May 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Seccheck script errors - anything I need to worry about?
by Luke Loh 11 May '03

11 May '03

Sven I've just gone through the home directories - none of them have spaces in them. Some of them have a period "." in their name though - would this break the script? The only other different thing I do is that I put home directories into groups, so User A, Group A would have his homedir /home/groupa/usera for eg. I also have many users that have no home directories - they are POP3 users so they are /bin/false. Would this also be an issue? Thing is, I've never had the secchk script give this problem before until last week ... perhaps a new user I created might have broken the script ... just trying to figure out how ... Regards Luke -----Original Message----- From: Sven 'Darkman' Michels [mailto:sven@darkman.de] Sent: Monday, 12 May 2003 9:00 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Seccheck script errors - anything I need to worry about? Luke Loh wrote: > My knowledge of awk is limited so I can't figure out what is wrong > except that it's related to the ${homedir} variable. > > Is this something I should worry about? Should I just reinstall > seccheck or is there something I need to investigate? Maybe you have spaces in the usernames/homes? like /home/bla fasel/? think that would cause it. HTH Sven -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Info about ports
by Pedro Cáliz 10 May '03

10 May '03

Hello list, Somebody knows where can I find a full list of port names? (like /etc/services, but more complete). I'm receiving continuous conections attemps to some ports I don't know what use may they have. More over, I'm not listening on this ports, nor they are permited in SuSEfirewall2 (it must be droped by default), but the firewall accepts that conections. I'm a bit concerned about this. I would like to know what serves this ports before drop it explicitly in the fw config. Regards, Pedro

4 3

Port 33270 and Trinity
by Paul Kozlenko 09 May '03

09 May '03

All: I have SuSE 8.1 Profesional running on a machine that appears to have port 33270 open. I found this as a result of running "saint". Saint reports this to be a possible problem. Description: Trinity is a Distributed Denial of Service tool that is controlled by IRC. In the version that the X-Force has been analyzing, the agent binary is installed on a Linux system at /usr/lib/idle.so. When idle.so is started, it connects to an Undernet IRC server on port 6667 What to do: Scan all systems for port 33270 connections. If any connections are found, telnet to that port and type "!@#". A system has been compromised if there is a root shell present after a successful connection to port 33270 In doing the above from another SuSE linux machine I get: #telnet linuxmachine 33270 Trying 172.20.1.99... Connected to linuxmachine. Escape character is '^]'. and then typing the "!@#" I get: Connection closed by foreign host. While this is good. I don't know what on my system is responding to this port. An "lsof -i TCP:33270" returns nothing. netstat -ea shows tcp 0 0 *:33270 *:* LISTEN root 31464 Can anybody tell me if I should start to panic! Or what this could be. Thanks - Paul

6 14

Re: [suse-security] Source MAC Address DoS
by jiade 09 May '03

09 May '03

> > I got arp storm in my network(30 PCs and some WLAN devices), > > about 10,000 arp requests per second, no responses,lasting > > for severalminutes,all these arp requests have the same content > > which looks very strange: > > > > SRC DST info > > 0060e0017d96 0060f0017d96 who has 192.168.1.188? tell > 192.168.1.188 > > Is 00:60:e0:01:7d:96 or is 00:60:f0:01:7d:96 192.168.1.188 (LAN-IP)? > Have both the same IP? 00:60:e0:01:7d:96 is 192.168.1.188 There is no NIC whose MAC address is 00:60:f0:01:7d:96 > Looks like duplicated IP(00:60:e0:01:7d:96 looks at 00:60:f0:01:7d:96 if it > has 192.168.1.188 as seen in the packet capture). > Is there a DHCP in your LAN and is it on one of both above mentioned NIC's? > Normal ARP requests go from DHCP to client xy. > Have a realtime snapshot with iptraf or etherreal. A DHCP is at 192.168.1.1, whose MAC address is 00:50:04:bd:0d:70, 192.168.1.188 is not a DHCP client, it's a static IP. > > it's an arp request but the DST is not a broadcast, > > and the DST is a real MAC address of one of my netcards > > while the SRC is a fake one. > > This happens several times a day but not regularly. > > Who will send millions of this kind of arp requests? > > > > Later I captured these packets and replayed this storm at 10000packets/s, > > no matter what kind of upper level protocol stuff (ARP,UDP or > somethingelse) > > I filled in these packets ,they will jam up the Linux box whose MAC > address > > is the same as the SOURCE (not the destination) MAC address of these > > packets. > > When I change the packets'source MAC address with the destination MAC > > address,the Linux box works well.I don't know the reason. > > Is this 00:60:e0:01:7d:96 ? Yes. Jiade

1 0

Bug in SuSEfirewall2 when blocking a range of ports with custom rules ?
by malte_gell＠t-online.de 07 May '03

07 May '03

Hello, I just blocked a range of ports via firewall2-custom.rc.config, just as an example: for target in DROP; do for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do iptables -A $chain -j $target -p tcp --dport 4000:6000 done done the used section is fw_custom_before_port_handling. The iptables syntax seem to be okay, but if I do this and connect to the ISP SuSEfirewall2 seem to block every incoming connection, so the connections seems to be "dead", though establishing the connection is okay. When blocking a single port e.g. with iptables -A $chain -j $target -p tcp --dport 4001 it works fine and no problems occur. So, is there a known problem when blocking a whole range of ports with the "X:Y" syntax of iptables and SuSEfirewall2 ? The used version is SuSEfirewall2 2.1. Thanx Malte

1 0

IDE MO-Drive on Suse Linux 8.2
by Lars Vaessen 07 May '03

07 May '03

Hi all I try to run an Mo-drive ide from Fujitsu on Suse Linux 8.2 Wen I try to mount it, I get : can't read superblock Is it possible to use an ide MO ? Or what is my mistake ! mount /dev/hdc /mo I also get an input/output Error Thanks Lars

1 0

Questions about arp storm.
by jiade 07 May '03

07 May '03

I got arp storm in my network(30 PCs and some WLAN devices), about 10,000 arp requests per second, no responses, lasting for several minutes, all these arp requests have the same content which looks very strange: SRC DST info 0060e0017d96 0060f0017d96 who has 192.168.1.188? tell 192.168.1.188 it's an arp request but the DST is not a broadcast, and the DST is a real MAC address of one of my netcards while the SRC is a fake one. This happens several times a day but not regularly. Who will send millions of this kind of arp requests? Need your help, thanks.

1 0

7.1 security updates ?
by Daniel Nilsson 06 May '03

06 May '03

Hi, We have one server left running SuSE 7.1, but as far as I can tell we are still getting security updates for this machine. I was expecting the updates to stop when SuSE 8.2 was released, that appears to have been the case in the past. We are working on upgrading this machine, but are experiencing some trouble (hardware related). Is there a date when the security updates for 7.1 will stop ? Thanks -- Daniel Nilsson

2 1

CA-2003-10 SunRPC XDR glibc
by Helge Hansemann 05 May '03

05 May '03

Hi, I saw the postings at the begining of april, concerning the pending vulnerability of the glibc (SunRPC XDR Integer Overflow). Could someone from SuSE tell me about the current status of fixing the glibc ? Thanks and greetings, Helge Hansemann

2 1

AW: [suse-security] chkrootkit and consorts
by Ulrich Roth 05 May '03

05 May '03

Hi all, of course I addes the files to xfiles.txt, not to xstrings.txt. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

AW: [suse-security] chkrootkit and consorts
by Ulrich Roth 05 May '03

05 May '03

Hi Andreas, > 3 - which of the tools should i have running deamonized? I ran rkdet daemonized. > 4 - which files should i protect/have watched by rkdet? I added /usr/bin/lsof, /sbin/lsmod and /bin/df to xstrings.txt. > 5 - what do you think of the idea of creating and regularly running a > customized shellscript that would unzip the tools plus a > set of trusted binaries and then uses these instead of the > always-installed ones? But that would mean i had to make special > setups/'make install's, wouldn't it? and it wouldn't work with resident > tools (rkdet) at all, right? I do this with tripwire. I compiled and installed it on the machines to be checked as if it was a permanent installation. And now I copy the executable, the config files and the database every night to the machines to be checked, do the check and then delete the files again. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Looking for a tool (Diese Mail wurde auf Viren gepr?ft.)
by dhoffmann＠obg-bau.de 05 May '03

05 May '03

Hi folks, Problem: In our company we have a pool of online resources which are protected via basic http-auth, some of them use https. Our employees should be able to use these urls without knowing the credentials. Our internet gateway is running SuSE 8.0. My idea is to install or script something on this box which is called with the desired link and then does the authentication transparently to the user. Does anyone know about some kind of software to handle this? -- Denis Hoffmann IT OBG Bau GmbH & Co.KG Illinger Straße 150 66564 Ottweiler Tel.: 06824 3000 351 Fax: 06824 3000 500 http://www.obg-bau.de/

4 5

chkrootkit and consorts
by Andreas Wagner 05 May '03

05 May '03

Hi list, i have downloaded chkrootkit, check_ps and rkdet, but i have a hard time in figuring out how (best) to use them. As far as you don't see your own security compromised, i'd like to know some of your thoughts or configurations of these tools... 1 - are any of the tools redundant and can be dropped (i think i understood that the functionality of check_ps is provided by chkrootkit as well which does even more...)? 2 - is any anti-rootkit tool missing (not speaking of tripwire etc.)? 3 - which of the tools should i have running deamonized? 4 - which files should i protect/have watched by rkdet? 5 - what do you think of the idea of creating and regularly running a customized shellscript that would unzip the tools plus a set of trusted binaries and then uses these instead of the always-installed ones? But that would mean i had to make special setups/'make install's, wouldn't it? and it wouldn't work with resident tools (rkdet) at all, right? and so on, i could go on asking for hours, but i'll appreciate just about any help. TIA, Andreas -- To know recursion, you must first know recursion. -- My Public PGP Keys: 1024 Bit DH/DSS: 0x869F81BA 768 Bit RSA: 0x1AD97BA5

3 4

iptables config
by Grutsch, Gerhard 03 May '03

03 May '03

Hi, i have got : network A with ip adress room 192.168.x.x (this side also connects to the internet) network B with ip adress room 10.x.x.x (my internal LAN) and a router with is a Linux box to connect the 2 lans via routing. So far so good, the traffic is running between the 2 networks, since i configures the routes on both networks. ------------| |------------ | | LAN A |-----------------------ROUTER---------------| LAN B | | ------------- -------------- My problem is though, i have no restrictions! I know the first few commands like : iptables -P FORWARD DROP, but i want to regulate, that WKS_A from LAN_A can communicate with WKS_1 from LAN_B but not with WKS_2 from LAN_B. Or that WKS_1 on LAN_A is allowed to use SSH ánd nothing else, but WKS_2 on LAN_A can use all tcp/ip services....... Thanx a lot in advance Gerhard Grutsch Support services Tel : 089/55878-151 Mobile : 0172-8391368 E-mail : ggrutsch(a)statestreet.com

4 3

eSignal
by Gooly 03 May '03

03 May '03

This weekend I have to (want to) install eSignal-Software on Windows behind a Linux Firewall. It will collect data (real-time exchange-quotes) from different servers: "The communications between the client and server use both the "query-response" type and active/streaming technology (TCP). " First question, does anybody on this list has allreday experience with this (copy and paste some settings of firewall and/or squid?). The second question-part is about the power that has to have the firewall-pc (right now a little bit old) if squid is installed. - Does squid consume a lot 'power' memory and diskspace, what would be a recommandation? There is no need to save the data on the firewall for another pc. - The real-time data shold be handed to the program as soon as possible, of course. Now some questions about things I haven't heared so far. "You may use a proxy server if it is SOCKS v4, v4.3A or v5 compliant." Is that ok with Squid? This is a special note form the eSignal-site - what does this mean? How can I make the firewall/squid to 'toggle' between IP- and user-Identification? - Please note: eSignal applications do not support authentication queries from - the firewall/proxy server. It is strongly recommended that you use IP - authentication instead of user authentication; otherwise, the eSignal - application program on the client machine will not be able to access its - Internet servers. Thanks to all in advance, Carl

4 3

Just a problem with 'Online-Update'
by Christof Schmitt 02 May '03

02 May '03

Hi list, i am sorry, if i am wrong and it isn't a security question at all. But maybe i made a mistake while i was trying to update my SuSE 8.0 System by Yast and 'Online Update'. I tried 'auto update' and 'manual update' with different ftp-Servers: Patch-Descriptions were downloaded to 100%, but the next step: installation brake down (after yast-module-autoinst-833 is not downable -> installation). At least Online Update shows a list of 63 recommended patches and 95 security patches, but i can't get them. What did i do wrong? regards, Christof Schmitt

2 1

Can't make losetup mount a crypto file to the loopback device (SuSE 8.2)
by Bo Jacobsen 01 May '03

01 May '03

I'm trying to mount a file to the loopback device but the losetup command complains about it. I'm using the command line: losetup -e twofish /dev/loop0 /root/testfile losetup asks for a password but returns: ioctl: LOOP_SET_STATUS: invalid argument when one is entered "losetup -e none" works I have tried with the standard kernel in SuSE 8.2 but also kernel 2.4.20-13 with both "loopback device support" and "Twofish encryption for loopback device" compiled into the kernel. Any suggestions. Thanks in advance Bo Jacobsen

3 4

Snort
by Richard Ibbotson 01 May '03

01 May '03

Hi Would anyone at SuSE or anyone else like to make a comment about the following on the Snort home pages ... http://www.snort.org/ .... news page Snort Advisory: Integer Overflow in Stream4 Brian @ Wed Apr 16 14:52:33 EDT 2003 Affected Versions: # All versions of the following products are affected: Snort 1.8 through 1.9.1 # Snort CVS - current branch up to version 2.0.0 beta I notice that SuSE 8.2 uses Snort Version 1.9.1 (Build 231) By Martin Roesch (roesch(a)sourcefire.com, www.snort.org) Will there be an update soon or is the SuSE version of Snort not vulnerable to this bug ? Thanks -- Richard www.sheflug.co.uk

2 2

updatedb@locate
by Sourian 01 May '03

01 May '03

I understand. Why is it no longer installed by default? Is it replaced by something else? If I need to search for a command, how can I do it? Best regards, Sourian

4 3