August 2003 - openSUSE Security - openSUSE Mailing Lists

Local 3505 udp
by Dominik Składanowski 20 Aug '03

20 Aug '03

Hello, I've noticed that one of my servers has enabled strange process - local,udp. Sometimes it works sometimes don't, always listen on different high ports. I started only ssh, pop3, imaps, smtp and spamassasin. What is this? -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Skladanowski ++++++++++++++++++++++++++++++++++++++++++

2 1

Re: [suse-security] Local 3505 udp
by Marc Samendinger 20 Aug '03

20 Aug '03

> -----Original Message----- > From: Dominik Skladanowski [mailto:dominik.skladanowski@ch.pw.edu.pl] > Sent: Wednesday, August 20, 2003 3:51 PM > > > Hello, > > I've noticed that one of my servers has enabled strange process - > local,udp. Sometimes it works sometimes don't, always listen on > different high ports. > I started only ssh, pop3, imaps, smtp and spamassasin. > > What is this? you can try to find out whats listening if you follow the instructions on the following site http://www.hackinglinuxexposed.com/articles/20030515.html > ++++++++++++++++++++++++++++++++++++++++++ > > Dominik Skladanowski > > ++++++++++++++++++++++++++++++++++++++++++ HTH marc

1 0

Security Configuration - Oracle & Apache
by c g 20 Aug '03

20 Aug '03

I will be installing several systems with i386 SUSE Linux 8.2. I would like to install the systems in as secure a fashion as possible. I was thinking this would be done by installing the systems with only the necessary services required for their mission operation. I have 3 configurations I would like to manage. (all with the graphics packages installed) 1. Oracle 9i 9.2.0.1.0 Enterprise Database (with networking to clients) 2. Oracle 9i 9.2.0.1.0 Database Client (with networking) 3. Apache (plus PHP4, SSL, and SHTTP) My worry is that in reducing services I might remove a package form thatg set that is essential to the fucntion of a configuration. (i.e. the romoval of "cron" or other service that Oracle may neet to perform its activities) What better place to ask than a SUSE SECURITY/ORACLE user group eh... I guess what Im asking for is a separate list of installed rpms for each configuration that would yield as high a security level as possible under i386 Suse Linux 8.2 I figure the Oracle Server and client might be pretty much the same. THANKS for any help you might offer on the topic and related issues. Sg also... PLEASE throw in any comments you might have about the use of APACHE 1.3.x vs. 2.x (this message has been posted to both the Security and Oracle mailings) _________________________________________________________________ <b>Get MSN 8</b> and enjoy automatic e-mail virus protection. http://join.msn.com/?page=features/virus

2 1

RE: [suse-security] Blocking Kazaa and other P2P communication tools.
by Knut Erik Hauslo 20 Aug '03

20 Aug '03

Hmm. If that is so, setting Kazaa to use well known ports, then that's a problem. But my experiences are, that you can talk endlessly with users, you will always have someone ignoring what's said. Even writte policies are ignored. It's effective if you have honest users, I agree. -KEH -----Original Message----- From: Johannes Bretscher [mailto:bretscher@5sl.org] Sent: Tuesday, August 19, 2003 3:29 PM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: Re: [suse-security] Blocking Kazaa and other P2P communication tools. On Tue, Aug 19, 2003 at 03:17:10PM +0200, Knut Erik Hauslo wrote: > Use a sniffer and watch which ports are being used. I cannot tell you > which ports, because the corporate firewall that I manage is not SuSEs > Firewall2, but I have only defined which ports to accept outbound > (SMTP, HTTP(S), etc) and Kazaa does not work here. The problem is that these programs can change ports. Even well known ports like 80 443 25 etc may be used. I don't know if Kazaa can do this but I have seen programs speaking perfect http over port 80 that are in no other way related to the www. > > Not very useful maybe, but talking with users to have them stop using > Kazaa is i think more complicated. It may be the only effective way. > > -KEH > Greetings, Johannes -- "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

7 7

Blocking Kazaa and other P2P communication tools.
by Josef.Fuchs＠leykam.com 19 Aug '03

19 Aug '03

Hi, Security List Subscribers. Can somebody tell me if it´s possible to block all Kazaa communication at my SuSE Firewall-Box? I´m running an IPTABLES script based on the SuSE Firewall Script. thanks in advance Josef Fuchs

4 3

RE: [suse-security] Blocking Kazaa and other P2P communication tools.
by Knut Erik Hauslo 19 Aug '03

19 Aug '03

The problem is, if you are able to assing other port number to be used by kazaa, say 80 TCP, and you close 80 TCP on your firewall, then you will not be able to eihter open normal HTTP-pages nor do any Kazaa session. According to kazaa FAQ, it normally uses port 1214 TCP but it's possible to circumvent it... :-( http://doa2.host.sk/help/connection.htm -KEH -----Original Message----- From: Fred Merritt [mailto:fred@argus.pt] Sent: Tuesday, August 19, 2003 3:58 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Blocking Kazaa and other P2P communication tools. Forgive me, if I'm being a bit stupid here, because my brain is nested six levels deep in something else right now, but is it not possible to block outgoing requests to Kazaa?? If nobody can request anything, Kazaa, is not likely to send anything back, is it? Best regards. . . Fred Knut Erik Hauslo wrote: > Hmm. If that is so, setting Kazaa to use well known ports, then that's > a problem. But my experiences are, that you can talk endlessly with > users, you will always have someone ignoring what's said. Even writte > policies are ignored. It's effective if you have honest users, I > agree. > > -KEH > > -----Original Message----- > From: Johannes Bretscher [mailto:bretscher@5sl.org] > Sent: Tuesday, August 19, 2003 3:29 PM > To: Knut Erik Hauslo > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] Blocking Kazaa and other P2P communication > tools. > > > On Tue, Aug 19, 2003 at 03:17:10PM +0200, Knut Erik Hauslo wrote: > >>Use a sniffer and watch which ports are being used. I cannot tell you >>which ports, because the corporate firewall that I manage is not SuSEs > > >>Firewall2, but I have only defined which ports to accept outbound >>(SMTP, HTTP(S), etc) and Kazaa does not work here. > > > The problem is that these programs can change ports. Even well known > ports like 80 443 25 etc may be used. I don't know if Kazaa can do > this but I have seen programs speaking perfect http over port 80 that > are in no other way related to the www. > > >>Not very useful maybe, but talking with users to have them stop using >>Kazaa is i think more complicated. > > > It may be the only effective way. > > >>-KEH >> > > > Greetings, > Johannes > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Samba problemsecurity = SERVER
by Andrew Edunov 18 Aug '03

18 Aug '03

Hi list! I have some problem with my Samba samba-2.2.5-178 I'm using the following config: **** security = SERVER password server = some_server.com **** All work fine some time (about 30 minutes). After that I receive the message in Samba log: [2003/08/18 14:11:27, 0] lib/util_sock.c:write_socket_data(499) write_socket_data: write failure. Error = Connection reset by peer After this message when I try to map some shared resource using "net use" command on Windows box, I receive the next message: [2003/08/18 14:21:28, 1] smbd/password.c:server_validate(1099) password server is not connected [2003/08/18 14:21:28, 1] smbd/password.c:pass_check_smb(545) Couldn't find user 'and' in passdb. What does it mean? And how can I close this problem? -- IT Administrator Andrew Edunov

1 0

Remote Mail via Sendmail 8.12.2 and SMTP ?
by remote 18 Aug '03

18 Aug '03

Hi ! I administer a small network of Linux and Windows boxes, using a SuSE 8.0 Professional box as router, firewall and mail server. Everything is running fine right now, except for one little thing : I want my users to connect to my mail server from outside my domain, so that they can send e-mails using their mail accounts on my server. Right now, they can download their mail from outside via POP3, but are not allowed to send any mails, unless the mail is addressed to a local mail address. What do I have to do so that my users can use their local accounts to send mails to non- local addresses. For security and anti- spam reasons I´d like to implement some sort of POP3 before SMTP- policy so that only authenticated users can send mails. I use Sendmail 8.12.2, no modifications. Any suggestions ? Thanks

3 4

IPSEC and NAT Traversal
by r.maurizzi＠digitalpha.it 18 Aug '03

18 Aug '03

Hi all, I'd like to know if we can expect a SuSE official or semi-official kernel with IPSEC and NAT Traversal patches included and enabled. Currently, SuSE Kernels don't support NAT-T, even if the FreeSWAN rpm for 8.2 does. Can we hope to see it in the next weeks/months? I've already compiled a kernel including support for NAT-T, but I prefer to use SuSE's rpms if at all possible... :-) Greetings, Roberto Maurizzi

1 0

Stopping SMTP listening on port 25
by keith＠topaz5.worldonline.co.uk 17 Aug '03

17 Aug '03

Hi All! I've been to www.grc.com, and when my Apache port is blocked I'm getting true stealth mode. Excellent site! The only thing that concerns me is this: when I do netstat -lt (on SuSE 8.1 pro), netstat tells me that SMTP is waiting for incomming tcp connections. topaz:~ # netstat -lt Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address tcp 0 0 *:www-http *:* LISTEN tcp 0 0 localhost:smtp *:* LISTEN I'd rather SMTP didn't listen for incomming connections - even though port 25 is fully stealthed. I don't run a mail receiver/server. I collect all my email from my ISP's mail server, using fetchmail. I have tried disabling SMTP, using postfix stop, but fetchmail has problems collecting and delivering my mail locally with this. Is there any way to tell SMTP to work with fetchmail, WITHOUT listening for incoming tcp connection requests from port 25? Your help much appreciated. Regards Keith Roberts. P.S. I managed to get X11 to stop listening for incoming connections from port 6000. Here is my script: #!/bin/sh # # /usr/X11R6/bin/runX-no-listen # a simple script wrapper to start the X11 server # without listening for incoming tcp connections. # last updated 2003-08-13 startx -- -nolisten tcp # end of wrapper

3 3