July 2003 - openSUSE Security - openSUSE Mailing Lists

Abwesenheitsnotiz
by Jeff Harris 14 Jul '03

14 Jul '03

On Mon, 14 Jul 2003 Josef.Fuchs(a)leykam.local wrote: > Ich bin in der Zeit zwischen 14.7. bis 1.8.2003 auf Urlaub > > Josef Fuchs > PLEASE, PLEASE configure your vacation replies (if you're using vacation it should do this automatically) to NOT respond to this list. It shouldn't be too hard since this list, like most correctly set up lists, have "Precedence: bulk" as a header. Few things are as irritating as sending a post and receiving 5 or more messages that people are out of the office. (Of course the default reply-to address is a topic for another conversation on another list and shouldn't be brought up here. Do a web search for the pros & cons and keep your opinion on those lists.) -- Registered Linux user #304026. "lynx -source http://www.rallycentral.us/~linux/jharris.asc | gpg --import" or "gpg --keyserver pgp.mit.edu --recv-key BD23A31E" Key fingerprint = FB8C 3210 8DE1 78F4 6505 5918 0C34 BE94 BD23 A31E

1 0

HTTP Strange LOG
by cydonia＠cbn.net.id 14 Jul '03

14 Jul '03

Dear List, I have this strange logs in my APache Web server, 202.159.151.106 - - [10/Jul/2003:14:53:15 +0700] "GET /default.ida?XXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u909 0%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00% u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 271 "-" "-" Is My WEb server attacked ? If it is, How should i configure my Apache? Best Regards, Kheli

2 1

Creating rpm of locally compiled kernel
by Simon Oliver 14 Jul '03

14 Jul '03

Some time ago someone suggested that we create rpms (or dummy rpms) for locally compiled kernels so that yast update doesn't overwrite the local kernel. I would appreciate some hints on how to achieve this. -- Simon Oliver

3 3

KDE root login
by keith＠topaz5.worldonline.co.uk 12 Jul '03

12 Jul '03

> It's also not possible any more to use su (it always tells you bad > password), unless you're root already. I had a similar problem with bad passwords when trying to su-login under KDE, SuSE 8.1 pro, to use YaST. I found that my problem was with keyboard character-code translation, under KDE. You could try opening a shell in KDE, and typing in your root password at the shell prompt, and see if the keyboard characters you are typing in are actually the ones that KDE is receiving. Hope this works ok, Regards - Keith Roberts

1 0

Re: [suse-security] I�m under DoS attack!
by Marcos Rojas 12 Jul '03

12 Jul '03

... sorry about the massive email :( ... what about REJECT instead DROP ? iptables -I INPUT -s <IP_HOSTIL> -j REJECT Arjen de Korte <arjen(a)nijntje.xs4all.nl> wrote: On Friday 11 July 2003 23:35, Marcos Rojas wrote: > Do someone know how can i protect my Server, Iptables rules, Susefirewall? > > Now are only 3 IPs sources where the attack comes from (is a small one) ... iptables -I INPUT -s IP#1 -j DROP iptables -I INPUT -s IP#2 -j DROP iptables -I INPUT -s IP#3 -j DROP It makes no sense at all to add these permanently to your firewall, since an attack usually only lasts a couple of hours/days. After the attack subsides, remove the rules by iptables -D INPUT -s IP#1 -j DROP iptables -D INPUT -s IP#2 -j DROP iptables -D INPUT -s IP#3 -j DROP If you need logging, you may want to insert additional rules to log the dropped packets. Note that a firewall will not help in defending a 'real' DDoS attack, this must be stopped at your uplink. > Should I filter the Ips with Iptables? > > Example - apache-error-log: > > [Fri Jul 11 15:27:10 2003] [error] [client xxx.xxx.xxx.xxx] request failed: > erroneous characters after protocol string: > \t\x97\xf2|\xfbS?Xdm8\xd4\xfa\xca\x03\x11\xb1\xa1\xc8\"\x99\xd2\xb7\t\x04zN >\xe1\xe7\xc4\xd4^\x83\x02*sD\xfb\xc2R\xe8\x87\xef\x99\xe5Za\xca\x06\x1e\xe8\ >x16\xd5\xa9#F\xe3\xe4\x7fD\xeb\x02\xc3\xe4\x01\x1b\xb1\xb0\x1b\x96%\xe6\x0cM >\xa4\xc0\xb5\xeb8\xf7z\x99z\x8a\xf2\xda\xef\xbc\xe4\xb4\x99\\p\x11\xc6I\x89e >-5\xab\x90\x12\x86Fe\xd7B2\x80+\x9fS\xb0\x1d{\xe0\xe1==x\xca\xbaeb\x1d\xc7g\ >x19\x01D\xba\b\xc1\x9b,\x92\xc5\xe7xU\xc2\\\x1b\xb0/\xe3b\x82\xf8\x05\xc75\x >1f\xa0\xd2M\x1a\xab\xfe\x1c\xf4\x8bO\x9ae\xae\xc8\xcb:>\x04\xbd\xeb=\xe6\x7f\xa5W\t\x0fZN\x1f\x18\x95\xd3%|Gh\xadQ\xb9{\x1c\xe7\xdf >\x98|\xd6$\xd6\xdc\xa38m\xe7Z\xc7\xe5M\x03\x89\xaa\x1dv\xc4wtq\x14\x10\\\xe7 >g0\xed\x9bK\xc1\xba\xeelSi\xf5X\xc7\xa1\xcf\x86L)6\x97\x19\v\xc9\x05]\xe7zZa >\b\xd1j1\xda\xd37\x93\x9c\x1a\x05\x8c\xcbvj&\xde\xda\xa7q5w9\xc7K\"\xabU3\xf >b\xaf\xd7APn\xa3\b\xbf\x1c\xe9\x84\x9b'\xb6\xecH-\xc6\x8e+j\xa1\x89\xd7\xc8\ >x95\xc2/\xf8\xa0\x0fC\x15\x85\xf5\x0c\x83 > \xb6\\\x1c\xf5\x8b\x15\x8e\x10.\x98\ xfe > > [Fri Jul 11 16:13:03 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in > request É#26;?¹">¦ñ©æt¨bf8Ó¿óÝ@©êNNËH¤ A$>É?¹ > > [Fri Jul 11 16:13:09 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in > request hInW|ÿ ègO > > > [Fri Jul 11 16:13:18 2003] [error] [client xxx.xxx.xxx.xxx] request failed: > erroneous characters after protocol string: > \xbe\xb6\x18\xc4>\x81\x18\xe4\xc1\x8ei\xc2\xe9\x0cT\x1c\xd3\xaf\x85t?JXQ\xf >0\xa0S\xa6Ww\xf3\x93k\xef\xacL\xdb\x13+Vg\xac\xde\xf8\x8b]\xb6\xf0_\xec,\xbb >\x11\xb4\x0c\xb1g?\xfdb\b\x8f\xbdQ\xee\xf9\\\x1d\xd6\xa4v\xbce\xea\v\t\xa4\x >02\x8a|\xb2\xdb/9\xbaK\x8fM#ir4\x067\xe0\x9e\xe4\x84~r\x98\x11\xb8\xf4\x19\x >cbBg\xd3\xaa\xc3\xcf\x15\xb7h\xb9\t\xfe^\xad\xe8k8\x05z9\x91\xfa\xd6\xa8\xf1 >\x05o\xf7\xf5dQ\x91\xab\xfa\xa7\x82<]\x81/\xcd+\xd4C\xa6\x9c\xc2E\xc2\xec\xb >7\xee/\xb0\x94 > \x89\x1a.\x13\xb1\xdcw\xbfRC\xa3[]\xcf;\x1e\xb5\"nH-\x1b\xa8e\xafBg\xd0\xbd >gIw\x1e\x86i\xde\xd1\xee\xebhF\xa2B\x1b\x96\xc1Yz\xccj\xc4Jh\xb2\xcf\xb8\xb1 >\\\x8a\xa4\xdaXn\xb0\xcc~C\x97'\x82A\xc0\x83%u\x14\xfa\xa8f\x0c\xeb\x86\xf8\ >x0e\xf9c\x92\xf9T?|\xfe:O\x1f\xad;R{\xa8W\x17'\xf7\xb3bd#\xc9\x97\x98JH}\xfe >\x0ceC\x9c\xa7r\xc0v`\xb1\xff\x02&j\xfb\xdbr;\xa7\xb9q\xb02\xa1e\x14\x88YILk >\x9b\x11\x8e\xb0\xf1\xe6\xcc\xfb;\xc2F\xa2M\xbe\x03\x9c\x0c\xb7\xb7\xdbtG\xe >a\xdd\xdf\xf3W\x7f\x85\xa6\x92\x11@_\xee\xaf\x92'\x9e\xce\xe9E\x1a\x15\"\xb3 >\xc4nKI\xb4\xa4n\xb5\xa0\x8b\xfb\x83\x0f\xfa\xbcS\xaaB\xd2\x8a\xd5\x8d\xcaU\ >x9b\t-\xea\xe5IR\x12\xf0\xe7v\xe3\xfeo\x0e\xd2Lx\\\xeaD\x14@W\xf2kQ'\xbc\xa2 >V\xc5iY\xe6RGs\xc0\x8fm\xa7j\xfa0\x8cv\xecZN\xa8's\xeb\\\xae?\xa3\"\xd9\x88\ >xa9\xaa\xa8\x1e\x1f\xe7X\x1bBo4k\xe0!\xae\x8c\x13\v\xae\x93S:i_b\\V\xdeK\xa5 >\xad~\xc0\x8dY\x8d\x9c\x17\xa3 --------------------------------- Internet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

2 1

Help with Samba / Suse Firewall
by Nigel Gaylard 12 Jul '03

12 Jul '03

Hi All Could someone please advise me on the following log entries. I am using Samba to serve a 3 windows clients but noticed the following in my log files (still learning linux and discovered log files recently). The firewall lists this message every few seconds and it appears to relate to Samba and more specifically the nmbd daemon. Samba is working so it purely the log file filling up with these entries that concerns me most. Secondly I tried using nmblookup -M SERVER and it tries the address 192.168.0.255 as the "nameserver" whereas the SAMBA server is 192.168.0.10. Samba is setup to be the wins server. Many thanks Nigel Gaylard ***EXTRACT from LOG FILES **** Jul 11 15:15:18 server nmbd[1180]: [2003/07/11 15:15:18, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_bcast(291) Jul 11 15:15:18 server nmbd[1180]: become_domain_master_browser_bcast: Jul 11 15:15:18 server nmbd[1180]: Attempting to become domain master browser on workgroup MWDESIGNS on subnet 192.168.0.10 Jul 11 15:15:18 server nmbd[1180]: [2003/07/11 15:15:18, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_bcast(305) Jul 11 15:15:18 server nmbd[1180]: become_domain_master_browser_bcast: querying subnet 192.168.0.10 for domain master browser on workgroup MWDESIGNS Jul 11 15:15:28 server nmbd[1180]: [2003/07/11 15:15:28, 0] nmbd/nmbd_become_dmb.c:become_domain_master_stage2(114) Jul 11 15:15:28 server nmbd[1180]: ***** Jul 11 15:15:28 server nmbd[1180]: Jul 11 15:15:28 server nmbd[1180]: Samba server SERVER is now a domain master browser for workgroup MWDESIGNS on subnet 192.168.0.10 Jul 11 15:15:28 server nmbd[1180]: Jul 11 15:15:28 server nmbd[1180]: ***** Jul 11 16:03:27 server kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= MAC= SRC=192.168.0.10 DST=192.168.0.255 LEN=256 TOS=0x00 PREC=0x00 TTL=64 ID=162 DF PROTO=UDP SPT=138 DPT=138 LEN=236 Jul 11 16:03:28 server nmbd[1470]: [2003/07/11 16:03:28, 0] nmbd/nmbd_browsesync.c:find_domain_master_name_query_fail(358) Jul 11 16:03:28 server nmbd[1470]: find_domain_master_name_query_fail: Jul 11 16:03:28 server nmbd[1470]: Unable to find the Domain Master Browser name MWDESIGNS<1b> for the workgroup MWDESIGNS. Jul 11 16:03:28 server nmbd[1470]: Unable to sync browse lists in this workgroup.

3 2

Fwd: [suse-security] I�m under DoS attack!
by Marcos Rojas 11 Jul '03

11 Jul '03

What do you think about this rule? iptables -I INPUT -s <IP_HOSTIL> -j DROP Marcos Rojas <marcos1948(a)yahoo.com.ar> wrote: Fecha: Fri, 11 Jul 2003 18:35:32 -0300 (ART) De: Marcos Rojas A: suse-security(a)suse.com Asunto: [suse-security] I´m under DoS attack! Do someone know how can i protect my Server, Iptables rules, Susefirewall? Now are only 3 IPs sources where the attack comes from (is a small one) ... Should I filter the Ips with Iptables? Example - apache-error-log: [Fri Jul 11 15:27:10 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \t\x97\xf2|\xfbS?Xdm8\xd4\xfa\xca\x03\x11\xb1\xa1\xc8\"\x99\xd2\xb7\t\x04zN\xe1\xe7\xc4\xd4^\x83\x02*sD\xfb\xc2R\xe8\x87\xef\x99\xe5Za\xca\x06\x1e\xe8\x16\xd5\xa9#F\xe3\xe4\x7fD\xeb\x02\xc3\xe4\x01\x1b\xb1\xb0\x1b\x96%\xe6\x0cM\xa4\xc0\xb5\xeb8\xf7z\x99z\x8a\xf2\xda\xef\xbc\xe4\xb4\x99\\p\x11\xc6I\x89e-5\xab\x90\x12\x86Fe\xd7B2\x80+\x9fS\xb0\x1d{\xe0\xe1==x\xca\xbaeb\x1d\xc7g\x19\x01D\xba\b\xc1\x9b,\x92\xc5\xe7xU\xc2\\\x1b\xb0/\xe3b\x82\xf8\x05\xc75\x1f\xa0\xd2M\x1a\xab\xfe\x1c\xf4\x8bO\x9ae\xae\xc8\xcb: xfe [Fri Jul 11 16:13:03 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request É#26;?¹">¦ñ©æt¨bf8Ó¿óÝ@©êNNËH¤ A$>É?¹ [Fri Jul 11 16:13:09 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request hInW|ÿ ègO [Fri Jul 11 16:13:18 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \xbe\xb6\x18\xc4>\x81\x18\xe4\xc1\x8ei\xc2\xe9\x0cT\x1c\xd3\xaf\x85t?JXQ\xf0\xa0S\xa6Ww\xf3\x93k\xef\xacL\xdb\x13+Vg\xac\xde\xf8\x8b]\xb6\xf0_\xec,\xbb\x11\xb4\x0c\xb1g?\xfdb\b\x8f\xbdQ\xee\xf9\\\x1d\xd6\xa4v\xbce\xea\v\t\xa4\x02\x8a|\xb2\xdb/9\xbaK\x8fM#ir4\x067\xe0\x9e\xe4\x84~r\x98\x11\xb8\xf4\x19\xcbBg\xd3\xaa\xc3\xcf\x15\xb7h\xb9\t\xfe^\xad\xe8k8\x05z9\x91\xfa\xd6\xa8\xf1\x05o\xf7\xf5dQ\x91\xab\xfa\xa7\x82<]\x81/\xcd+\xd4C\xa6\x9c\xc2E\xc2\xec\xb7\xee/\xb0\x94 \x89\x1a.\x13\xb1\xdcw\xbfRC\xa3[]\xcf;\x1e\xb5\"nH-\x1b\xa8e\xafBg\xd0\xbdgIw\x1e\x86i\xde\xd1\xee\xebhF\xa2B\x1b\x96\xc1Yz\xccj\xc4Jh\xb2\xcf\xb8\xb1\\\x8a\xa4\xdaXn\xb0\xcc~C\x97'\x82A\xc0\x83%u\x14\xfa\xa8f\x0c\xeb\x86\xf8\x0e\xf9c\x92\xf9T?|\xfe:O\x1f\xad;R{\xa8W\x17'\xf7\xb3bd#\xc9\x97\x98JH}\xfe\x0ceC\x9c\xa7r\xc0v`\xb1\xff\x02&j\xfb\xdbr;\xa7\xb9q\xb02\xa1e\x14\x88YILk\x9b\x11\x8e\xb0\xf1\xe6\xcc\xfb;\xc2F\xa2M\xbe\x03\x9c\x0c\xb7\xb7\xdbtG\xea\xdd\xdf\xf3W\x7f\x85\xa6\x92\x11@_\xee\xaf\x92'\x9e\xce\xe9E\x1a\x15\"\xb3\xc4nKI\xb4\xa4n\xb5\xa0\x8b\xfb\x83\x0f\xfa\xbcS\xaaB\xd2\x8a\xd5\x8d\xcaU\x9b\t-\xea\xe5IR\x12\xf0\xe7v\xe3\xfeo\x0e\xd2Lx\\\xeaD\x14@W\xf2kQ'\xbc\xa2V\xc5iY\xe6RGs\xc0\x8fm\xa7j\xfa0\x8cv\xecZN\xa8's\xeb\\\xae?\xa3\"\xd9\x88\xa9\xaa\xa8\x1e\x1f\xe7X\x1bBo4k\xe0!\xae\x8c\x13\v\xae\x93S:i_b\\V\xdeK\xa5\xad~\xc0\x8dY\x8d\x9c\x17\xa3 --------------------------------- Internet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

2 1

Fwd: [suse-security] I�m under DoS attack!
by Marcos Rojas 11 Jul '03

11 Jul '03

What do you think about this rule? iptables -I INPUT -s <IP_HOSTIL> -j DROP Marcos Rojas <marcos1948(a)yahoo.com.ar> wrote: Fecha: Fri, 11 Jul 2003 18:35:32 -0300 (ART) De: Marcos Rojas A: suse-security(a)suse.com Asunto: [suse-security] I´m under DoS attack! Do someone know how can i protect my Server, Iptables rules, Susefirewall? Now are only 3 IPs sources where the attack comes from (is a small one) ... Should I filter the Ips with Iptables? Example - apache-error-log: [Fri Jul 11 15:27:10 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \t\x97\xf2|\xfbS?Xdm8\xd4\xfa\xca\x03\x11\xb1\xa1\xc8\"\x99\xd2\xb7\t\x04zN\xe1\xe7\xc4\xd4^\x83\x02*sD\xfb\xc2R\xe8\x87\xef\x99\xe5Za\xca\x06\x1e\xe8\x16\xd5\xa9#F\xe3\xe4\x7fD\xeb\x02\xc3\xe4\x01\x1b\xb1\xb0\x1b\x96%\xe6\x0cM\xa4\xc0\xb5\xeb8\xf7z\x99z\x8a\xf2\xda\xef\xbc\xe4\xb4\x99\\p\x11\xc6I\x89e-5\xab\x90\x12\x86Fe\xd7B2\x80+\x9fS\xb0\x1d{\xe0\xe1==x\xca\xbaeb\x1d\xc7g\x19\x01D\xba\b\xc1\x9b,\x92\xc5\xe7xU\xc2\\\x1b\xb0/\xe3b\x82\xf8\x05\xc75\x1f\xa0\xd2M\x1a\xab\xfe\x1c\xf4\x8bO\x9ae\xae\xc8\xcb: xfe [Fri Jul 11 16:13:03 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request É#26;?¹">¦ñ©æt¨bf8Ó¿óÝ@©êNNËH¤ A$>É?¹ [Fri Jul 11 16:13:09 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request hInW|ÿ ègO [Fri Jul 11 16:13:18 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \xbe\xb6\x18\xc4>\x81\x18\xe4\xc1\x8ei\xc2\xe9\x0cT\x1c\xd3\xaf\x85t?JXQ\xf0\xa0S\xa6Ww\xf3\x93k\xef\xacL\xdb\x13+Vg\xac\xde\xf8\x8b]\xb6\xf0_\xec,\xbb\x11\xb4\x0c\xb1g?\xfdb\b\x8f\xbdQ\xee\xf9\\\x1d\xd6\xa4v\xbce\xea\v\t\xa4\x02\x8a|\xb2\xdb/9\xbaK\x8fM#ir4\x067\xe0\x9e\xe4\x84~r\x98\x11\xb8\xf4\x19\xcbBg\xd3\xaa\xc3\xcf\x15\xb7h\xb9\t\xfe^\xad\xe8k8\x05z9\x91\xfa\xd6\xa8\xf1\x05o\xf7\xf5dQ\x91\xab\xfa\xa7\x82<]\x81/\xcd+\xd4C\xa6\x9c\xc2E\xc2\xec\xb7\xee/\xb0\x94 \x89\x1a.\x13\xb1\xdcw\xbfRC\xa3[]\xcf;\x1e\xb5\"nH-\x1b\xa8e\xafBg\xd0\xbdgIw\x1e\x86i\xde\xd1\xee\xebhF\xa2B\x1b\x96\xc1Yz\xccj\xc4Jh\xb2\xcf\xb8\xb1\\\x8a\xa4\xdaXn\xb0\xcc~C\x97'\x82A\xc0\x83%u\x14\xfa\xa8f\x0c\xeb\x86\xf8\x0e\xf9c\x92\xf9T?|\xfe:O\x1f\xad;R{\xa8W\x17'\xf7\xb3bd#\xc9\x97\x98JH}\xfe\x0ceC\x9c\xa7r\xc0v`\xb1\xff\x02&j\xfb\xdbr;\xa7\xb9q\xb02\xa1e\x14\x88YILk\x9b\x11\x8e\xb0\xf1\xe6\xcc\xfb;\xc2F\xa2M\xbe\x03\x9c\x0c\xb7\xb7\xdbtG\xea\xdd\xdf\xf3W\x7f\x85\xa6\x92\x11@_\xee\xaf\x92'\x9e\xce\xe9E\x1a\x15\"\xb3\xc4nKI\xb4\xa4n\xb5\xa0\x8b\xfb\x83\x0f\xfa\xbcS\xaaB\xd2\x8a\xd5\x8d\xcaU\x9b\t-\xea\xe5IR\x12\xf0\xe7v\xe3\xfeo\x0e\xd2Lx\\\xeaD\x14@W\xf2kQ'\xbc\xa2V\xc5iY\xe6RGs\xc0\x8fm\xa7j\xfa0\x8cv\xecZN\xa8's\xeb\\\xae?\xa3\"\xd9\x88\xa9\xaa\xa8\x1e\x1f\xe7X\x1bBo4k\xe0!\xae\x8c\x13\v\xae\x93S:i_b\\V\xdeK\xa5\xad~\xc0\x8dY\x8d\x9c\x17\xa3 --------------------------------- Internet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

1 0

Fwd: [suse-security] I�m under DoS attack!
by Marcos Rojas 11 Jul '03

11 Jul '03

What do you think about this rule? iptables -I INPUT -s <IP_HOSTIL> -j DROP Marcos Rojas <marcos1948(a)yahoo.com.ar> wrote:Fecha: Fri, 11 Jul 2003 18:35:32 -0300 (ART) De: Marcos Rojas A: suse-security(a)suse.com Asunto: [suse-security] I´m under DoS attack! Do someone know how can i protect my Server, Iptables rules, Susefirewall? Now are only 3 IPs sources where the attack comes from (is a small one) ... Should I filter the Ips with Iptables? Example - apache-error-log: [Fri Jul 11 15:27:10 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \t\x97\xf2|\xfbS?Xdm8\xd4\xfa\xca\x03\x11\xb1\xa1\xc8\"\x99\xd2\xb7\t\x04zN\xe1\xe7\xc4\xd4^\x83\x02*sD\xfb\xc2R\xe8\x87\xef\x99\xe5Za\xca\x06\x1e\xe8\x16\xd5\xa9#F\xe3\xe4\x7fD\xeb\x02\xc3\xe4\x01\x1b\xb1\xb0\x1b\x96%\xe6\x0cM\xa4\xc0\xb5\xeb8\xf7z\x99z\x8a\xf2\xda\xef\xbc\xe4\xb4\x99\\p\x11\xc6I\x89e-5\xab\x90\x12\x86Fe\xd7B2\x80+\x9fS\xb0\x1d{\xe0\xe1==x\xca\xbaeb\x1d\xc7g\x19\x01D\xba\b\xc1\x9b,\x92\xc5\xe7xU\xc2\\\x1b\xb0/\xe3b\x82\xf8\x05\xc75\x1f\xa0\xd2M\x1a\xab\xfe\x1c\xf4\x8bO\x9ae\xae\xc8\xcb: xfe [Fri Jul 11 16:13:03 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request É#26;?¹">¦ñ©æt¨bf8Ó¿óÝ@©êNNËH¤ A$>É?¹ [Fri Jul 11 16:13:09 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request hInW|ÿ ègO [Fri Jul 11 16:13:18 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \xbe\xb6\x18\xc4>\x81\x18\xe4\xc1\x8ei\xc2\xe9\x0cT\x1c\xd3\xaf\x85t?JXQ\xf0\xa0S\xa6Ww\xf3\x93k\xef\xacL\xdb\x13+Vg\xac\xde\xf8\x8b]\xb6\xf0_\xec,\xbb\x11\xb4\x0c\xb1g?\xfdb\b\x8f\xbdQ\xee\xf9\\\x1d\xd6\xa4v\xbce\xea\v\t\xa4\x02\x8a|\xb2\xdb/9\xbaK\x8fM#ir4\x067\xe0\x9e\xe4\x84~r\x98\x11\xb8\xf4\x19\xcbBg\xd3\xaa\xc3\xcf\x15\xb7h\xb9\t\xfe^\xad\xe8k8\x05z9\x91\xfa\xd6\xa8\xf1\x05o\xf7\xf5dQ\x91\xab\xfa\xa7\x82<]\x81/\xcd+\xd4C\xa6\x9c\xc2E\xc2\xec\xb7\xee/\xb0\x94 \x89\x1a.\x13\xb1\xdcw\xbfRC\xa3[]\xcf;\x1e\xb5\"nH-\x1b\xa8e\xafBg\xd0\xbdgIw\x1e\x86i\xde\xd1\xee\xebhF\xa2B\x1b\x96\xc1Yz\xccj\xc4Jh\xb2\xcf\xb8\xb1\\\x8a\xa4\xdaXn\xb0\xcc~C\x97'\x82A\xc0\x83%u\x14\xfa\xa8f\x0c\xeb\x86\xf8\x0e\xf9c\x92\xf9T?|\xfe:O\x1f\xad;R{\xa8W\x17'\xf7\xb3bd#\xc9\x97\x98JH}\xfe\x0ceC\x9c\xa7r\xc0v`\xb1\xff\x02&j\xfb\xdbr;\xa7\xb9q\xb02\xa1e\x14\x88YILk\x9b\x11\x8e\xb0\xf1\xe6\xcc\xfb;\xc2F\xa2M\xbe\x03\x9c\x0c\xb7\xb7\xdbtG\xea\xdd\xdf\xf3W\x7f\x85\xa6\x92\x11@_\xee\xaf\x92'\x9e\xce\xe9E\x1a\x15\"\xb3\xc4nKI\xb4\xa4n\xb5\xa0\x8b\xfb\x83\x0f\xfa\xbcS\xaaB\xd2\x8a\xd5\x8d\xcaU\x9b\t-\xea\xe5IR\x12\xf0\xe7v\xe3\xfeo\x0e\xd2Lx\\\xeaD\x14@W\xf2kQ'\xbc\xa2V\xc5iY\xe6RGs\xc0\x8fm\xa7j\xfa0\x8cv\xecZN\xa8's\xeb\\\xae?\xa3\"\xd9\x88\xa9\xaa\xa8\x1e\x1f\xe7X\x1bBo4k\xe0!\xae\x8c\x13\v\xae\x93S:i_b\\V\xdeK\xa5\xad~\xc0\x8dY\x8d\x9c\x17\xa3 --------------------------------- Internet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

1 0

I�m under DoS attack!
by Marcos Rojas 11 Jul '03

11 Jul '03

Do someone know how can i protect my Server, Iptables rules, Susefirewall? Now are only 3 IPs sources where the attack comes from (is a small one) ... Should I filter the Ips with Iptables? Example - apache-error-log: [Fri Jul 11 15:27:10 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \t\x97\xf2|\xfbS?Xdm8\xd4\xfa\xca\x03\x11\xb1\xa1\xc8\"\x99\xd2\xb7\t\x04zN\xe1\xe7\xc4\xd4^\x83\x02*sD\xfb\xc2R\xe8\x87\xef\x99\xe5Za\xca\x06\x1e\xe8\x16\xd5\xa9#F\xe3\xe4\x7fD\xeb\x02\xc3\xe4\x01\x1b\xb1\xb0\x1b\x96%\xe6\x0cM\xa4\xc0\xb5\xeb8\xf7z\x99z\x8a\xf2\xda\xef\xbc\xe4\xb4\x99\\p\x11\xc6I\x89e-5\xab\x90\x12\x86Fe\xd7B2\x80+\x9fS\xb0\x1d{\xe0\xe1==x\xca\xbaeb\x1d\xc7g\x19\x01D\xba\b\xc1\x9b,\x92\xc5\xe7xU\xc2\\\x1b\xb0/\xe3b\x82\xf8\x05\xc75\x1f\xa0\xd2M\x1a\xab\xfe\x1c\xf4\x8bO\x9ae\xae\xc8\xcb:<A<\x99K\xc5\xd8\x8cV8\x04\xbd\xeb=\xe6\x7f\xa5W\t\x0fZN\x1f\x18\x95\xd3%|Gh\xadQ\xb9{\x1c\xe7\xdf\x98|\xd6$\xd6\xdc\xa38m\xe7Z\xc7\xe5M\x03\x89\xaa\x1dv\xc4wtq\x14\x10\\\xe7g0\xed\x9bK\xc1\xba\xeelSi\xf5X\xc7\xa1\xcf\x86L)6\x97\x19\v\xc9\x05]\xe7zZa\b\xd1j1\xda\xd37\x93\x9c\x1a\x05\x8c\xcbvj&\xde\xda\xa7q5w9\xc7K\"\xabU3\xfb\xaf\xd7APn\xa3\b\xbf\x1c\xe9\x84\x9b'\xb6\xecH-\xc6\x8e+j\xa1\x89\xd7\xc8\x95\xc2/\xf8\xa0\x0fC\x15\x85\xf5\x0c\x83 \xb6\\\x1c\xf5\x8b\x15\x8e\x10.\x98\ xfe [Fri Jul 11 16:13:03 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request É#26;?¹">¦ñ©æt¨bf8Ó¿óÝ@©êNNËH¤ A$>É?¹ [Fri Jul 11 16:13:09 2003] [error] [client xxx.xxx.xxx.xxx] Invalid URI in request hInW|ÿ ègO [Fri Jul 11 16:13:18 2003] [error] [client xxx.xxx.xxx.xxx] request failed: erroneous characters after protocol string: \xbe\xb6\x18\xc4>\x81\x18\xe4\xc1\x8ei\xc2\xe9\x0cT\x1c\xd3\xaf\x85t?JXQ\xf0\xa0S\xa6Ww\xf3\x93k\xef\xacL\xdb\x13+Vg\xac\xde\xf8\x8b]\xb6\xf0_\xec,\xbb\x11\xb4\x0c\xb1g?\xfdb\b\x8f\xbdQ\xee\xf9\\\x1d\xd6\xa4v\xbce\xea\v\t\xa4\x02\x8a|\xb2\xdb/9\xbaK\x8fM#ir4\x067\xe0\x9e\xe4\x84~r\x98\x11\xb8\xf4\x19\xcbBg\xd3\xaa\xc3\xcf\x15\xb7h\xb9\t\xfe^\xad\xe8k8\x05z9\x91\xfa\xd6\xa8\xf1\x05o\xf7\xf5dQ\x91\xab\xfa\xa7\x82<]\x81/\xcd+\xd4C\xa6\x9c\xc2E\xc2\xec\xb7\xee/\xb0\x94 \x89\x1a.\x13\xb1\xdcw\xbfRC\xa3[]\xcf;\x1e\xb5\"nH-\x1b\xa8e\xafBg\xd0\xbdgIw\x1e\x86i\xde\xd1\xee\xebhF\xa2B\x1b\x96\xc1Yz\xccj\xc4Jh\xb2\xcf\xb8\xb1\\\x8a\xa4\xdaXn\xb0\xcc~C\x97'\x82A\xc0\x83%u\x14\xfa\xa8f\x0c\xeb\x86\xf8\x0e\xf9c\x92\xf9T?|\xfe:O\x1f\xad;R{\xa8W\x17'\xf7\xb3bd#\xc9\x97\x98JH}\xfe\x0ceC\x9c\xa7r\xc0v`\xb1\xff\x02&j\xfb\xdbr;\xa7\xb9q\xb02\xa1e\x14\x88YILk\x9b\x11\x8e\xb0\xf1\xe6\xcc\xfb;\xc2F\xa2M\xbe\x03\x9c\x0c\xb7\xb7\xdbtG\xea\xdd\xdf\xf3W\x7f\x85\xa6\x92\x11@_\xee\xaf\x92'\x9e\xce\xe9E\x1a\x15\"\xb3\xc4nKI\xb4\xa4n\xb5\xa0\x8b\xfb\x83\x0f\xfa\xbcS\xaaB\xd2\x8a\xd5\x8d\xcaU\x9b\t-\xea\xe5IR\x12\xf0\xe7v\xe3\xfeo\x0e\xd2Lx\\\xeaD\x14@W\xf2kQ'\xbc\xa2V\xc5iY\xe6RGs\xc0\x8fm\xa7j\xfa0\x8cv\xecZN\xa8's\xeb\\\xae?\xa3\"\xd9\x88\xa9\xaa\xa8\x1e\x1f\xe7X\x1bBo4k\xe0!\xae\x8c\x13\v\xae\x93S:i_b\\V\xdeK\xa5\xad~\xc0\x8dY\x8d\x9c\x17\xa3<% and so on ... Please help me :( Marcos --------------------------------- Internet GRATIS es Yahoo! Conexión. Usuario: yahoo; contraseña: yahoo Desde Buenos Aires: 4004-1010 Más ciudades: clic aquí.

1 0