de> May 19 18:03:36 linuso postfix/smtpd[1638]: disconnect from unknown[195.243.195.231] In postfix's main.cf is the entry: smtpd_recipient_restrictions = permit_mynetworks, check_client_access btree:/etc/postfix/dracd, check_sender_access btree:/etc/postfix/dracd, check_relay_domains I think, that qpopper is not compiled for dracd ? Or is there another reason for the "Relay access denied"? Manfred Rebentisch -- COMPARAT Software-Entwicklungs-GmbH Mobile Voice Solutions Prießstr. 16, 23558 Lübeck Tel: 0451/479 56 60 Fax: 0451/871 090 26 http://www.comparat.de http://www.mobile-voice.de

1 1

SuSEfirewall2 question?
by Radko L 20 May '03

20 May '03

I have SuSE 8.1 and I roun pptp server on it I'm configurated SuSEfirewall2.conf but I want to put for external interface and any ppp connection when I tried ppp0 ppp1 and so on, everithink work but I want to ask you is there any other way like ppp+ and this to match any ppp0, ppp1 ... connection I've tried it but it doesn't work Could you help me how to do that? Regards __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

1 0

FW_FORWARD_MASQ
by Andre Vorster 20 May '03

20 May '03

Hi All I am trying to setup SuSEfirewall2 to forward & Masq to a Microsoft web server on my internal LAN The website runs ASP scripts so I can't, as far as I know hosts it on apache. Shoot the damm developer !!!! The websites IP is 196.25.208.26, I created a virtual adapter eth1:1 with IP 196.25.208.28. I Have FW_DEV_DMZ="eth1:1" - (IP-196.25.208.26) FW_FORWARD="196.25.208.28,10.0.0.7" - (10.0.0.7 is the private IP of my web server) FW_FORWARD_MASQ ="0/0 10.0.0.7,tcp,80" But it does not work ? Thanks Andre South Africa

3 2

SuSEfirewall2, 3 nics, 2 ISPs, NAT, iproute2, dual routing tables... oh the humanity!
by nhoward＠wichitavalley.com 19 May '03

19 May '03

I am about to build a frankenstein monster out of my SuSE 8.1 Linux internet server / NAT router-firewall machine.... at least I'm going to try. Presently the machine has two nics in it, one is the external internet nic and the other is an internal network nic, with an rfc1918 address, in the classic firewall/router/bastion-host setup. I presently have a wireless ISP who gives me a static IP address, and the bandwidth is good enough for hosting my vanity domain name web and email servers but is not always so good (too much packet delay/latency) for my online game playing from windows boxes on my interior network which is NAT'ed by the Linux box as my internet router and firewall machine. Let's call this one ISP "A". I just signed up for a broadband cablemodem connection, which will only give me a dynamic ip address that will change frequently. Let's call this one ISP "B". I wish to add a third nic into my Linux machine and have it connected to both ISP's and have all my web/email/ssh server traffic running on that Linux machine routed out to the internet via the nic connected to ISP "A" and have my NAT'ed interior network traffic from the windows boxes routed out via the nic connected to the cablemodem ISP "B". Now if it weren't for my SuSEfirewall2 settings coming into play, I think I can do this via setting up two different routing tables and taking advantage of iproute2's abilities... I've found some config examples on usenet and have read the howto at http://lartc.org/howto/lartc.rpdb.multiple-links.html to get the basic networking stuff supporting this abominable nightmare, but I have grown too comfortable with my SuSEfirewall2 settings which make me feel safer against keeping the booger-man out of my Linux machine and the various other machines I have NAT'ed behind the Linux machine. From what I've been able to see with my limited knowledge of SuSEfirewall2, it seems that this wonderful iptables management tool is geared primarily for the model of having one external nic, one internal nic, and perhaps also a "dmz" third nic. Can the SuSEfirewall2 in SuSE 8.1 (in present form as shipped) support both my external nics and two ISP's and the multiple routing tables mess that I desire to have the best of both worlds? If so, can anyone possibly point me to some configuration examples showing me how to protect against evil traffic coming inbound from both external interfaces while still allowing desired traffic coming inbound from both nics, and allowing my desired outbound traffic to go out the appropriate nic as specified in the respective routing table? Also, as if I'm not enough of a glutton for punishment... I may even wish to add a fourth nic in the futire to be a NAT'ed "DMZ" of sorts on yet another rfc1918 network address separate from my windows network, for the purpose of placing a dedicated UT2003 server machine. Am I asking for too much in expecting to be able to do this all with one single Linux machine? I know it would probably be simpler to have dual machines (or just get a cheap Linksys router), one for each ISP, but I'm a cheap bastard who is out of money now after paying for two ISPs and would like to try to make all this complicated mess work on a single Linux box. Thanks for any help. Neal

1 0

Re: [suse-security] IMAP and 8.2
by Bob Vickers 19 May '03

19 May '03

David, stunnel does not work with the imap-2000 package supplied by SuSE 8.2. You have to find an imapd implentation that supports plain text logins. The point of stunnel is to convert an insecure imap server into a secure one. SuSE blew this apart by building imapd in such a way that it would not support this. Bob On Sat, 17 May 2003, David Soltero-Lugo wrote: > > I tried the inet option (on xinetd) and did not work, can you provide > mor information on the stunnel option?? > > Thanks > David > > Björn Róbertsson wrote: > > >I also discovered that my ssl'd imapd service had stopped working. I'd > >created stunnel connection and I found in /etc/stunnel a config file which > >allowed for a very simple configuration... > > > >This however requires the service stunnel started and you need to remove > >the corresponding imap/pop lines from /etc/inetd.conf > > > >Hope to help :) > > > >Bjorn Robertsson > > > >p.s. I use cyrus so the cyrus config does not need to know imaps if you > >use stunnel. > > > > > > > >>Vaclav, > >> > >>Yesterday we too upgraded our mail server and discovered this change > >>that SuSE quietly introduced. It sounds like you have done the hard > >>part; to configure inetd.conf to support SSL-enabled IMAP and POP you > >>just need lines > >> imaps stream tcp nowait root /usr/sbin/tcpd imapd > >> pop3s stream tcp nowait root /usr/sbin/tcpd ipop3d > >> > >>I've found it very hard to find good documentation on how to set up an > >>IMAP service that does not use plaintext passwords. > >> > >>Bob > >> > >> > >>On Wed, 14 May 2003, Vaclav Brunnhofer wrote: > >> > >> > >> > >>>Being prevented here in this group that the support for 7.2 would > >>>finish in the near future (see another thread), I have purchased and > >>>upgraded to 8.2. > >>> > >>>So far, almost everything is working as expected, expect for IMAP (the > >>>same case would be POP3, if I would not use qpopper). > >>>In the mean time, I have found information that the IMAP rpm, shipped > >>>with 8.2 (IMAP 2002) is a major release, enabling to disable fulltext > >>>passwords for identification. Apparently the rpm shipped with 8.2 is > >>>compiled with this in mind. So far it is good, but I cannot find any > >>>information, how to make it work. I have found that it is necessary to > >>>use starttls - a ssl based authentification. > >>> > >>>Just I cannot find (may be I am using incorrect queries in google) how > >>>to setup the IMAP server - I have found how to configure the clients, > >>>how to compile IMAP for disabling authetification by plaintext > >>>passwords, but I am missing information, how to configure inetd (or > >>>even xinetd) to work with this imap daemon. The same applies for > >>>ipop3, just I have installec qpopper and this works fine. > >>> > >>>SuSE installation support claims it is beyond the scope of > >>>installation support. > >>> > >>>Does anyone know how to make the imap over startls or ssl work? > >>>Thanks a lot > >>> > >>>S pozdravem > >>> > >>>Vaclav Brunnhofer > >>> > >>>======================================================== > >>>======= > >>>| Entomologicky ustav e-mail: vbru(a)entu.cas.cz | > >>>| Akademie Ved Ceske Republiky tel.: 038 7775251 > >>>| > >>>| Branisovska 31 fax: 038 5310354 | > >>>| 370 05 Ceske Budejovice mobil: +420 606 632822 | > >>>======================================================== > >>>====== > >>> > >>> > >>>-- > >>>Check the headers for your unsubscription address > >>>For additional commands, e-mail: suse-security-help(a)suse.com > >>>Security-related bug reports go to security(a)suse.de, not here > >>> > >>> > >>> > >>============================================================== > >>Bob Vickers R.Vickers(a)cs.rhul.ac.uk > >>Dept of Computer Science, Royal Holloway, University of London > >>WWW: http://www.cs.rhul.ac.uk/home/bobv > >>Phone: +44 1784 443691 > >> > >> > >> > >>-- > >>Check the headers for your unsubscription address > >>For additional commands, e-mail: suse-security-help(a)suse.com > >>Security-related bug reports go to security(a)suse.de, not here > >> > >> > > > > > > > > > > ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Antw: [suse-security] Problems Understanding SuSEfirewall2
by petry 19 May '03

19 May '03

Hello, as I recognize so far you use active ftp (port 20, ftp-data). IMHO it is a quite large security hole. We only allow passive ftp connections. Try http://slacksite.com/other/ftp.html for some explanation. Greetings Olaf ____________________________________________________ Fa. Prof. Dr. G. Hellberg EDV-Beratung & Softwareengineering Dipl.-Ing. Olaf Petry Sonnenweg 7 D-30171 Hannover Germany Fon: +49 (0)511 / 288 25 90 Fax: +49 (0)511 / 288 25 89 Mobil: +49 (0)177 / 230 22 65 Web: www.DrHellberg.de E-Mail: info(a)DrHellberg.de >>> "remote" <remote(a)leat.ruhr-uni-bochum.de> 19.05.2003 08:31 >>> Hi ! LAN except for the following protocols/ports : pop3, pop3s, http, https, ftp, ftps, smtp, ssh, domain. ... FW_SERVICES_EXT_TCP="20 21 22 25 53 80 110 995"

1 0

haveing spuriouse problems with routing I think some are my
by philt 18 May '03

18 May '03

isp but I am a newbie and hoped you might help here is the symptom May 19 07:19:39 redroute1 kernel: SuSE-FW-ILLEGAL-ROUTING IN=ipsec0 OUT=eth0 SRC=192.168.10.150 DST=192.168.0.47 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=147 DF PROTO=ICMP TYPE=8 CODE=0 ID=46600 SEQ=512 May 19 07:19:40 redroute1 kernel: SuSE-FW-ILLEGAL-ROUTING IN=ipsec0 OUT=eth0 SRC=192.168.10.150 DST=192.168.0.47 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=148 DF PROTO=ICMP TYPE=8 CODE=0 ID=46600 SEQ=768 It seems sometimes I can ping and sometimes I can not. Most problems seem to take place on a connection after I try to connect to a drive on the right side of the connection from the left here is other information up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. iptables -I FORWARD 1 -o ipsec0 -s 192.168.10.0/24 -d 192.169.0.0/24 -j ACCEPT iptables -I FORWARD 1 -i ipsec0 -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. iptables -D FORWARD -o ipsec0 -s 192.168.10.0/24 -d 192.168.0.0/24 -j ACCEPT iptables -D FORWARD -i ipsec0 -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; #%defaultroute is okay for most simple cases. interfaces=%defaultroute # Debug-logging controls: "none" for (almost) none, "all" for lots. klipsdebug=all plutodebug=none # Use auto= parameters in conn descriptions to control startup actions. plutoload=%search plutostart=%search # Close down old connection when new one using same ID shows up. uniqueids=yes #Enable NAT-Traversal #nat_traversal=yes conn %default authby=rsasig keyingtries=1 ikelifetime=240m keylife=20m compress=yes disablearrivalcheck=no leftrsasigkey=%cert rightrsasigkey=%cert conn dowagiac-redoak left=12.47.77.50 leftsubnet=192.168.0.0/24 leftcert=redroute1cert.pem right=%defaultroute rightsubnet=192.168.10.0/24 rightcert=redroute10cert.pem # To authorize this connection, but not actually start it, at startup, # uncomment this. auto=add pfs=yes # Copyright (c) 2000-2002 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 2002 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into # -> /usr/share/doc/packages/SuSEfirewall2/EXAMPLES ! # -> /usr/share/doc/packages/SuSEfirewall2/FAQ ! # -> /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE ! # # /etc/sysconfig/SuSEfirewall2 # # for use with /sbin/SuSEfirewall2 version 3.1 which is for 2.4 kernels! # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall2 you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you need also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team # # ------------------------------------------------------------------------ # # Configuration HELP: # # If you have got any problems configuring this file, take a look at # /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # # All types have to set enable SuSEfirewall2 in the runlevel editor # # If you are a end-user who is NOT connected to two networks (read: you have # got a single user system and are using a dialup to the internet) you just # have to configure (all other settings are OK): 2) and maybe 9). # # If this server is a firewall, which should act like a proxy (no direct # routing between both networks), or you are an end-user connected to the # internet and to an internal network, you have to setup your proxys and # reconfigure (all other settings are OK): 2), 3), 9) and maybe 7), 11), 14) # # If this server is a firewall, and should do routing/masquerading between # the untrusted and the trusted network, you have to reconfigure (all other # settings are OK): 2), 3), 5), 6), 9), and maybe 7), 10), 11), 12), 13), # 14), 20) # # If you want to run a DMZ in either of the above three standard setups, you # just have to configure *additionally* 4), 9), 12), 13), 17), 19). # # If you know what you are doing, you may also change 8), 11), 15), 16) # and the expert options 19), 20), 21), 22) and 23) at the far end, but you # should NOT. # # If you use diald or ISDN autodialing, you might want to set 17). # # To get programs like traceroutes to your firewall to work is a bit tricky, # you have to set the following options to "yes" : 11 (UDP only), 18 and 19. # # Please note that if you use service names, that they exist in /etc/services. # There is no service "dns", it's called "domain"; email is called "smtp" etc. # # *Any* routing between interfaces except masquerading requires to set FW_ROUTE # to "yes" and use FW_FORWARD or FW_ALLOW_CLASS_ROUTING ! # # If you just want to do masquerading without filtering, ignore this script # and run this line (exchange "ippp0" "ppp0" if you use a modem, not isdn): # iptables -A POSTROUTING -t nat -j MASQUERADE -o ippp0 # echo 1 > /proc/sys/net/ipv4/ip_forward # and additionally the following lines to get at least a minimum of security: # iptables -A INPUT -j DROP -m state --state NEW,INVALID -i ippp0 # iptables -A FORWARD -j DROP -m state --state NEW,INVALID -i ippp0 # ------------------------------------------------------------------------ # # 1.) # Should the Firewall run in quickmode? # # "Quickmode" means that only the interfaces pointing to external networks # are secured, and no other. all interfaces not in the list of FW_DEV_EXT # are allowed full network access! Additionally, masquerading is # automatically activated for FW_MASQ_DEV devices. and last but not least: # all incoming connection via external interfaces are REJECTED. # You will only need to configure 2.) and FW_MASQ_DEV in 6.) # Optionally, you may add entries to section 9a.) # # Choice: "yes" or "no", if not set defaults to "no" # FW_QUICKMODE="no" FW_DEV_EXT="ppp0 ipsec0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_INT="eth0" # # 4.) # Which is the interface that points to the dmz or dialup network? # # Enter all the network devices here which point to the dmz/dialups. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD to define the services # which should be available to the internet and set FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_DMZ="" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from # /etc/sysconfig/network/options # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD to define # what is allowed to be forwarded! # # Choice: "yes" or "no", if not set defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading. This option is required for FW_MASQ_NETS and # FW_FORWARD_MASQ. # # Choice: "yes" or "no", if not set defaults to "no" # FW_MASQUERADE="yes" # # You must also define on which interface(s) to masquerade on. This is # normally your external device(s) to the internet. # Most users can leave the default below. # # e.g. "ippp0" or "$FW_DEV_EXT" FW_MASQ_DEV="ppp0" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A target network, protocol and service is appended by a comma to # the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with # unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows # the 10.0.1.0 network to use www/ftp to the internet. # "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # Set this variable to "0/0" to allow unrestricted access to the internet. # FW_MASQ_NETS="192.168.0.0/24" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", if not set defaults to "yes" # # "yes" is a good choice FW_PROTECT_FROM_INTERNAL="no" oice: "yes" or "no", if not set defaults to "yes" # FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="53 rsync ssh" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_UPD="500" FW_SERVICES_EXT_IP="50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # # Common: ssh smtp domain FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.10.0/24 192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="192.168.0.0/24,192.168.10.0/24 192.168.10.0/24,192.168.0.0/24" # FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="YES" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" # FW_ALLOW_PING_DMZ="no" # FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" Thank you for any help you can be. -- Absolute Internet Services (http://www.aiserve.net)

1 0

ipsec Tunels between nated subnets
by philt 17 May '03

17 May '03

I am trying freeswan to work and I have the connection up and running but when I try to ping packets are droped at tx. I am running a dialup connection to the internet and ipsec0 is attached to pppO Here is the basic layout right left 192.168.10.0/24---ipsec0=======ipsec0---192.168.0.0/24 Here is my updown script important pieces from the right side up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. iptables -I FORWARD 1 -o ipsec0 -s 192.168.10.0/24 -d 192.169.0.0/24 -j ACCEPT iptables -I FORWARD 1 -i ipsec0 -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT Chain POSTROUTING (policy ACCEPT 23 packets, 1716 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- any ipsec0 192.168.10.0/24 anywhere 0 0 MASQUERADE all -- any ppp0 192.168.10.0/24 anywhere Chain OUTPUT (policy ACCEPT 23 packets, 1716 bytes) pkts bytes target prot opt in out source destination Can someone please help me stop masq on ipsec0 I am newbyish so real samples would help thanks -- Absolute Internet Services (http://www.aiserve.net)

2 1

RE: [suse-security] IMAP and 8.2
by Björn Róbertsson 17 May '03

17 May '03

Just have a look at then config file in /etc/stunnel/stunnel.conf It has a [ ] section for imaps, uncomment and start the service, /etc/init.d/stunnel start You should see a listening port on 993, netstat an |grep 993 And then you should be able to configure your mail client to use SSLed imap. For maximum security you should only allow imap connections from localhost. Next is to use smtps (secure smtp) to send mail... Bjorn Robertsson -----Original Message----- From: David Soltero-Lugo [mailto:david@cnnet.upr.edu] Sent: 17. maí 2003 14:20 To: Björn Róbertsson Cc: R.Vickers(a)cs.rhul.ac.uk; bobv(a)cs.rhul.ac.uk; vbru(a)entu.cas.cz; suse-security(a)suse.com Subject: Re: [suse-security] IMAP and 8.2 I tried the inet option (on xinetd) and did not work, can you provide mor information on the stunnel option?? Thanks David Björn Róbertsson wrote: I also discovered that my ssl'd imapd service had stopped working. I'd created stunnel connection and I found in /etc/stunnel a config file which allowed for a very simple configuration... This however requires the service stunnel started and you need to remove the corresponding imap/pop lines from /etc/inetd.conf Hope to help :) Bjorn Robertsson p.s. I use cyrus so the cyrus config does not need to know imaps if you use stunnel. Vaclav, Yesterday we too upgraded our mail server and discovered this change that SuSE quietly introduced. It sounds like you have done the hard part; to configure inetd.conf to support SSL-enabled IMAP and POP you just need lines imaps stream tcp nowait root /usr/sbin/tcpd imapd pop3s stream tcp nowait root /usr/sbin/tcpd ipop3d I've found it very hard to find good documentation on how to set up an IMAP service that does not use plaintext passwords. Bob On Wed, 14 May 2003, Vaclav Brunnhofer wrote: Being prevented here in this group that the support for 7.2 would finish in the near future (see another thread), I have purchased and upgraded to 8.2. So far, almost everything is working as expected, expect for IMAP (the same case would be POP3, if I would not use qpopper). In the mean time, I have found information that the IMAP rpm, shipped with 8.2 (IMAP 2002) is a major release, enabling to disable fulltext passwords for identification. Apparently the rpm shipped with 8.2 is compiled with this in mind. So far it is good, but I cannot find any information, how to make it work. I have found that it is necessary to use starttls - a ssl based authentification. Just I cannot find (may be I am using incorrect queries in google) how to setup the IMAP server - I have found how to configure the clients, how to compile IMAP for disabling authetification by plaintext passwords, but I am missing information, how to configure inetd (or even xinetd) to work with this imap daemon. The same applies for ipop3, just I have installec qpopper and this works fine. SuSE installation support claims it is beyond the scope of installation support. Does anyone know how to make the imap over startls or ssl work? Thanks a lot S pozdravem Vaclav Brunnhofer ======================================================== ======= | Entomologicky ustav e-mail: vbru(a)entu.cas.cz | | Akademie Ved Ceske Republiky tel.: 038 7775251 | | Branisovska 31 fax: 038 5310354 | | 370 05 Ceske Budejovice mobil: +420 606 632822 | ======================================================== ====== -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Snort DOS?
by Jeff Harris 16 May '03

16 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I ran into a situation last week, where my /var partion completely filled up. Upon investigation, I realized that /var/log/snort filled 85% of the space available on the partition. Having no space left on /var left no space for incoming mail and no space for squid cache, and slowed my machine to a crawl. Would it be theoretically possible to launch a herd of port scanners against a known host to fill up someone's /var drive and shut them down? Or, am I missing something in a logrotate or config setting somewhere? TIA Jeff Harris - --- Registered Linux user #304026. "lynx -source http://www.rallycentral.us/~linux/jharris.asc | gpg --import" or "gpg --keyserver pgp.mit.edu --recv-key BD23A31E" Key fingerprint = FB8C 3210 8DE1 78F4 6505 5918 0C34 BE94 BD23 A31E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE+xU04DDS+lL0jox4RAkpFAJ4rzc3jvPN023uw93Nb2+vL6EwS3QCfXssg nFhxyCz5rfzNTWBP7/FCjeA= =w5B0 -----END PGP SIGNATURE-----

2 1

xntpd binds udp 123 on all interfaces?!
by GentooRulez 16 May '03

16 May '03

xntpd does listen on all interfaces it found while coming up. i googled around and read the fine manuals but i did'nt found any option to bind only a certain interface to listen on udp 123 Any suggestions ? And yes, i blocked all unwanted ntp traffic, but i'll ensure that xntpd is only listen on interfaces i'll allow to. Regards Michael

2 1

AW: [suse-security] Discontinued SuSE Linux Distributions ( when will this happen to 7.2?)
by Sebastian Stadtlich 16 May '03

16 May '03

Hello Sorry to bother, i know this must have been asked on this list, but i could neither find the answer on the following question in the archives nor with google : "When will the SUSE 7.2 Distribution be discontinued?" Thank you Best regards Sebastian Stadtlich > -----Ursprüngliche Nachricht----- > Von: Roman Drahtmueller [mailto:draht@suse.de] > Gesendet: Montag, 12. Mai 2003 16:12 > An: suse-security(a)suse.com > Betreff: [suse-security] Discontinued SuSE Linux Distributions > > > -----BEGIN PGP SIGNED MESSAGE----- > > Dear suse-security-announce subscriber and SuSE Linux user, > > With the release of the SuSE Linux 8.2 i386 ftp version, we > announce that the SuSE Linux 7.1 distribution will be > discontinued for all architectures. Our SLES (SuSE Linux > Enterprise Server) products and the products based on SLES > are not affected by this announcement. > > Vulnerabilities found after Friday, May 16 2002, will not be > fixed for SuSE Linux 7.1 any more. After two years of > successful use, SuSE Linux 7.1 will free resources for the > newly released products. By consequence, the 7.1 distribution > directories on our ftp server ftp.suse.com have been moved to > the /pub/suse/discontinued/ directory tree structure; the 7.1 > directories in the update trees will follow near the end of > May, soon after all pending update packages have been published. > > SuSE puts much effort into adding security improvements > (patches) to the software. We usually do not publish new > versions of a software package because new features and > changed behaviour of a single package can jeopardize the > seamless operation of the product as a whole. Over the > lifetime of a SuSE Linux distribution, this causes an > increasing workload on the SuSE Security Team and SuSE > software engineering in general: The older the product (and > the package versions in it) is, the more work is needed to > prepare patches that fix security related malfunctions. This > forces us to focus on the SuSE Linux distributions of a newer > release date to ensure that our customers can continuously > take advantage of the quality that they are used to with SuSE > products. Please note that our SuSE Linux Enterprise Server > products have a longer support lifetime which is completely > independent from the SuSE Linux distributions. To learn more > about the SuSE Linux Enterprise Server product family, please > visit http://www.suse.de/en/business/products/index.html . > > As usual, SuSE will continue to provide update packages for > the remaining distributions SuSE-7.2 SuSE-7.3 SuSE-8.0 > SuSE-8.1 and SuSE-8.2 > > for a two-year period after the release of the respective > distribution. > > If you have any questions regarding this announcement, please > do not hesitate to direct your questions to security(a)suse.de > (SuSE security contact). > > Regards, > Roman Drahtmüller, > SuSE Security. > - > - > | Roman Drahtmüller <draht(a)suse.de> // "You don't need > eyes to see, | > SuSE Linux AG - Security Phone: // you > need vision!" > | Nürnberg, Germany +49-911-740530 // Maxi > Jazz, Faithless | > - > - > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.7 (GNU/Linux) > > iQEVAwUBPr+qfXey5gA9JdPZAQEAygf+KEI9PrsUt9jqjV4qGYDI2LfMzEswGaTg > VfjuJoy9bg+/6LZMk7FSdO3R19ndhNw/C5vXGIad2ta2xgdOuVit9I2POQ6gn7z+ > ufUeNBPHI2u0Iv+aDTVemfyjrtwRdWrbL1ygBMr0PxnnowjRmXruK9Q+IGwaJkjo > ZjFvK76GER0LkQKfijNr6XvjliFGAqESEAASrzrP8IQwYURjFoBRqze2+T+kUKgo > 2pUa5t+WecxqZG7I9hgOti/9sQAuwfMN7uaONVEt6BdIsJki3zL5erPTQjoiprlD > kExFoCEydhlL/xjcrEo0PJsPXKH/evxbrQjfcOqQrfsTmJlirCAj4Q== > =e7cv > -----END PGP SIGNATURE----- > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

16 23

Re: 2.4 routing table DOS flaw question
by GentooRulez 16 May '03

16 May '03

Shit. While reading it a third time a saw that rh mentions 2 flaws. Anyway, nobody wrote a reponse and so my carelessness will not impact :O) Or will anybody write some words to the initially questions? Regards Michael

1 0

Fw: [suse-security] Sambal root exploit found
by GentooRulez 16 May '03

16 May '03

What about a simple update. Maybe the newer version (52) will fix that. su root wget ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/samba-2.2.0a-52.i386.rpm rpm -F samba-2.2.0a-52.i386.rpm rm samba-2.2.0a-52.i386.rpm rcsmb restart Hope that helps Michael

1 0

Sambal root exploit found
by Christian Boxhammer 16 May '03

16 May '03

Hello list, I have found a root exploit on our Linux Server (SuSE 7.2). The machine ist running samba-2.2.0a-51. This root exploit is named sambal. It creates a new user named postgres with HOME=/var/lib/pgsql/. It can attack Linux, FreeBSD, NetBSD and OpenBSD machines. The source Code of this exploit can be found on www.netric.org. My Problems: How dangerous is this? How can I detect, what the hacker does with our system? (HISTFILE unset by exploit) Does anyone know anything about sambal? Thanks Christian

1 0

Message found in bootmessages
by philt 16 May '03

16 May '03

Can someone tell me what this means. I am a newby and need to figure this one out as it might be effecting my use of ipsec Thank you. Error: the fourth parameter is for use with tcp, udp and icmp only in FW_FORWARD -> 192.168.10.0/24,192.168.0.0/16,192.168.0.0/24,192.168.10.0/16 -- Absolute Internet Services (http://www.aiserve.net)

2 2

http://www.heise.de/newsticker/data/dab-16.05.03-000/
by Mathias Homann 16 May '03

16 May '03

Hi, anything happening about this yet? http://www.heise.de/newsticker/data/dab-16.05.03-000/ bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

1 0

Re: [suse-security] 2.4 routing table DOS flaw question
by GentooRulez 16 May '03

16 May '03

Oops, now that i'am reading it a second time it seems to be a local exploit but not remote exploitable. Isn't it? snip ----- This flaw can allow an unprivileged local user to gain read and write access to I/O ports on the system. ---- snap Regards Michael

1 0

2.4 routing table DOS flaw question
by GentooRulez 16 May '03

16 May '03

Here is a nadvisory http://rhn.redhat.com/errata/RHSA-2003-172.html that describes a flaw in 2.4.x kernel routing hash table. Do i need to patch my kernel and restart the box (and loose my heavy uptime) even if iptables filters all packets come in and are not related to a self established connection? In other words, if a router serves nothing and incoming packets are blocked, the routing table comes not in the game and i dont need to patch? AND - is there a way using iptools (ip route) to circumvent the problem? Regards Michael

1 0

Re: [suse-security] What has happened to harsen_suse in SuSE 8.2]
by Bill Eastman 16 May '03

16 May '03

On Thu, 2003-05-15 at 19:18, Joerg Mayer wrote: > On Thu, May 15, 2003 at 12:39:07PM -0500, Bill Eastman wrote: > > I wish SuSE had an install EVERYTHING that REALLY installed EVERYTHING > > instead of "Everything SuSE thinks I need". > > I don't think that this is possible: Some packages exclude each other > because they would provide files with identical names (postfix/sendmail). In that case, present a list and let the person doing the install make a choice (at least the professional version). At least include memtest86, updatedb, locate. When I installed memtest86 using yast, it did NOT edit grub, so I had to add it to grub manually. Leave the home version like it is. -- Bill Eastman <beastman(a)austin.rr.com>

1 0

re: [suse-security] Sambal root exploit found
by Michael Ryan 16 May '03

16 May '03

Patches for samba have been available for around a month now ... take the box offline, wipe it and re-install SuSE 8.1 or 8.2 if possible. Use SuSEfirewall2 to block access to unneeded services and/or disable them. Best advice I can give I'm afraid ... mik Christian Boxhammer <box(a)mail.geod.uni-bonn.de> wrote: __________ >Hello list, > >I have found a root exploit on our Linux Server (SuSE 7.2). The machine ist >running samba-2.2.0a-51. This root exploit is named sambal. It creates a new >user named postgres with HOME=/var/lib/pgsql/. >It can attack Linux, FreeBSD, NetBSD and OpenBSD machines. The source Code of >this exploit can be found on www.netric.org. > >My Problems: >How dangerous is this? >How can I detect, what the hacker does with our system? (HISTFILE unset by >exploit) >Does anyone know anything about sambal? > >Thanks > Christian > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

What has happened to harsen_suse in SuSE 8.2
by Bo Jacobsen 16 May '03

16 May '03

What has happened to harden_suse. I see that it's no longer present in 8.2 ?!. I have always used this program and is now wondering what to use instead. Bo Jacobsen

3 2

FW_MASQ_DEV="$FW_DEV_EXT"
by philt 16 May '03

16 May '03

If I change this to only read ppp0 is it going to remove the following iptable entry 0 0 MASQUERADE all -- any ipsec0 192.168.0.0/24 anywhere FW_MASQ_DEV="$FW_DEV_EXT" Could I have been struggling for days and not got this? -- Absolute Internet Services (http://www.aiserve.net)

1 0

SuSEfirewall2 and NAT help : i am so lost!
by David T-G 15 May '03

15 May '03

Hi, all -- From reviewing the archives I *believe* I'm in a good place to ask, but I could be wrong. Please be gentle in your redirection :-) I am a loyal :-) SuSE user and am doing some work for a client who has finally switched from SCO UNIX to SCO's version of Linux, which includes SuSEfirewall2 and otherwise looks quite a bit like a SuSE system (gee, go figure!). In any given location he has a static external interface and a 10.x.y.z internal interface and would like to do NATting for his internal windows machines. I am trying to write a script to configure and enable SuSEfirewall2 for this so that he can do a hands-off install on his literally thousands of clients. SCO UNIX used ipf and ipnat, and I got those simple rules worked out. Now I need to do the same thing for iptables and SuSEfirewall2 and I'm pretty lost. Recalling that this has to be a hands-off install, I have whipped up a little script to identify the internal and external interfaces, and then apply cat /etc/sysconfig/SuSEfirewall2.bak.$$ | \ sed \ -e "s/FW_DEV_EXT=.*/FW_DEV_EXT='$EXT'/" \ -e "s/FW_DEV_INT=.*/FW_DEV_INT='$INT'/" \ -e "s/FW_QUICKMODE=.*/FW_QUICKMODE='yes'/" \ -e "s/FW_ROUTE=.*/FW_ROUTE='yes'/" \ -e "s/FW_MASQUERADE=.*/FW_MASQUERADE='yes'/" \ -e "s:FW_MASQ_NETS=.*:FW_MASQ_NETS='10.0.0.0/8':" \ -e "s/FW_SERVICES_QUICK_TCP=.*/FW_SERVICES_QUICK_TCP='telnet ftp ssh www mysql'/" \ -e "s:FW_TRUSTED_NETS=.*:FW_TRUSTED_NETS='10.0.0.0/8':" > \ /etc/sysconfig/SuSEfirewall2 to set the variables accordingly and then create the rc?.d start and stop symlinks for the three scripts. Unfortunately, a client machine on the inside properly pointing to the internal address as its default gateway cannot get through. Having read the example file, asked google for help, read through list archives, and generally poked and prodded everywhere I can, I've come up with many "you need to turn on NAT" but no pointers to how to do so! TIA & HAND :-D -- David T-G * There is too much animal courage in (play) davidtg(a)justpickone.org * society and not sufficient moral courage. (work) davidtgwork(a)justpickone.org -- Mary Baker Eddy, "Science and Health" http://justpickone.org/davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg!

2 1

What has happened to harden_suse in SuSE 8.2
by Bo Jacobsen 15 May '03

15 May '03

What has happened to harden_suse. I see that it's no longer present in 8.2 ?!. I have always used this program and is now wondering what to use instead. Bo Jacobsen

2 2

colgar pagina en apache
by Lucio Solorzano 15 May '03

15 May '03

Creo que mi problema es que estoy usando un script de Visual Basic para validar los usuarios que pueden entrar a ver el contenido de la pagina, lo que pasa es que primero lo hice usando el frontpage y le agrege scripts como el de la validacion de usuarios. Linux corre scripts de VB ? o solamente de Java Saludos, > > Method Not Allowed > > > > The requested method POST is not allowed for the URL /pagina1.htm. > > > > ---------- > > Apache/1.3.23 Server at server.cidelsa.com.pe Port 80 > > > > Esperando su respuesta > > > > Gracias > >

1 0

[suse-security] Strange behaviour of SuSE
by Bill.Light＠kp.org 15 May '03

15 May '03

If no one else has answered - You've been rooted... See how to do it at Cyberborneo: http://www.cyberborneo.com/tutorial.htm Take the machine off line - you don't own it anymore.... ================================================================================= Hi there! I have a little problem with our Linux server and I don't know, if it's perhaps a security problem. We run a samba server with SuSE 7.3 Last days, it behaves a little bit strange: At the first time, I wasn't able to login at the console with the root account. After entering the username root, nothing happens. From remote with ssh, I could login. Now, after some days, no root login is possible - even ssh says "access denied" When I login as normal user, I see two files in the root directory of the volume named "devory" and "slamet". I didn't create the files. They have the same date attribute and nearly the same time attribute. The server itself seems to work without problems. Is this a security problem, a hard disk problem or what else? Regards, Wolfgang Eul -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

harden_suse
by Loof, Torsten 15 May '03

15 May '03

Hi List, Does anybody know what happened to the harden_suse and bastille scripts? Can't find them for the 8.2 distribution on the ftp-server and mirrows any more. For the 8.1 distrubution i could find under /suse/noarch for harden and /suse/i586 for bastille. But now ? Regards, Torsten Loof

3 2

AW: [suse-security] harden_suse
by Junge, Stefan 15 May '03

15 May '03

Hi Torsten, Try this Link http://www.suse.de/~marc/SuSE.html Here you will find Version 3.5 MfG Stefan > -----Ursprüngliche Nachricht----- > Von: Loof, Torsten [mailto:tl@gopas.net] > Gesendet: Donnerstag, 15. Mai 2003 16:06 > An: suse-security(a)suse.com > Betreff: [suse-security] harden_suse > > > > Hi List, > > Does anybody know what happened to the harden_suse and > bastille scripts? > Can't find them for the 8.2 distribution on the ftp-server and mirrows > any more. > For the 8.1 distrubution i could find under /suse/noarch for > harden and > /suse/i586 for bastille. But now ? > > Regards, > > Torsten Loof > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

SuSE Security Announcement: KDE (SuSE-SA:2003:026)
by Sebastian Krahmer 15 May '03

15 May '03

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: KDE Announcement-ID: SuSE-SA:2003:0026 Date: Thu Apr 24 12:00:00 MEST 2003 Affected products: 7.1, 7.2, 7.3, 8.0, 8.1, 8.2 SuSE eMail Server 3.1 SuSE eMail Server III SuSE Firewall Adminhost VPN SuSE Linux Admin-CD for Firewall SuSE Firewall on CD 2 - VPN SuSE Firewall on CD 2 SuSE Linux Connectivity Server SuSE Linux Enterprise Server 7 SuSE Linux Office Server Vulnerability Type: various security vulnerabilities Severity (1-10): 5 SuSE default package: yes Cross References: http://www.kde.org/info/security/advisory-20030409-1.txt http://www.kde.org/info/security/advisory-20021220-1.txt http://www.kde.org/announcements/announce-3.0.5a.html Content of this advisory: 1) security vulnerability resolved: Results of security audit of KDE. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - glibc - pptpd 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The K Desktop Environment KDE allows to generate postscript previews which can be viewed via certain konqueror plug-ins for example. The previews are generated by invoking the ghostscript program but without supplying the "-dSAFER" option as an argument. This allows embedded code to be executed. Additionally to the correction made to the postscript generation process, various other security related bug fixes and patches from KDE 3.0.5a have been incorporated. For more information regarding these fixes please visit the URLs given as cross references. The complete list of fixed packages is as follows: kdelibs3 kdelibs3-cups kdebase3 kdebase3-kdm kdebase3-konqueror kdebase3-ksysguardd kdebase3-extra kdegames3 kdegames3-board kdegraphics3-fax kdegraphics3-tex kdegraphics3-viewer kdegraphics3-postscript kdemultimedia3-midi kdemultimedia3-sound kdemultimedia3-video kdenetwork3 kdenetwork3-mail kdenetwork3-chat kdenetwork3-lan kdepim3-organizer kdepim3-kpilot kdesdk3 kdeutils3 kdeutils3-laptop Due to the large list of update packages we do not provide MD5 sums in this advisory. This would blow up the advisory and make it unreadable. Rather we recommend to either update your system via YaST2 where the auto updater automatically checks the integrity of the packages or to follow the guideline from section 3, "Package authenticity verification". Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - glibc New glibc packages will be available soon which fix a RPC XDR integer overflow. The packages are currently being tested. - pptpd A buffer overflow was found in the pptpd server. New packages will be available soon. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPqe3R3ey5gA9JdPZAQEQOAf+MU36o5Osrr/Dt5D+q+slnnydUkcqTb6h lohbbUys6O9FYAbEQKZ4jwlT9Cg7+Z19FHF4wjVm3N9/VDU7uzdcOkE2mVwHh3cD OHEEG3cXj099wmj2MXnPkCQQothtrSAFa6OJ9mdw5jzeb8XIi6vXi/4HdtJU7BiY sVXkPTEEhzZQKjtHq1KotFWXSf7AMq4YB5Gtd1ob1hCTUdba7ScvGxbcKopGYlZf cepYOpM9WInfRFVZBeP1lpWEvG5BViESv/KxBrEaxyQCYsZjf1jkGCTLgmCk+/X4 RDjkzw8tgZFBrIv5+7L3I/H1hJ9sNTEPjkkPAJiSnX3ceT4ltmHWYA== =ZHNK -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

5 6

AW: [suse-security] Discontinued SuSE Linux Distributions
by Ulrich Roth 14 May '03

14 May '03

Hi Martin, > My problem: The machine is a server which should be running > permanently. > So I should update the system while running the machine ... > any ideas if there are problems updating the system to 8.2 from 7.1 ... > > I can remember I had to work for two days to get my server > running again, when I upgraded from 6.3 to 7.1 ... as the directories, etc. > did not fit anymore ... :-(((( > > Any hints or other suggestions? Here is my suggestion if you have the appropriate hardware: Install 8.2 on a new machine. Then install all additional applications and configure everything identically. If everything is well prepared and if you are lucky, the only thing you need to do is to plug out the network cable from the old machine and plug it into the new machine. Downtime: a few seconds. For me this worked already three times. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Discontinued SuSE Linux Distributions
by Roman Drahtmueller 14 May '03

14 May '03

-----BEGIN PGP SIGNED MESSAGE----- Dear suse-security-announce subscriber and SuSE Linux user, With the release of the SuSE Linux 8.2 i386 ftp version, we announce that the SuSE Linux 7.1 distribution will be discontinued for all architectures. Our SLES (SuSE Linux Enterprise Server) products and the products based on SLES are not affected by this announcement. Vulnerabilities found after Friday, May 16 2002, will not be fixed for SuSE Linux 7.1 any more. After two years of successful use, SuSE Linux 7.1 will free resources for the newly released products. By consequence, the 7.1 distribution directories on our ftp server ftp.suse.com have been moved to the /pub/suse/discontinued/ directory tree structure; the 7.1 directories in the update trees will follow near the end of May, soon after all pending update packages have been published. SuSE puts much effort into adding security improvements (patches) to the software. We usually do not publish new versions of a software package because new features and changed behaviour of a single package can jeopardize the seamless operation of the product as a whole. Over the lifetime of a SuSE Linux distribution, this causes an increasing workload on the SuSE Security Team and SuSE software engineering in general: The older the product (and the package versions in it) is, the more work is needed to prepare patches that fix security related malfunctions. This forces us to focus on the SuSE Linux distributions of a newer release date to ensure that our customers can continuously take advantage of the quality that they are used to with SuSE products. Please note that our SuSE Linux Enterprise Server products have a longer support lifetime which is completely independent from the SuSE Linux distributions. To learn more about the SuSE Linux Enterprise Server product family, please visit http://www.suse.de/en/business/products/index.html . As usual, SuSE will continue to provide update packages for the remaining distributions SuSE-7.2 SuSE-7.3 SuSE-8.0 SuSE-8.1 and SuSE-8.2 for a two-year period after the release of the respective distribution. If you have any questions regarding this announcement, please do not hesitate to direct your questions to security(a)suse.de (SuSE security contact). Regards, Roman Drahtmüller, SuSE Security. - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBPr+qfXey5gA9JdPZAQEAygf+KEI9PrsUt9jqjV4qGYDI2LfMzEswGaTg VfjuJoy9bg+/6LZMk7FSdO3R19ndhNw/C5vXGIad2ta2xgdOuVit9I2POQ6gn7z+ ufUeNBPHI2u0Iv+aDTVemfyjrtwRdWrbL1ygBMr0PxnnowjRmXruK9Q+IGwaJkjo ZjFvK76GER0LkQKfijNr6XvjliFGAqESEAASrzrP8IQwYURjFoBRqze2+T+kUKgo 2pUa5t+WecxqZG7I9hgOti/9sQAuwfMN7uaONVEt6BdIsJki3zL5erPTQjoiprlD kExFoCEydhlL/xjcrEo0PJsPXKH/evxbrQjfcOqQrfsTmJlirCAj4Q== =e7cv -----END PGP SIGNATURE-----

5 4

SuSEfirewall2
by Stelios Asmargianakis 13 May '03

13 May '03

Hello guys Recently i made a huge :) upgrade into a server from Redhat 5 to SuSE 8.1. I used the /ets/sysconfig/SuSEfirewall2 to make iptable rules and everything works fine except the speed. I mean that the machine is running really slow after running the firewall. I have open the following services-ports (tcp and utp): 10000 169 22 25 3128 3306 42 443 53 80 http https ssh which means that on this machine i am running bind,apache,mysql,ssh,mail The same services was running on the x-server and it was much faster than this (more than 300% faster!) Any suggestions?

2 2

RE: [suse-security] Discontinued SuSE Linux Distributions ( when will this happen to 7.2?)
by Schuster Thomas 13 May '03

13 May '03

> > > It will happen when the version _after_ 8.2 is available on ftp. > > > > 8.2 is _available_ on ftp, thats why _7.1_ was _discontinued_. > > and I said "7.2 will be discontinued when the one after 8.2 > is on ftp." But Roman Drahtmueller wrote (12.05.2003 16:14) >As usual, SuSE will continue to provide update packages for the remaining >distributions > SuSE-7.2 > SuSE-7.3 > SuSE-8.0 > SuSE-8.1 >and > SuSE-8.2 > >for a two-year period after the release of the respective distribution. So, you just need to know, when 7.2 was released.... Bye T. Schuster ----------------------- I&S ITS IEC CU Siemens AG - Intelligent Traffic Systems

1 0

AW: [suse-security] Security worry
by Ulrich Roth 13 May '03

13 May '03

Hello Anatl, > Having saved some files on /dev/fd0 recently, the err below > started gathering up: > > Directory sread (sector 0xa) failed May 13 07:14:45 mand kernel: Did you unmount the floppy before taking it out of the drive? Otherwise your floppy may be defective, I think. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Security worry
by webmaster 13 May '03

13 May '03

Hi List, Having saved some files on /dev/fd0 recently, the err below started gathering up: Directory sread (sector 0xa) failed May 13 07:14:45 mand kernel: I have not found any useful solution yet. Would any of you be kind enough to suggest one? Thank you Anatl Kreorg Oktatóközpont Grid International Magyarország kreorg(a)kreorg.hu +36-1-321-0031

1 0

AW: [suse-security] Windows commands for linux internet
by Manfred Pausch 12 May '03

12 May '03

quick-n-dirty solution: plink.exe (ssh-client for windows command line) http://the.earth.li/~sgtatham/putty/latest/x86/plink.exe c:\plink.exe root@LinuxBox -p <root-pw> <dialin-command> the problem is that the root-password is stored in the link on the 9x-desktop :( for disconnect from internet use <disconnect-command> instead of <dialin-command> -----Ursprungliche Nachricht----- Von: l.g.e(a)web.de [mailto:l.g.e@web.de] Gesendet: Montag, 12. Mai 2003 16:30 An: suse-security(a)suse.com Betreff: Re: [suse-security] Windows commands for linux internet Chris Bek schrieb: >[...] >The main user of the network wants to have 2 icons on his desktop = >(Win9X) such that: >By double clicking the first one, the LinuxBox dials-in the internet >and the 2nd logs him out. > >Any good ideas about this?? port cinternet / kinternet to win 9X :) sources in smpppd-*.src.rpm ["SuSE meta ppp deamon"] simple protocoll, should be very easy to implement/port. maybe it is already ported, or runs within cygwin. otherwise, if you want, I'd port it for you, contact me privatly. Lars -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Windows commands for linux internet
by Chris Bek 12 May '03

12 May '03

Hi folks, I have a Linux server which serves as an Internet gateway for a 5 PC = (Win9X) network. Everything works find so far and SuSEFirewall is also operating nicely. The problem is the following: The main user of the network wants to have 2 icons on his desktop = (Win9X) such that: By double clicking the first one, the LinuxBox dials-in the internet and = the 2nd logs him out. Any good ideas about this?? The current installation of the Linux Box is a 7.2 SuSE out-of-the-box = installation. Thanx friends. Chris

8 7

Re: [suse-security] perl script drop
by petry 12 May '03

12 May '03

Only a small hint for the /tmp-partition: mount it as follows in /etc/fstab /dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec with the noexec-parameter so no one is able to execute a created script from that directory Greetings olaf >>> "Gerhard Stegmann" <gerhard.stegmann(a)magelan.net> 12.05.2003 13:12 >>> hi there i have 2.4.20 with apache 1.3.26 and mod_php 4.2.2 somehow it was possible for a guy, to drop a file /tmp/.ps on the machine, and to start perl on that file #>ps ax 1234 perl /tmp/.ps the file was created under wwwrun.www - ownership, which tells me that apache created it. the script just listens for incoming connections on p 4098, and opens a shell if the correct password is entered.

5 4

Re: [suse-security] mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

> -----Original Message----- > From: Ken Schneider > > > > > yeah sure, I knew I forgot something (to post) :) > > my chap-secrets looks like > > > > /etc/ppp/chap-secrets > > > > # INBOUND CONNECTIONS > > #client hostname <password> 192.168.1.1 > > "test" * "account" * > > Comment out the "test" entry and add a real account. Something like: > > marc linux1 <password(without the<>)> ip.addressed.you.want > > Then you should be able to log in. > > Ken Thanks for your help, it was a silly mistake on my side. the link I used to test the connection was nat'ed. The vpn works like a charm now :) marc

1 0

Re: [suse-security] mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

> -----Original Message----- > From: Ken Schneider [mailto:kschneider@rtsx.com] > > > > You need to add an entry in /etc/ppp/chap-secrets as well for > authentication. > > Ken yeah sure, I knew I forgot something (to post) :) my chap-secrets looks like /etc/ppp/chap-secrets # INBOUND CONNECTIONS #client hostname <password> 192.168.1.1 "test" * "account" * marc

2 1

mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

Hi list, I try to build a vpn server with the PoPToP VPN Server. installed software: ppp-2.4.0-93 pptpd-1.1.2-60 /etc/pptpd.conf option /etc/ppp/options debug localip 192.168.0.1 remoteip 192.168.1.100-199 listen 10.0.0.1 /etc/ppp/options lock debug auth refuse-chap refuse-chap refuse-pap refuse-chap-md5 refuse-chapms require-chapms-v2 mppe-128 mppe-stateless nodeflate nobsdcomp nopredictor1 When I try to establish a connection from a windows 2000 client I get the following log entries: -- May 12 15:20:15 cps pptpd[1166]: MGR: Launching /usr/sbin/pptpctrl to handle client May 12 15:20:15 cps pptpd[1166]: CTRL: local address = 192.168.0.1 May 12 15:20:15 cps pptpd[1166]: CTRL: remote address = 192.168.1.100 May 12 15:20:15 cps pptpd[1166]: CTRL: pppd options file = /etc/ppp/options May 12 15:20:15 cps pptpd[1166]: CTRL: Client 10.0.0.2 control connection started May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 1) May 12 15:20:15 cps pptpd[1166]: CTRL: Made a START CTRL CONN RPLY packet May 12 15:20:15 cps pptpd[1166]: CTRL: I wrote 156 bytes to the client. May 12 15:20:15 cps pptpd[1166]: CTRL: Sent packet to client May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 7) May 12 15:20:15 cps pptpd[1166]: CTRL: 0 min_bps, 1525 max_bps, 32 window size May 12 15:20:15 cps pptpd[1166]: CTRL: Made a OUT CALL RPLY packet May 12 15:20:15 cps pptpd[1166]: CTRL: Starting call (launching pppd, opening GRE) May 12 15:20:15 cps pptpd[1166]: CTRL: pty_fd = 5 May 12 15:20:15 cps pptpd[1166]: CTRL: tty_fd = 6 May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): Connection speed = 115200May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): local address = 192.168.0.1 May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): remote address = 192.168.1.100 May 12 15:20:15 cps pptpd[1166]: CTRL: I wrote 32 bytes to the client. May 12 15:20:15 cps pptpd[1166]: CTRL: Sent packet to client May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 15) May 12 15:20:15 cps pptpd[1166]: CTRL: Got a SET LINK INFO packet with standard ACCMs May 12 15:20:15 cps modprobe: modprobe: Can't locate module char-major-108 May 12 15:20:15 cps pppd[1167]: The remote system is required to authenticate itself May 12 15:20:15 cps pppd[1167]: but I couldn't find any suitable secret (password) for it to use to do so. May 12 15:20:15 cps pppd[1167]: (None of the available passwords would let it use an IP address.) May 12 15:20:15 cps pptpd[1166]: Error reading from pppd: Input/output error May 12 15:20:15 cps pptpd[1166]: CTRL: GRE read or PTY write failed (gre,pty)=(6,5) May 12 15:20:15 cps pptpd[1166]: CTRL: Client 10.0.0.2 control connection finished May 12 15:20:15 cps pptpd[1166]: CTRL: Exiting now May 12 15:20:15 cps pptpd[1164]: MGR: Reaped child 1166 -- I tried to use various settings, like chapms-v2 authentication with weak encryption (40 bit), chap authentication without encryption... but it seems like I overlook something. if anyone could give me a hint in the right direction. TIA marc

2 1

Seccheck script errors - anything I need to worry about?
by Luke Loh 12 May '03

12 May '03

Dear List Recently, I've started getting the following message from the seccheck script: Cron <root@mail> test -x /usr/lib/secchk/security-control.sh && /usr/lib/secchk/security-control.sh daily & /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 315: [: too many arguments /usr/lib/secchk/security-daily.sh: line 315: [: too many arguments Looking at the offending lines in the script I get: 292 # .rhosts check 293 awk -F: '{ print $1 " " $6 }' /etc/passwd | 294 while read uid homedir; do 295 for j in .rhosts .shosts; do 296 if [ -s ${homedir}/$j ] ; then 297 rhost=`ls -lcdbg ${homedir}/$j|sed 's/[%\]/_/g'` 298 printf "$uid: $rhost\n" 299 test -f "$j" && { # still a race, however ... 300 if egrep \\+ ${homedir}/$j > /dev/null ; the n 301 printf "\t(has got a plus (+) sign!)\n" 302 fi 303 } 304 fi 305 done 306 done > $OUT 307 if [ -s "$OUT" ] ; then 308 printf "\nChecking for users with .rhosts/.shosts files.\n" 309 cat "$OUT" 310 fi 311 # Check home directories. Directories should not be owned by someone el se 312 # or writeable. 313 awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \ 314 while read uid homedir; do 315 if [ -d ${homedir}/ ] ; then 316 file=`ls -ldb ${homedir}|sed 's/[%\]/_/g'` 317 printf "$uid $file\n" 318 fi 319 done | My knowledge of awk is limited so I can't figure out what is wrong except that it's related to the ${homedir} variable. Is this something I should worry about? Should I just reinstall seccheck or is there something I need to investigate? Thank you and regards Luke Loh

3 2

AW: [suse-security] perl script drop
by TORSTEN.NEUMANN＠DLH.DE 12 May '03

12 May '03

noexec mount option doesn´t help at all: $ mount /dev/vg00/lvol9 on /mnt type reiserfs (rw,noexec) $ ./hello -bash: ./hello: Permission denied $ /lib/ld-linux.so.2 ./hello hello world $ file hello hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.0, dynamically linked (uses shared libs), not stripped Regards Torsten > ---------- > Von: Peter Wiersig[SMTP:wiersig-ml@dns.glamus.de] > Gesendet: Montag, 12. Mai 2003 13:48 > An: suse-security(a)suse.com > Betreff: Re: [suse-security] perl script drop > > petry wrote: > > Only a small hint for the /tmp-partition: mount it as follows in > > /etc/fstab > > > > /dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec > > > > with the noexec-parameter so no one is able to execute a created > > script from that directory > > Only when the script interpreter is located on the noexec partition: > > $ cat FreeSpace/hello.pl > print "Hello world\n"; > wiersig@peter:~ > $ ls -l FreeSpace/hello* > -rw-r--r-- 1 wiersig wiersig 23 May 12 13:47 FreeSpace/hello.pl > -rw-r--r-- 1 wiersig wiersig 17 May 12 13:45 FreeSpace/hello.sh > wiersig@peter:~ > $ perl FreeSpace/hello.pl > Hello world > > mount options don't help when faced with scripts. > > Have fun, > Peter > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

perl script drop
by Gerhard Stegmann 12 May '03

12 May '03

hi there i have 2.4.20 with apache 1.3.26 and mod_php 4.2.2 somehow it was possible for a guy, to drop a file /tmp/.ps on the machine, and to start perl on that file #>ps ax 1234 perl /tmp/.ps the file was created under wwwrun.www - ownership, which tells me that apache created it. the script just listens for incoming connections on p 4098, and opens a shell if the correct password is entered. is this issue known to someone here ? thanks, gerhard the script : ---------------------------------->8-------------- <<.ps>> ~~~~~~~~~~~~~~~~~~~~~~

2 1

New(?) exploit for webservers?
by Sven 'Darkman' Michels 12 May '03

12 May '03

evening, i noticed some weird logentries in my apache access log: 57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-" 57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-" 57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-" 66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-" 66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-" 66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-" 217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-" 217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-" 200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-" 217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-" 217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-" 217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-" 217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-" since 8th may they're some of these entries, mostly a few times from the same ip and the requests change a bit. Anybody has seen that before? or know anything about it? I quickchecked bugtraq for something like that but didn't found something. Regards, Sven

4 3

Source MAC Address DoS
by jiade 12 May '03

12 May '03

I got arp storm in my network(30 PCs and some WLAN devices), about 10,000 arp requests per second, no responses,lasting for severalminutes,all these arp requests have the same content which looks very strange: SRC DST info 0060e0017d96 0060f0017d96 who has 192.168.1.188? tell 192.168.1.188 it's an arp request but the DST is not a broadcast, and the DST is a real MAC address of one of my netcards while the SRC is a fake one. This happens several times a day but not regularly. Who will send millions of this kind of arp requests? Later I captured these packets and replayed this storm at 10000packets/s, no matter what kind of upper level protocol stuff (ARP,UDP or somethingelse) I filled in these packets ,they will jam up the Linux box whose MAC address is the same as the SOURCE (not the destination) MAC address of these packets. When I change the packets'source MAC address with the destination MAC address,the Linux box works well.I don't know the reason. Need your help, thanks.

2 4