May 2003 - openSUSE Security - openSUSE Mailing Lists

Windows commands for linux internet
by Chris Bek 12 May '03

12 May '03

Hi folks, I have a Linux server which serves as an Internet gateway for a 5 PC = (Win9X) network. Everything works find so far and SuSEFirewall is also operating nicely. The problem is the following: The main user of the network wants to have 2 icons on his desktop = (Win9X) such that: By double clicking the first one, the LinuxBox dials-in the internet and = the 2nd logs him out. Any good ideas about this?? The current installation of the Linux Box is a 7.2 SuSE out-of-the-box = installation. Thanx friends. Chris

8 7

Re: [suse-security] perl script drop
by petry 12 May '03

12 May '03

Only a small hint for the /tmp-partition: mount it as follows in /etc/fstab /dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec with the noexec-parameter so no one is able to execute a created script from that directory Greetings olaf >>> "Gerhard Stegmann" <gerhard.stegmann(a)magelan.net> 12.05.2003 13:12 >>> hi there i have 2.4.20 with apache 1.3.26 and mod_php 4.2.2 somehow it was possible for a guy, to drop a file /tmp/.ps on the machine, and to start perl on that file #>ps ax 1234 perl /tmp/.ps the file was created under wwwrun.www - ownership, which tells me that apache created it. the script just listens for incoming connections on p 4098, and opens a shell if the correct password is entered.

5 4

Re: [suse-security] mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

> -----Original Message----- > From: Ken Schneider > > > > > yeah sure, I knew I forgot something (to post) :) > > my chap-secrets looks like > > > > /etc/ppp/chap-secrets > > > > # INBOUND CONNECTIONS > > #client hostname <password> 192.168.1.1 > > "test" * "account" * > > Comment out the "test" entry and add a real account. Something like: > > marc linux1 <password(without the<>)> ip.addressed.you.want > > Then you should be able to log in. > > Ken Thanks for your help, it was a silly mistake on my side. the link I used to test the connection was nat'ed. The vpn works like a charm now :) marc

1 0

Re: [suse-security] mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

> -----Original Message----- > From: Ken Schneider [mailto:kschneider@rtsx.com] > > > > You need to add an entry in /etc/ppp/chap-secrets as well for > authentication. > > Ken yeah sure, I knew I forgot something (to post) :) my chap-secrets looks like /etc/ppp/chap-secrets # INBOUND CONNECTIONS #client hostname <password> 192.168.1.1 "test" * "account" * marc

2 1

mppe encryption with pptpd under suse 7.2
by Marc Samendinger 12 May '03

12 May '03

Hi list, I try to build a vpn server with the PoPToP VPN Server. installed software: ppp-2.4.0-93 pptpd-1.1.2-60 /etc/pptpd.conf option /etc/ppp/options debug localip 192.168.0.1 remoteip 192.168.1.100-199 listen 10.0.0.1 /etc/ppp/options lock debug auth refuse-chap refuse-chap refuse-pap refuse-chap-md5 refuse-chapms require-chapms-v2 mppe-128 mppe-stateless nodeflate nobsdcomp nopredictor1 When I try to establish a connection from a windows 2000 client I get the following log entries: -- May 12 15:20:15 cps pptpd[1166]: MGR: Launching /usr/sbin/pptpctrl to handle client May 12 15:20:15 cps pptpd[1166]: CTRL: local address = 192.168.0.1 May 12 15:20:15 cps pptpd[1166]: CTRL: remote address = 192.168.1.100 May 12 15:20:15 cps pptpd[1166]: CTRL: pppd options file = /etc/ppp/options May 12 15:20:15 cps pptpd[1166]: CTRL: Client 10.0.0.2 control connection started May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 1) May 12 15:20:15 cps pptpd[1166]: CTRL: Made a START CTRL CONN RPLY packet May 12 15:20:15 cps pptpd[1166]: CTRL: I wrote 156 bytes to the client. May 12 15:20:15 cps pptpd[1166]: CTRL: Sent packet to client May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 7) May 12 15:20:15 cps pptpd[1166]: CTRL: 0 min_bps, 1525 max_bps, 32 window size May 12 15:20:15 cps pptpd[1166]: CTRL: Made a OUT CALL RPLY packet May 12 15:20:15 cps pptpd[1166]: CTRL: Starting call (launching pppd, opening GRE) May 12 15:20:15 cps pptpd[1166]: CTRL: pty_fd = 5 May 12 15:20:15 cps pptpd[1166]: CTRL: tty_fd = 6 May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): Connection speed = 115200May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): local address = 192.168.0.1 May 12 15:20:15 cps pptpd[1167]: CTRL (PPPD Launcher): remote address = 192.168.1.100 May 12 15:20:15 cps pptpd[1166]: CTRL: I wrote 32 bytes to the client. May 12 15:20:15 cps pptpd[1166]: CTRL: Sent packet to client May 12 15:20:15 cps pptpd[1166]: CTRL: Received PPTP Control Message (type: 15) May 12 15:20:15 cps pptpd[1166]: CTRL: Got a SET LINK INFO packet with standard ACCMs May 12 15:20:15 cps modprobe: modprobe: Can't locate module char-major-108 May 12 15:20:15 cps pppd[1167]: The remote system is required to authenticate itself May 12 15:20:15 cps pppd[1167]: but I couldn't find any suitable secret (password) for it to use to do so. May 12 15:20:15 cps pppd[1167]: (None of the available passwords would let it use an IP address.) May 12 15:20:15 cps pptpd[1166]: Error reading from pppd: Input/output error May 12 15:20:15 cps pptpd[1166]: CTRL: GRE read or PTY write failed (gre,pty)=(6,5) May 12 15:20:15 cps pptpd[1166]: CTRL: Client 10.0.0.2 control connection finished May 12 15:20:15 cps pptpd[1166]: CTRL: Exiting now May 12 15:20:15 cps pptpd[1164]: MGR: Reaped child 1166 -- I tried to use various settings, like chapms-v2 authentication with weak encryption (40 bit), chap authentication without encryption... but it seems like I overlook something. if anyone could give me a hint in the right direction. TIA marc

2 1

Seccheck script errors - anything I need to worry about?
by Luke Loh 12 May '03

12 May '03

Dear List Recently, I've started getting the following message from the seccheck script: Cron <root@mail> test -x /usr/lib/secchk/security-control.sh && /usr/lib/secchk/security-control.sh daily & /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 296: [: too many arguments /usr/lib/secchk/security-daily.sh: line 315: [: too many arguments /usr/lib/secchk/security-daily.sh: line 315: [: too many arguments Looking at the offending lines in the script I get: 292 # .rhosts check 293 awk -F: '{ print $1 " " $6 }' /etc/passwd | 294 while read uid homedir; do 295 for j in .rhosts .shosts; do 296 if [ -s ${homedir}/$j ] ; then 297 rhost=`ls -lcdbg ${homedir}/$j|sed 's/[%\]/_/g'` 298 printf "$uid: $rhost\n" 299 test -f "$j" && { # still a race, however ... 300 if egrep \\+ ${homedir}/$j > /dev/null ; the n 301 printf "\t(has got a plus (+) sign!)\n" 302 fi 303 } 304 fi 305 done 306 done > $OUT 307 if [ -s "$OUT" ] ; then 308 printf "\nChecking for users with .rhosts/.shosts files.\n" 309 cat "$OUT" 310 fi 311 # Check home directories. Directories should not be owned by someone el se 312 # or writeable. 313 awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \ 314 while read uid homedir; do 315 if [ -d ${homedir}/ ] ; then 316 file=`ls -ldb ${homedir}|sed 's/[%\]/_/g'` 317 printf "$uid $file\n" 318 fi 319 done | My knowledge of awk is limited so I can't figure out what is wrong except that it's related to the ${homedir} variable. Is this something I should worry about? Should I just reinstall seccheck or is there something I need to investigate? Thank you and regards Luke Loh

3 2

AW: [suse-security] perl script drop
by TORSTEN.NEUMANN＠DLH.DE 12 May '03

12 May '03

noexec mount option doesn´t help at all: $ mount /dev/vg00/lvol9 on /mnt type reiserfs (rw,noexec) $ ./hello -bash: ./hello: Permission denied $ /lib/ld-linux.so.2 ./hello hello world $ file hello hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.0, dynamically linked (uses shared libs), not stripped Regards Torsten > ---------- > Von: Peter Wiersig[SMTP:wiersig-ml@dns.glamus.de] > Gesendet: Montag, 12. Mai 2003 13:48 > An: suse-security(a)suse.com > Betreff: Re: [suse-security] perl script drop > > petry wrote: > > Only a small hint for the /tmp-partition: mount it as follows in > > /etc/fstab > > > > /dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec > > > > with the noexec-parameter so no one is able to execute a created > > script from that directory > > Only when the script interpreter is located on the noexec partition: > > $ cat FreeSpace/hello.pl > print "Hello world\n"; > wiersig@peter:~ > $ ls -l FreeSpace/hello* > -rw-r--r-- 1 wiersig wiersig 23 May 12 13:47 FreeSpace/hello.pl > -rw-r--r-- 1 wiersig wiersig 17 May 12 13:45 FreeSpace/hello.sh > wiersig@peter:~ > $ perl FreeSpace/hello.pl > Hello world > > mount options don't help when faced with scripts. > > Have fun, > Peter > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

perl script drop
by Gerhard Stegmann 12 May '03

12 May '03

hi there i have 2.4.20 with apache 1.3.26 and mod_php 4.2.2 somehow it was possible for a guy, to drop a file /tmp/.ps on the machine, and to start perl on that file #>ps ax 1234 perl /tmp/.ps the file was created under wwwrun.www - ownership, which tells me that apache created it. the script just listens for incoming connections on p 4098, and opens a shell if the correct password is entered. is this issue known to someone here ? thanks, gerhard the script : ---------------------------------->8-------------- <<.ps>> ~~~~~~~~~~~~~~~~~~~~~~

2 1

New(?) exploit for webservers?
by Sven 'Darkman' Michels 12 May '03

12 May '03

evening, i noticed some weird logentries in my apache access log: 57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-" 57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-" 57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-" 66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-" 66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-" 66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-" 217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-" 217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-" 200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-" 217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-" 217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-" 217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-" 217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-" 80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-" since 8th may they're some of these entries, mostly a few times from the same ip and the requests change a bit. Anybody has seen that before? or know anything about it? I quickchecked bugtraq for something like that but didn't found something. Regards, Sven

4 3

Source MAC Address DoS
by jiade 12 May '03

12 May '03

I got arp storm in my network(30 PCs and some WLAN devices), about 10,000 arp requests per second, no responses,lasting for severalminutes,all these arp requests have the same content which looks very strange: SRC DST info 0060e0017d96 0060f0017d96 who has 192.168.1.188? tell 192.168.1.188 it's an arp request but the DST is not a broadcast, and the DST is a real MAC address of one of my netcards while the SRC is a fake one. This happens several times a day but not regularly. Who will send millions of this kind of arp requests? Later I captured these packets and replayed this storm at 10000packets/s, no matter what kind of upper level protocol stuff (ARP,UDP or somethingelse) I filled in these packets ,they will jam up the Linux box whose MAC address is the same as the SOURCE (not the destination) MAC address of these packets. When I change the packets'source MAC address with the destination MAC address,the Linux box works well.I don't know the reason. Need your help, thanks.

2 4