September 2003 - openSUSE Security - openSUSE Mailing Lists

SYN_RECV
by Daniel Kostyal 18 Sep '03

18 Sep '03

since last night i noticed activity on my ssh port. with netstat -punta i get the following output: tcp 0 0 xxx.xxx.xxx.xxx:22 61.85.xxx.xxx:xxxxx SYN_RECV tcp 0 0 xxx.xxx.xxx.xxx:22 61.85.xxx.xxx:xxxxx SYN_RECV tcp 0 0 xxx.xxx.xxx.xxx:22 61.85.xxx.xxx:xxxxx SYN_RECV

1 0

SuSE Security Announcement: openssh (SuSE-SA:2003:038) 7.3 ??
by Bill.Light＠kp.org 18 Sep '03

18 Sep '03

I have checked the "changelog" entry of openssh and it shows NO patches. (The announcement shows for 7.3 still) As a matter of fact, the changelog entries only show changes in 2001, and I have seen (and applied) openssh updates since then !? My 8.0 machine is also not reflecting a change. The two 8.2 boxes worked fine....Do I manually download the patches and apply ? I use Yast2 - abandon all hope ? Is there a problem with the 7.3 & 8.0 ftp sites ? (I have tried suse.com, gwdg.de, and leo.org) Suggestions/Comments ? - Bill

2 1

Re: [suse-security] Automatically Updating named (bind9) with local address translations
by J J 18 Sep '03

18 Sep '03

Glad to have helped! I have tried to scrutinise the amazingly complex SuSEfirewall2 script to understand it better. I more or less understood SuSEfirewall but this adds orders of magnitudes of complexity, I'm still trying to get my head round the best way to use/reason for use of all these tables in iptables - I was "brought up" on ipchains, which my small mind could just about handle! :) One of the things that FW_SERVICE_DNS does is implicitly open UDP highports and this is unfortunately critical it seems. From what I understand of IP, having looked at the RFCs (very educational they are too!) TCP/IP (which is what people are used to thinking in terms of) makes reliable two-way connections. Outbound and inbound traffic have serial numbers on the packets kinda thing so it's easy for a firewall to work out what's the return traffic. UDP was designed to be "connectionless" so that packets come and go, some are dropped, etc. All sounds casual but the resulting improvement in speed is critical for many applications, including DNS, as I understand it. The downside is that returning UDP packets could be as a result of querys that you've sent or "other". I think this is where you have to trust that your server (BIND or whatever) that's listening on the high UDP ports will be hardened and not fall over like a Microsoft product in a stiff breeze. One of the universal helping features as I see it is that "random" highports are used so the worms would have to hit a moving target. My answers, such as they are!... 1) I was somewhat aware that I wasn't making this clear as I wrote! The port that DNS querys go to is 53. That should not be open on your external UDP services. So if you have a line like FW_SERVICES_EXT_UDP="domain" then I'd suggest that you remove the "domain" (or 53 if in numeric form) . On the other hand I was talking about my hack to get round the protection of global services (which affects high and low ports, UDP and TCP) so that returning traffic from the DNS servers being queried wasn't blocked. SuSEfirewall2 seems to have a few bits in it to get around this problem so my "hack" is probably not needed with SuSEfirewall2. Whichever way you do it, you won't have a DNS that's receiving queries from the internet - it will just be receiving the replies to its queries. The best way to make sure? Go to one of the many sites that do portscans and firewall hardness checks. They will tell you soon enough what ports you've got open that might be vulnerable to attack. Most of the sites are Windows-centric but that's OK. I did a quick Google for "scan my firewall" and got www.auditmypc.com, give it a go - it may well give you a nice warm "I'm glad I use Linux with an enterprise strength firewall" type feeling! :) 2) Absolutely. The host command takes a second parameter - the DNS you want to query, e.g. ... root@myhost:~ # host www.microsoft.com localhost Using domain server: Name: localhost Address: 127.0.0.1 Aliases: www.microsoft.com is a nickname for www.microsoft.com.edgesuite.net www.microsoft.com.edgesuite.net is a nickname for a562.cd.akamai.net a562.cd.akamai.net has address 80.15.236.25 a562.cd.akamai.net has address 80.15.236.17 a562.cd.akamai.net has address 80.15.236.16 a562.cd.akamai.net has address 80.15.236.14 a562.cd.akamai.net has address 80.15.236.33 ...versus... root@myhost:~ # host www.microsoft.com 195.82.96.40 Using domain server 195.82.96.40: www.microsoft.com is a nickname for www.microsoft.com.edgesuite.net www.microsoft.com.edgesuite.net is a nickname for a562.cd.akamai.net a562.cd.akamai.net has address 80.15.236.14 a562.cd.akamai.net has address 80.15.236.33 a562.cd.akamai.net has address 80.15.236.25 a562.cd.akamai.net has address 80.15.236.17 a562.cd.akamai.net has address 80.15.236.16 This command is critical for working out where DNS issues are coming from! 3) You got me! I don't know! I think they're something like "timeout" and probably more to do with DNS replication. With the files we're using that are "master" files they probably have no effect... probably! :) Hope this all reassures you! Carl Peto ("JJ") >From: "Philip B Cook" <philipbcook(a)ntlworld.com> >To: "J J" <c_peto(a)hotmail.com>,<suse-security(a)suse.com> >Subject: Re: [suse-security] Automatically Updating named (bind9) with >local address translations >Date: Wed, 17 Sep 2003 17:21:47 +0100 > >JJ, > >many thanks for your comprehensive reply. I have been away a few days, so >have not had chance to follow your instructions. > >I am now up and running successfully. > >In addition to your instructions, I had to also do the following... in case >anyone else out there can learn from my experience. > >1. I stopped my gateway machine using automatic settings for DNS servers >from my cable company and instead directed it to use 127.0.0.1 (the >loopback >address). This way my gateway can also query IP addresses on the local >network from BIND 9. > >As you said I have placed the cable companies DNS servers in the Forwarders >statement in named.conf > >2. I also had to add the line > >FW_SERVICE_DNS="yes" > >to my SuSEfirewall2 configuration file. So as to allow the local DNS >server >to be accessed. > >3. I have added named (BIND 9) into Run Level 3 & 5 > >I found a text on zone files which helped me understand the contents of >these. > >I do have three final questions ... > >1. Is my DNS server now visible from the INTERNET .. how can I tell ? I >dont want it to be. >2. Is there a way to directly query the DNS server and know the result has >come from there and not some other name resolution process. >3. What does the repeated 172800 (equiv seconds in 2 days) mean in your >example of a zone file. I didnt seem to need them, and my zone file text >did not mention any entry in this position of each line of the file. > >Many, many thanks for your help. > >Philip > > >----- Original Message ----- >From: "J J" <c_peto(a)hotmail.com> >To: <philipbcook(a)ntlworld.com>; <suse-security(a)suse.com> >Sent: Sunday, September 14, 2003 11:49 AM >Subject: Re: [suse-security] Automatically Updating named (bind9) with >local >address translations > > > > Yes, this isn't too hard. > > > > (I used to run a configuration almost exactly like the one you say. The > > differences were trivial - masquerading instead of proxy and >SuSEfirewall > > instead of SuSEfirewall2.) > > > > The first thing you need to do after installing BIND9 is set it to run > > automatically, configure it to forward DNS requests to your ISPs DNS >servers > > and set the dhcp daemon so that clients query your gateway's server >instead > > of the ISPs DNSes. You said that was "easy" so I won't go on about it >here, > > tell me if you have any problems with that! :) > > > > You'll need to create "zone definition" files for the computers on your > > local network and refer to them in /etc/named.conf. Taking the example >of > > my network, which is running on 192.168.0.0 subnet mask 255.255.255.0... > > > > You'll probably already have the following entries in named.conf: > > > > zone "localhost" in { > > type master; > > file "localhost.zone"; > > }; > > > > zone "0.0.127.in-addr.arpa" in { > > type master; > > file "127.0.0.zone"; > > }; > > > > Copy these entries to create new entries for your subnet, e.g. > > > > zone "bookman-headoffice.co.uk" in { > > type master; > > file "bookman-headoffice.zone"; > > allow-update { 192.168.0/24; 127/8; }; > > }; > > > > zone "0.168.192.in-addr.arpa" in { > > type master; > > file "192.168.0.zone"; > > allow-update { 192.168.0/24; 127/8; }; > > }; > > > > Note the extra clause in each entry? That's the critical bit. It >allows > > the dhcp server to update the DNS server. > > > > In the DNS directory (I think /var/lib/named for the SuSE 8.2 BIND9 > > package), copy the zone definition files for localhost as a template for > > your new zone definition files. > > > > For example: > > > > $ORIGIN co.uk. > > bookman-headoffice 172800 IN SOA localhost. >root.localhost. >( > > 20021086 10800 900 604800 86400 ) ;Cl=3 > > 172800 IN NS localhost. ;Cl=3 > > 172800 IN MX 10 gateway.bookman-headoffice.co.uk. > > ;Cl=3 > > 172800 IN A 192.168.0.127 ;Cl=3 > > > > $ORIGIN bookman-headoffice.co.uk. > > > > host1 172800 IN A 192.168.0.127 ;Cl=3 > > > > It's going to be too complex for me to explain zone definition files on >this > > mailing list but the documentation with BIND9 seems good (I use BIND8 in > > production) and the example files look good. You won't need to put in >all > > the host definitions, of course, because we're hoping that dhcp will do >that > > for you! > > > > Next set the dhcpd.conf file to trigger these automatic updates: > > > > ddns-update-style interim; > > > > And you should be away. When the dhcp server grants a lease it should >also > > update the DNS server with the hostname that the client gives it. > > > > I couldn't get M$ clients to update the DNS server themselves - probably > > some proprietory protocol stuff - but setting them all with useful >hostnames > > and all to get their IP address from my SuSE 7.2 gateway got round the > > problem, as I've described. > > > > Hope this helps. Tell me if you succeed! > > > > Carl > > (aka. "JJ") > > > > >From: "Philip B Cook" <philipbcook(a)ntlworld.com> > > >To: <suse-security(a)suse.com> > > >Subject: [suse-security] Automatically Updating named (bind9) with >local > > >address translations > > >Date: Sat, 13 Sep 2003 17:00:40 +0100 > > > > > >I am successfully using SuSE Linux as a gateway, router and http proxy. > > > > > >I am connected to the internet via a Cable Modem. The Linux machine is > > >running Squid, SuSEfirewall2, dhcpcd and Samba (smbd and nmbd). > > > > > >My local machines get their IP addresses from the dhcpcd server, these >are > > >allocated dynamically. DHCPCD tells each machine to use the Cable > > >Companies two DNS servers for name resolution. I would like to use >named > > >(BIND9) to provide a local cache of internet addresses, which is easy, >but > > >how can I also provide name resolution for each of the local machines >from > > >BIND9 without having to use static IP addresses on my local network or >use > > >fixed addressing for each MAC address in DHCPD. > > > > > >Once a local machine gets an IP address from DHCPCD can this >information >be > > >given to BIND9 so that it will do local lookups as well as caching >internet > > >addresses. Can this be done by either the server or the hosts. > > > > > >Thanks ... > > > > > >Philip > > > > > > > > > > > > > > > > _________________________________________________________________ > > Use MSN Messenger to send music and pics to your friends > > http://www.msn.co.uk/messenger > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > _________________________________________________________________ Get Hotmail on your mobile phone http://www.msn.co.uk/msnmobile

2 1

Re: [suse-security] SuSE Security Announcement: openssh (SuSE-SA:2003:038) 7.3??
by Bill.Light＠kp.org 17 Sep '03

17 Sep '03

Sven - I ain't feeling so good.....Here's what I get : # rpm -q openssh --changelog |less * Mon Sep 24 2001 - cihlar(a)suse.cz - fixed security problem with sftp & bypassing keypair auth restrictions - patch based on CVS - fixed status part of init script - it returned running even if there were only sshd of connections and no listening sshd [#11220] - fixed stop part of init script - when there was no /var/run/sshd.pid, all sshd were killed * Thu Sep 06 2001 - nadvornik(a)suse.cz - added patch for correct buffer flushing from CVS [bug #6450] * Fri Jul 27 2001 - cihlar(a)suse.cz - update x11-ssh-askpass to version 1.2.2 * Thu Jul 26 2001 - cihlar(a)suse.cz - update to version 2.9p2 - removed obsolete "cookies" patch * Mon Jun 11 2001 - cihlar(a)suse.cz - fixed to compile with new xmkmf # So now I should go back and FORCE all these patches manually ??!! What the heck has been downloading when I do get patches ?? Is Yast that broken ? ===================================================== > I have checked the "changelog" entry of openssh and it shows NO patches. > (The announcement shows for 7.3 still) As a matter of fact, the > changelog entries only show changes in 2001, and I have seen (and applied) > openssh updates since then !? > > My 8.0 machine is also not reflecting a change. > > The two 8.2 boxes worked fine....Do I manually download the patches and > apply ? > > I use Yast2 - abandon all hope ? Is there a problem with the 7.3 & 8.0 > ftp sites ? (I have tried suse.com, gwdg.de, and leo.org) > Suggestions/Comments ? Ive updated my 7.3 via. fou4s, result: # rpm -q openssh --changelog * Tue Sep 16 2003 - postadal(a)suse.cz - fixed race condition in allocating memory [#31025] (CAN-2003-0693) * Fri Oct 25 2002 - postadal(a)suse.cz - fixed security problem: when password expired the forced password change echoed the password on the screen [bug #20903]. * Fri Jun 28 2002 - okir(a)suse.de - fixed broken %patch statement; re-added channelbug diff * Fri Jun 28 2002 - okir(a)suse.de - back down to 2.9.9, with patch * Tue Jun 25 2002 - okir(a)suse.de - patch for privilege separation+PAM as you can see, all's there... HTH, Sven

1 0

AW: [suse-security] Automatically Updating named (bind9) with local address translations
by Ulrich Roth 17 Sep '03

17 Sep '03

Hi, > 1. Is my DNS server now visible from the INTERNET .. how can > I tell ? Log on to another Unix/Linux machine in the internet. Run nslookup in interactive mode. In nslookup, enter the following commands: nslookup> set q=any nslookup> server (IP of your server) If this command works, one can probably query your server from the internet. Try an FQDN your server should know about: nslookup> www.yourdomain.com To leave the nslookup program, type "exit". I know that nslookup has nearly become obsolete and one should use dig, nevertheless I like nslookup. > 2. Is there a way to directly query the DNS server and know > the result has come from there and not some other name resolution process. If you try it the way above, you may get the additional hint "Authoritative answers can be found from <some other server>." So you can at least tell if the queried server gives the answer or any other server. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0

Re: [suse-security] Automatically Updating named (bind9) with local address translations
by J J 17 Sep '03

17 Sep '03

Yes, this isn't too hard. (I used to run a configuration almost exactly like the one you say. The differences were trivial - masquerading instead of proxy and SuSEfirewall instead of SuSEfirewall2.) The first thing you need to do after installing BIND9 is set it to run automatically, configure it to forward DNS requests to your ISPs DNS servers and set the dhcp daemon so that clients query your gateway's server instead of the ISPs DNSes. You said that was "easy" so I won't go on about it here, tell me if you have any problems with that! :) You'll need to create "zone definition" files for the computers on your local network and refer to them in /etc/named.conf. Taking the example of my network, which is running on 192.168.0.0 subnet mask 255.255.255.0... You'll probably already have the following entries in named.conf: zone "localhost" in { type master; file "localhost.zone"; }; zone "0.0.127.in-addr.arpa" in { type master; file "127.0.0.zone"; }; Copy these entries to create new entries for your subnet, e.g. zone "bookman-headoffice.co.uk" in { type master; file "bookman-headoffice.zone"; allow-update { 192.168.0/24; 127/8; }; }; zone "0.168.192.in-addr.arpa" in { type master; file "192.168.0.zone"; allow-update { 192.168.0/24; 127/8; }; }; Note the extra clause in each entry? That's the critical bit. It allows the dhcp server to update the DNS server. In the DNS directory (I think /var/lib/named for the SuSE 8.2 BIND9 package), copy the zone definition files for localhost as a template for your new zone definition files. For example: $ORIGIN co.uk. bookman-headoffice 172800 IN SOA localhost. root.localhost. ( 20021086 10800 900 604800 86400 ) ;Cl=3 172800 IN NS localhost. ;Cl=3 172800 IN MX 10 gateway.bookman-headoffice.co.uk. ;Cl=3 172800 IN A 192.168.0.127 ;Cl=3 $ORIGIN bookman-headoffice.co.uk. host1 172800 IN A 192.168.0.127 ;Cl=3 It's going to be too complex for me to explain zone definition files on this mailing list but the documentation with BIND9 seems good (I use BIND8 in production) and the example files look good. You won't need to put in all the host definitions, of course, because we're hoping that dhcp will do that for you! Next set the dhcpd.conf file to trigger these automatic updates: ddns-update-style interim; And you should be away. When the dhcp server grants a lease it should also update the DNS server with the hostname that the client gives it. I couldn't get M$ clients to update the DNS server themselves - probably some proprietory protocol stuff - but setting them all with useful hostnames and all to get their IP address from my SuSE 7.2 gateway got round the problem, as I've described. Hope this helps. Tell me if you succeed! Carl (aka. "JJ") >From: "Philip B Cook" <philipbcook(a)ntlworld.com> >To: <suse-security(a)suse.com> >Subject: [suse-security] Automatically Updating named (bind9) with local >address translations >Date: Sat, 13 Sep 2003 17:00:40 +0100 > >I am successfully using SuSE Linux as a gateway, router and http proxy. > >I am connected to the internet via a Cable Modem. The Linux machine is >running Squid, SuSEfirewall2, dhcpcd and Samba (smbd and nmbd). > >My local machines get their IP addresses from the dhcpcd server, these are >allocated dynamically. DHCPCD tells each machine to use the Cable >Companies two DNS servers for name resolution. I would like to use named >(BIND9) to provide a local cache of internet addresses, which is easy, but >how can I also provide name resolution for each of the local machines from >BIND9 without having to use static IP addresses on my local network or use >fixed addressing for each MAC address in DHCPD. > >Once a local machine gets an IP address from DHCPCD can this information be >given to BIND9 so that it will do local lookups as well as caching internet >addresses. Can this be done by either the server or the hosts. > >Thanks ... > >Philip > > > > _________________________________________________________________ Use MSN Messenger to send music and pics to your friends http://www.msn.co.uk/messenger

2 1

AW: [suse-security] tripwire policy file
by Ulrich Roth 17 Sep '03

17 Sep '03

Hi Erwin, > has anyone of you a tripwire policy file optimized for suse > 8.2. the one shipped with the distribution is only optimized > for redhat 7.0 (/usr/share/doc/packages/tripwire/twpol.txt). I can give you mine which is optimized for SuSE 8.0. But I cannot assure that it's complete. I had the same problem like you. Did you already look at the tripwire web site? There they sometimes have policy files for other Linuxes, too, which aren't in the distro. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

2 1

tripwire policy file
by Erwin Lang 17 Sep '03

17 Sep '03

hi, has anyone of you a tripwire policy file optimized for suse 8.2. the one shipped with the distribution is only optimized for redhat 7.0 (/usr/share/doc/packages/tripwire/twpol.txt). tschau, erwin

1 0

Re: [suse-security-announce] SuSE Security Announcement: openssh (SuSE-SA:2003:038)
by James Ogley 17 Sep '03

17 Sep '03

> Cross References: http://www.openssh.com/txt/buffer.adv > Please download the update package for your distribution and verify its > integrity by the methods listed in section 3) of this announcement. Are these updates based upon the second revision of the patch, which apparently is the one that should be applied? -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc Work: james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Personal: james(a)rubberturnip.org.uk www.rubberturnip.org.uk Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org ********************************************************************** CONFIDENTIALITY.This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance plc. If you have received this email in error please immediately notify the Pinnacle Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

1 0

RE: [suse-security] lsh
by GarUlbricht7＠netscape.net 17 Sep '03

17 Sep '03

Adam Daniel <adamd(a)forensicdata.com.au> wrote: >Has anyone tried getting lsh working on a SuSE machine? > >http://www.lysator.liu.se/~nisse/lsh/ > >adam ---<sig line deleted>--- > Adam, As you know, lsh-1.4.2-29 is part of the 8.1 distro, and lsh-1.5-53 is part of 8.2. I just did a quick check and haven't seen any security updates for lsh -- I wouldn't be surpirized in lsh-devel should also be installed with lsh because, but maybe not. YMMV. I see you got two other replies already. Earlier this afternoon, I copied the 8.1 version onto my hard drive, and checked dependencies using k-package. K-package indicated no problems on my system,. However, because of the developer's release note: "If you want high security and stability, better use openssh for now!" I just patched my "openssh" with the latest SuSE patch.. It may be that later copies of lsh have higher security and stability, I didn't check into that. You probably have. HTH Friendly Greetings, Gar -- In the Beginning was the Command Line ---Neal Stephenson -- __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

1 0