September 2003 - openSUSE Security - openSUSE Mailing Lists

nmap from apache????
by Marco Lum 25 Sep '03

25 Sep '03

Somebody know the reason that Apache did nmap, grep & uname ? and what's wrong with the apache? There's nothings special in access_log with same IP. Please help! Copy from apache error_log [Wed Sep 24 21:05:56 2003] [info] [client 61.10.230.187] (104)Connection reset by peer: client stopped connection before send mmap completed [Wed Sep 24 21:08:31 2003] [error] [client 203.218.78.248] File does not exist: /home/free/hkmu/public_html/favicon.ico [Wed Sep 24 21:10:24 2003] [info] [client 203.83.101.121] send mmap timed out [Wed Sep 24 21:42:07 2003] [error] [client 203.198.18.167] File does not exist: /home/free/hkmu/public_html/favicon.ico [Wed Sep 24 21:54:09 2003] [error] [client 66.150.40.80] File does not exist: /home/free/hkmu/public_html/robots.txt [Wed Sep 24 22:01:05 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:13 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:15 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:27 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:33 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:36 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:40 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:43 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:01:49 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped conneuname: write error: Broken pipe grep: write error: Broken pipe uname: write error: Broken pipe grep: write error: Broken pipe grep: write error: Broken pipe grep: write error: Broken pipe [Wed Sep 24 22:36:13 2003] [error] [client 192.168.0.64] File does not exist: /home/web/hks grep: write error: Broken pipe uname: write error: Broken pipe grep: write error: Broken pipe [Wed Sep 24 23:06:54 2003] [error] [client 192.168.0.64] File does not exist: /home/web/web uname: write error: Broken pipe grep: write error: Broken pipe grep: write error: Broken pipe [Wed Sep 24 23:40:32 2003] [error] [client 192.168.0.64] File does not exist: /home/web/web grep: write error: Broken pipe grep: write error: Broken pipe grep: write error: Broken pipe [Thu Sep 25 00:03:08 2003] [error] [client 192.168.0.64] File does not exist: /home/web/web grep: write error: Broken pipe [Thu Sep 25 01:32:43 2003] [error] [client 192.168.0.64] File does not exist: /home/web/hks [Thu Sep 25 02:09:12 2003] [error] [client 202.130.22.251] File does not exist: /srv/www/htdocs/default.ida [Thu Sep 25 02:10:28 2003] [error] [client 192.168.0.64] File does not exist: /home/web/hks [Thu Sep 25 02:15:49 2003] [error] [client 192.168.0.64] File does not exist: /home/web/web grep: write error: Broken pipe ction before send mmap completed [Wed Sep 24 22:02:52 2003] [info] [client 66.150.40.60] (32)Broken pipe: client stopped connection before send mmap completed [Wed Sep 24 22:24:40 2003] [error] [client 66.196.65.40] File does not exist: /home/free/hkmu/public_html/robots.txt [Wed Sep 24 22:26:34 2003] [info] [client 203.83.101.80] (104)Connection reset by peer: client stopped connection before send mmap completed [Wed Sep 24 22:26:35 2003] [info] [client 203.83.101.80] (104)Connection reset by peer: client stopped connection before send mmap completed [Wed Sep 24 22:56:08 2003] [info] [client 202.64.243.187] (104)Connection reset by peer: client stopped connection before rwrite completed [Wed Sep 24 23:01:11 2003] [info] [client 202.64.243.187] (104)Connection reset by peer: client stopped connection before rwrite completed -- Marco Lum Net Service Manager ___________________________________________________________________________________________ System Development Service Inter/Intra/Local-Area Networking Service VOICE: +852 2851 1190 FAX : +852 2851 1109 Email: enquiry(a)hkservice.com WWWeb: http://www.hkservice.com HK Service Company HK Service Consultants Limited

3 2

Bind Patch to "fix" verisign sitefinder...
by jjunior＠pib.com.br 25 Sep '03

25 Sep '03

Hello there... SuSE has released some update with the patched bind that allows the "delegation only" option to be set and stop verisign "utility"? If not, someone has made an RPM, RPM-patch? thanks. []s core

1 0

Samba-vscan experience
by Fabiano Felix 24 Sep '03

24 Sep '03

Hello All, I want to use the samba-vscan module in a productivity environment, and I want to know that if someone have experience in this use? What's problems may be presented? There is some restriction about preformance? It's trustworthy? I apreciate some user's story... I use the SLES8 version (I believe that is better to make a package update)... Regards, Fabiano Felix

2 1

SuSE 8.1 IBM S/390 - security standard/baseline for Internet facing
by farzad.torabi＠qbe.com 24 Sep '03

24 Sep '03

Does anyone have, know where I can find a baseline for SuSE 8.1 on IBM S/390 - apparently it is a bit different from the intel based ones. I am going to run Websphere and Apache on it in DMZ, and desperate for a hardening standard document. Any help would be very much appreciated. With thanks and regards . . Fred ________________________________________________________________________ IMPORTANT NOTICE : The information in this email is confidential and may also be privileged. If you are not the intended recipient, any use or dissemination of the information and any disclosure or copying of this email is unauthorised and strictly prohibited. If you have received this email in error, please promptly inform us by reply email or telephone. You should also delete this email and destroy any hard copies produced.

2 1

Portable OpenSSH Security Advisory: sshpam.adv
by Simon Oliver 24 Sep '03

24 Sep '03

Please see below for details of another openssh advisory. Is the current patched version of SuSE vulnerable to this attack? The advisory warns that we are vulnerable if privsep is disabled - the most recent patch from SuSE disabled privsep by default! I like the idea of privsep, please can somebody at SuSE answer the following: 1. How do I re-enable privsep - is it enough to turn it on in the sshd_config? 2. What is the problem with enabling privsep in the latest release? 3. How do I check that privsep is actually working - there doesn't seem to be any record of it in the syslog. 4. I am used to restricting access to many services via the hosts.allow - will this help if there is an sshd exploit? Thanks -- Simon Oliver This document can be found at: http://www.openssh.com/txt/sshpam.adv 1. Versions affected: Portable OpenSSH versions 3.7p1 and 3.7.1p1 contain multiple vulnerabilities in the new PAM code. At least one of these bugs is remotely exploitable (under a non-standard configuration, with privsep disabled). The OpenBSD releases of OpenSSH do not contain this code and are not vulnerable. Older versions of portable OpenSSH are not vulnerable. 2. Solution: Upgrade to Portable OpenSSH 3.7.1p2 or disable PAM support ("UsePam no" in sshd_config). Due to complexity, inconsistencies in the specification and differences between vendors' PAM implementations we recommend that PAM be left disabled in sshd_config unless there is a need for its use. Sites only using public key or simple password authentication usually have little need to enable PAM support.

4 6

Antwort: [suse-security] SSH - changed finger print
by Joachim.Winter＠malberg-edv.de 24 Sep '03

24 Sep '03

Perhaps the Putty-File is destroyed. You can find it in the putty-dir with the extension "REG". Try to restore this file and then to reconnect. Mit freundlichen Grüßen Joachim Winter Malberg EDV-Systemberatung GmbH Humboldtstrasse 18 04105 Leipzig Tel.: 0341 / 986 - 2860 Fax: 0341 / 986 - 2879 www.malberg-edv.de |---------+-----------------------------------> | | Dominik Sk?adanowski | | | <dominik.skladanowski@ch| | | .pw.edu.pl> | | | | | | 24.09.2003 11:51 | | | | |---------+-----------------------------------> > ------------------------------------------------------------------------------------------------------------------------------| | | | An: SuSE-Security <suse-security(a)suse.com> | | Kopie: | | Thema: [suse-security] SSH - changed finger print | > ------------------------------------------------------------------------------------------------------------------------------| Hello list, today during login to server by ssh, I've noticed that fingerprint of my key server has changed. I comapred keys with previous backups - keys are the same. It is strange, different fingerprint warning I get when I use PuTTY on my W2k workstation. When I try to login from my SuSE workstation I didn't get any warning. I use SuSE 8.2 Pro and latest patches to OpenSSH I have installed. -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Sk?adanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl ++++++++++++++++++++++++++++++++++++++++++ -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

How to disable vga (monitor) display (when compiling kernel)
by Bo Jacobsen 24 Sep '03

24 Sep '03

I'm trying to disable the monitor display so nothing is shown (neigher while booting nor when it's time for the shell prompt) (after the grub boot selections) on a monitor connected to a buildt in VGA card. I have tried to different combinations of disabled options in the kernel (running "make menuconfig"), but most of then result in a system that will run exatly as I wan't it to, but when running "shutdown -r now" it will hang somewhere in the shutdown process. /var/log/messages gives no usefull information. I have tried to disable the following: /console drivers/Vga text console /console drivers/frame buffer support/all disabled /character devices/Virtual Terminal I have also tried to enable "/character devices/Support for console on serial support". I run SuSE 8.2 and have tried this on the kernel: linux-2.4.21.SuSE-13.tar.bz2 Any idears on how this is proberly done. Thanks in advance Bo Jacobsen

2 1

KDE 3.1.3 / KMail / cryptplug
by Bastian Friedrich 23 Sep '03

23 Sep '03

Hi! I have been using the OpenGPG cryptplug module for KMail for a while and have been quite happy with it. Yesterday, I installed KDE 3.1.3 (from a ftp.suse.com mirror) on my SuSE 8.2. KMail no longer correctly accepts PGP/MIME signed Mails, but shows a red frame around the mail (indicating an invalid signature), although the signatures are correct (checked manually and with mozilla's enigmail). Cleartext signed messages (ASCII armored) are fine, though. Are you using KMail 1.5.3 as well? Can you correctly verify this mail's signature? Has anyone else had this problem and a solution for it? According to it's chanelog, KDE 3.1.4's KMail seems to have some fixes for cryptplug problems... TIA, Regards, Bastian -- Bastian Friedrich bastian(a)bastian-friedrich.de Adress & Fon available on my HP http://www.bastian-friedrich.de/ \~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\ \ Know what I hate? I hate rhetorical questions!

2 1

Re: [suse-security] Why no SuSE RPMs for KDE 3.1.4 security update?
by r.maurizzi＠digitalpha.it 23 Sep '03

23 Sep '03

> Normally SuSE is very quick with advisories and security updates. > This time, it is making think seriously about switching to Red Hat, or > at least not buying SuSE 9.0. If SuSE is delaying KDe 3.1.4 because > of the effort being put into SuSE 9.0, this tactic is backfiring. Aw man, relax a bit... How many of you do have kdm accepting remote connections? How many do that using kerberos? I, for example, use the first a lot but then only from the local network. How many of your users can brute force an access? I like fast responses from SuSE too, and they do just that when it's serious. When it's not (and here it's rather easy to use a temporary workaround, like another xmd) I prefer they take the time they think it's necessary to do their job at best, like they usually do. Ciao, Roberto.

2 1

Sieve does not sieve :(
by Stefan Waidele jun. 23 Sep '03

23 Sep '03

Hi all, I am working with postfix & cyrus-imap on SuSE8.1 How do I get sieve running? I have followed /usr/share/doc/packages/cyrus-imapd/doc/install-sieve.html including the example-script at the end. The problem is that test-mails do get through straight to my inbox instead of being rejected. I send those messages with the from-header info(a)waidele.biz which is the from-address that should be sieved out. Is there a step-by-step howto that combines the bits & pieces neccessary to get sieve running? I really miss procmail :) Stefan Here are some observations: ---- 'ps ax | grep tim' does not show timsieved running. ---- The telnet-test works: cyrus@p10085231:/home/sieve> telnet localhost sieve Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Cyrus timsieved v1.1.0" "SASL" "PLAIN LOGIN DIGEST-MD5 CRAM-MD5" "SIEVE" "fileinto reject envelope vacation imapflags notify subaddress relational regex" OK ---- This is the log if I send the testmail: Sep 23 11:38:15 p10085231 lmtpd[16565]: accepted connection Sep 23 11:38:15 p10085231 lmtpd[16565]: lmtp connection preauth'd as postman Sep 23 11:38:15 p10085231 master[16614]: about to exec /usr/lib/cyrus/bin/lmtpd Sep 23 11:38:15 p10085231 lmtpunix[16614]: executed Sep 23 11:38:15 p10085231 lmtpd[16565]: duplicate_check: <3F701484.30602(a)Waidele.biz> user.stw 0 Sep 23 11:38:15 p10085231 lmtpd[16565]: mystore: starting txn 2147483718 Sep 23 11:38:15 p10085231 lmtpd[16565]: mystore: committing txn 2147483718 Sep 23 11:38:15 p10085231 lmtpd[16565]: duplicate_mark: <3F701484.30602(a)Waidele.biz> user.stw 1064309895

2 1