June 2003 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] spam
by Ulrich Roth 16 Jun '03

16 Jun '03

Hi Philippe, > inetnum: 217.21.112.0 - 217.21.127.255 > netname: NL-CYBERANGELS-20030204 > descr: CyberAngels > country: NL > admin-c: MB9931-RIPE > tech-c: BA9919-RIPE > status: ALLOCATED PA > notify: ba(a)cyberangels.nl > mnt-by: RIPE-NCC-HM-MNT > mnt-lower: CYBERANGELS-MNT > mnt-routes: CYBERANGELS-MNT > changed: hostmaster(a)ripe.net 20030204 > source: RIPE > > [...] > > Is there a way to get rid of a spammer, if I get the > following from the > isp's address after writing to abuse@isp: > > [...] > > This message was created automatically by mail delivery > software (Exim). > > A message that you sent could not be delivered to one or more of its > recipients. This is a permanent error. The following > address(es) failed: > > abuse(a)cyberangels.nl > SMTP error from remote mailer after RCPT > TO:<abuse(a)cyberangels.nl>: > host mx.freenet.de [194.97.50.144]: 550 unrouteable address Try it again. Just tested the connection, it's working now. But how do you know that the e-mail address abuse(a)cyberangels.nl exists? I think you better also send a Cc to the given address ba(a)cyberangels.com. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

spam
by Philippe Vogel 16 Jun '03

16 Jun '03

Hi! You all know the mails: "free funds from us loads" (bla bla bla) you can get a lot of money and so on. The header is faked, like with all those spam mails. The mail leads to: http://www.easyusgrants.com/cashgrantsa.html ISP: [...] inetnum: 217.21.112.0 - 217.21.127.255 netname: NL-CYBERANGELS-20030204 descr: CyberAngels country: NL admin-c: MB9931-RIPE tech-c: BA9919-RIPE status: ALLOCATED PA notify: ba(a)cyberangels.nl mnt-by: RIPE-NCC-HM-MNT mnt-lower: CYBERANGELS-MNT mnt-routes: CYBERANGELS-MNT changed: hostmaster(a)ripe.net 20030204 source: RIPE [...] Is there a way to get rid of a spammer, if I get the following from the isp's address after writing to abuse@isp: [...] This message was created automatically by mail delivery software (Exim). A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: abuse(a)cyberangels.nl SMTP error from remote mailer after RCPT TO:<abuse(a)cyberangels.nl>: host mx.freenet.de [194.97.50.144]: 550 unrouteable address ------ This is a copy of the message, including all the headers. ------ [...] May this come from the isp having problems, because of too many abuse mails? I'm totally nerved of getting this spam and my mailserver cannot block mail from faked addresses. By the way, does anybody know, if it is possible to integrate dns-checks of faked mail-servers in the mail-headers? Philippe P.S.: Are there any higher privileged institutions to get rid of that isp, if he is behind that spam?

5 5

Re: [suse-security] spam
by Lothar Kimmeringer 15 Jun '03

15 Jun '03

On Sun, 15 Jun 2003 15:57:27 +0200, Philippe Vogel wrote: >You all know the mails: "free funds from us loads" (bla bla bla) you can get >a lot of money and so on. [...] That's the wrong maillist for that. The best would be to consult the newsgroup de.admin.net-abuse.mail (assuming from your freenet.de- address). > abuse(a)cyberangels.nl > SMTP error from remote mailer after RCPT TO:<abuse(a)cyberangels.nl>: > host mx.freenet.de [194.97.50.144]: 550 unrouteable address Seems that there is a routing-problem on cyberangels' side. This doesn't necessarily mean they don't care about complaints. >May this come from the isp having problems, because of too many abuse mails? No, then something like "quota exceeded" or "mailbox full" would be in the response. >By the way, does anybody know, if it is possible to integrate dns-checks of >faked mail-servers in the mail-headers? What exactly do you mean with faked mail-servers? >P.S.: Are there any higher privileged institutions to get rid of that isp, >if he is behind that spam? www.spews.org Another good resource is the international newsgroup news.admin.net-abuse.email Regards, Lothar

2 1

Dodgy Apache Connections
by keith＠topaz5.worldonline.co.uk 14 Jun '03

14 Jun '03

Hi all! I have noticed the following connections to port 80 on my machine via my dial-up ISP. Found them in my apache access-log. Anyone got any ideas what they are? ns1.bios.gr.jp - - [20/May/2003:12:17:09 +0000] "CONNECT 1.3.3.7:1337 HTTP/1.0" 403 309 "-" "-" dial-62-64-232-188.access.uk.tiscali.com - - [20/May/2003:19:35:05 +0000] "GET /scripts/root.exe?/c+dir HTTP/1.0" 403 325 "-" "-" pj38.lodz.sdi.tpnet.pl - - [22/May/2003:21:54:57 +0000] "\xe3>" 403 - "-" "-" 212.66.160.107 - - [23/May/2003:22:24:13 +0000] "SEARCH / HTTP/1.1" 403 321 "-" "-" pd9e1e5c7.dip.t-dialin.net - - [13/Jun/2003:23:32:24 +0000] "GET / HTTP/1.0" 403 309 "-" "DSNS 1.0" Seems to me as though people are poking around my machine while I'm online. My ISP is tiscali. Regards K. Roberts

2 1

WEB port forwarding
by Istvan Hollo 14 Jun '03

14 Jun '03

Hello List, SuSE 8.2 Currently my webserver is running on the Firewall machine but I want to move it to another machine, behind the firewall. Settings on the firewall: FW_ROUTE="yes" FW_MASQ_NETS="1.2.3.0/24" FW_FORWARD="0/0,1.2.3.4,tcp,80 0/0,1.2.3.4,tcp,443" FW_REDIRECT="1.2.3.0/24,0/0,tcp,53,53" IP forwarning is enabled. Apache is stopped on the firewall machine. But it does not want to work. Can someone of you point me to the right direction? thanks, istvan

4 4

SuSE Security Announcement: radiusd-cistron (SuSE-SA:2003:030)
by Thomas Biege 13 Jun '03

13 Jun '03

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: radiusd-cistron Announcement-ID: SuSE-SA:2003:030 Date: Friday, Jun 13th 2003 09:32 MET Affected products: 7.2, 7.3, 8.0 Vulnerability Type: possible remote system compromise SuSE default package: no Cross References: http://bugs.debian.org/cgi-bin/bugreport.cgi ?bug=196063 Content of this advisory: 1) security vulnerability resolved: handling too large NAS numbers problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - lprng - frox - poster - ghostscript-library 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The package radiusd-cistron is an implementation of the RADIUS protocol. Unfortunately the RADIUS server handles too large NAS numbers not correctly. This leads to overwriting internal memory of the server process and may be abused to gain remote access to the system the RADIUS server is running on. There is no temporary workaround known. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Please note, missing packages will be published as soon as possible. Intel i386 Platform: SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/radiusd-cistron-1.6.6-88.i38… e61fb299edfb092f24b3e455256cf262 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/radiusd-cistron-1.6.6-88.i38… d323307d4bc4c0e4dc0bcef3f848b91f source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/radiusd-cistron-1.6.6-88.sr… fc7718319972625612292798092d9a8b SuSE-7.3: ftp://ftp.suse.com/pub/suse/i386/update/7.3/n3/radiusd-cistron-1.6.4-182.i3… ee949e18ef02e87dffc4b5ea8d5d5ec5 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/radiusd-cistron-1.6.4-182.s… f4f87aab549967c0d4c216c8d2e312a1 SuSE-7.2: ftp://ftp.suse.com/pub/suse/i386/update/7.2/n3/radiusd-cistron-1.6.4-182.i3… e5a20985f79c887739ce0b83539c347b source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/radiusd-cistron-1.6.4-182.s… f5f73b9e9c3e5d338bfddd1a6b2b14d8 Sparc Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n3/radiusd-cistron-1.6.4-70.sp… 7318cc63ec3c29618b81ae6c8eb29fc8 source rpm(s): ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/radiusd-cistron-1.6.4-70.s… 0212fba5fd8d4ff3e9afe4a8a8802655 PPC Power PC Platform: SuSE-7.3: ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n3/radiusd-cistron-1.6.4-108.ppc… 30f9920f2a8d2db0e8eb2a0439d61118 source rpm(s): ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/radiusd-cistron-1.6.4-108.sr… 8133911f08442832c383000cb65e70ca ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - lprng A race condition in psbanner was fixed that can be abused by local users to overwrite file owned by daemon:lp. New packages are available on out FTP servers. - frox The init script of frox handled tmp file in an insecure manner. This behavior can be exploited by local users. New packages are available on out FTP servers. - poster A possible buffer overflow due to usage of gets() was fixed which could have been exploited by malicious input data to execute code under the user id of the user running poster. New packages are available on out FTP servers. - ghostscript-library Malicious PostScript[tm] files could execute shell commands even if the ghostscript interpreter was invoked with the -dSAFER flag. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SuSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBPunDg3ey5gA9JdPZAQGO4ggAgK7hPXWRsbX7/NnJ1Wl3zAJiB/V1UEah 8+d/P8JgkimKE0k8fSoJx8yGeWT4c9uoYg7Pk6OlLvyaxdF4sqg1uMD7uQm6mRx8 iUiZXvD2tFBVmbpBH/wKf6Ma/aGrlL0Zvbyrvwacid1iuLDfX2R0HMUy1ofOYfYd U5e9smWpnF0ZrSY63ZgWURJU8WbIWMAD/E7wn+CVwd0xUS71cj0uwb/ExXBX9epZ k5ztrqyOw/FokAy+kwCC7gECFphi3oJXS3XQ940UrIxMZS2/yXBE3+dQqz+WM9z4 pPAza8g5WjXjJiV0mN4AbIEVirTGgumBJ95iCCEtedO0/xO9J8ib9A== =5U8e -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege <thomas(a)suse.de> SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | gpg --import" Key fingerprint = 7254 B15D B3C4 943F 485E 0BBD 8ECC D7CB C200 A213 -- Das erste Opfer einer Schlacht ist immer der Schlachtplan.

1 0

SSH and CHROOT alternatives...
by Duncan Carter 12 Jun '03

12 Jun '03

Howdoo all, I've been looking at trying to secure SSH sessions so that specified users can only browse their home diretories. I've found a couple of bodges that can be made to do the trick, but none of them seem particulalry ideal. Has anyone got any suggestions on how I could secure SSH in this fashion, whether using CHROOT or something else entirely I don't mind. Cheers. ----~~~~==oOo==~~~~---- Duncan Carter ----~~~~==oOo==~~~~----

2 1

Why do I have so many ANTI-SPOOFING?
by Puth Chan Choth 12 Jun '03

12 Jun '03

Hello all, I have many ANTI-SPOOFINGs. I spoofed from my public IP to my broadcast and I do not why? Here is the log file that I got: Jun 5 14:49:55 server1 kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= MAC= SRC=[My Public IP] DST=[My Public Broadcast] LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=32 Does it mean that someone tries to hack me? If it is, how can I protect myself from hacking? Thank you so much for your assistance. Best regards, Chan Choth

3 3

AW: [suse-security] Amavis / Sendmail Problem
by Ulrich Roth 12 Jun '03

12 Jun '03

Hi Uwe, > I'm running a SuSE 7.2 as a Mail-Server. Since my last > OnlineUpdate, which updated sendmail, I have the problem, > that amavis is not started anymore. > "rcamavis status" tells me "amavis:OK", > but the following thing is in the /var/log/boot.msg > > Starting virus-scanning for sendmail > (amavis)<notice>startproc: execve (/usr/sbin/amavis-milter) [ /usr/sbin/amavis-milter -p local:/var/run/amavis.sock failed ], [ > PWD=/ BOOT_FILE=/boot/vmlinuz HOSTNAME=bart > CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES > MACHTYPE=i386-suse-linux LINES=25 SHLVL=2 COLUMNS=80 > BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux > HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin > RUNLEVEL=3 INIT_VERSION=sysvinit-2.78 _=/sbin/startproc > DAEMON=/usr/sbin/amavis-milter ] > done > > Does anybody have a clue what happened there? I use Sophos > sweep for scanning and it works. I even checked > /usr/sbin/amavis for changes but everything looks perfect. It looks like the file /var/run/amavis.sock can't be created (I assume because of missing write permissions, but don't ask me why they are missing). Nevertheless amavis seems to start up and run. If I remember well I had a similar problem with sendmail in some other SuSE distro. So I changed the write permissions, but then I got another error message that this directory is world writeable and therefore some other thing didn't work. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1

About CVS server access
by Jianyu Wang 12 Jun '03

12 Jun '03

Please help me. I use SuSE 8.0. I set my cvs server in inetd.config like this: cvsserver stream tcp nowait root /usr/sbin/tcpd /usr/bin/cvs -f --allow-root=/home/cvsroot pserver now I can use it in local network, but get a error message when I use it from outside via internet, I think the problem maybe in host.allow file, now I changed it like this: http-rman:ALL Please tell me , is it correct? Or it is not the key, then please tell me how I should do? Thanks Shanshui

2 1