January 2004 - openSUSE Security - openSUSE Mailing Lists

SuSE 8.1 hacked?
by Manuel Balderrábano 07 Jan '04

07 Jan '04

Hi. I just got some services (mysql, postfix, cvs...) shut down, took a look at /tmp, and found a miro.tgz and a "miro" executable. On the executable you can read: .-= Backdoor made by Mironov =-. .-= Running =-. I don't know how much this attack may have compromised the system. Under /var/log/ there are no clues on how they may have entered, /var/log/messages has been deleted. Directories like /tmp or /var have changed permissions since the attack to 700 Now ssh works really slow unless connected to Internet, and I feel very unconfortable about connecting this server again to the Internet. The systen is a SuSE 8.1, I had it a little forgotten lately, tough. Doesn anybody know anything about how they may have entered the system and how can I arrange it? I'm seriously thinking about installing a SuSE 9.0, but want to know what happened before doing anything. Thaks in advance.

5 5

RE: [suse-security] Tripwire on SLES8
by Tom Knight 07 Jan '04

07 Jan '04

> > From these sources I seem to only be able to install Tripwire 1.2, > > whereas I know that Tripwire 2.3 is available for SuSE Pro 8.2. > > > > I've used Tripwire 2.3 before, but not 1.2 - I can't help noticing > > that with 1.2 I don't have (for example) a twadmin command. > > Wasn't there a message on the list which showed a error within > tihs package? I found Tripwire 2.3 to work on SuSE 8.2 when I tried it in November. Looking at my archive I see someone had a problem after then in SuSE 9, 2.3 broke after I installed it. Hmm.... that PC's running Tripwire 2.3.1.2 > > > I know I could just dopwnload the rpm file from > > ftp://ftp.suse.com/pub/suse/i386/8.2/suse/i586/ but obviously I'd > > rather only use software intended for release with SLES... > > It is better to do so, because there will be failed dependancies, or yust > recompile it for your architecture from the source. > > http://www.tripwire.org/downloads/index.php (the source tarball only!) > > For this you need minimum cc or cpp installed and the dependancies on > packages can be found in the readme if you unpack the tar.gz file. I know that's an option, but I really want to have a YOU based update system. I want to get Tripwire installed as soon as possible (obviously), so I may take this route if there's absolutely no alternative. Thanks, Tom.

1 0

Promotionfactory
by Tom Knight 07 Jan '04

07 Jan '04

> nslookup www.promotionfactory.net IP address: 66.193.15.254 Host name: promotionfactory.net Alias: www.promotionfactory.net 254.15.193.66.in-addr.arpa > whois whois.arin.net 66.193.15.254 Time Warner Telecom TWTC-NETBLK-4 (NET-66-192-0-0-1) 66.192.0.0 - 66.195.63.255 Charlotte Colocation TWTC-CHRL-C-CHCO-00 (NET-66-193-8-0-1) 66.193.8.0 - 66.193.15.255 # ARIN WHOIS database, last updated 2004-01-06 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. ======================== And Google tells me.... http://www.charlottecolo.com And that website gives me: info(a)charlottecolo.com Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

1 0

Re: [suse-security] SuSE 8.1 hacked?
by james.bliss＠comcast.net 07 Jan '04

07 Jan '04

A system is only as secure as the administrator makes it. Your message is too vague to give you any sort of reasonable answer. For all I know you allowed root to ssh into your box and root had no password, or an easily guessed password. I could keep guessing why someone hacked your box but that would be useless. make sure your box is up to date, you only have the services which you need running on it, you understand the security issues with each service, you have a good security policy in place. If you do nt understand a service, or how to secure it, do not open it up to the wild. Play with it and learn it on a private box and THEN implement it with a good security policy. > Hi again. > I just re-installed a SuSE 8.1 and included all patches and updates avaliable, > I will now re-install all old services and its contents one by one;I hope > nothing else than the system was compromised! > > I guess my mistake was not having all patches aplied, but my serious doubt is: > I had a 2.4.23 kernel, so how could the intruder become root after the > breakthrough? It is supposed to be the last 2.4 kernel avaliable, could have > he used another exploit? > > Thanks to all for the interest. > > El Miércoles, 7 de Enero de 2004 12:32, Manuel Balderrábano escribió: > > Hi. > > > > I just got some services (mysql, postfix, cvs...) shut down, took a look at > > /tmp, and found a miro.tgz and a "miro" executable. > > > > On the executable you can read: > > > > .-= Backdoor made by Mironov =-. > > .-= Running =-. > > > > I don't know how much this attack may have compromised the system. > > > > Under /var/log/ there are no clues on how they may have entered, > > /var/log/messages has been deleted. > > > > Directories like /tmp or /var have changed permissions since the attack to > 700 > > > > Now ssh works really slow unless connected to Internet, and I feel very > > unconfortable about connecting this server again to the Internet. > > > > The systen is a SuSE 8.1, I had it a little forgotten lately, tough. > > > > Doesn anybody know anything about how they may have entered the system and > how > > can I arrange it? I'm seriously thinking about installing a SuSE 9.0, but > > want to know what happened before doing anything. > > > > Thaks in advance. > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > -- > -------------------------------------------------------------------------------- > - > Manuel Balderrábano > > e-mail: garibolo(a)wanadoo.es > -------------------------------------------------------------------------------- > - > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

2.4.21-168 kernel RPM's vs. 2.4.21-169 sources
by Warren Jones 07 Jan '04

07 Jan '04

I'm puzzled that the kernel update RPM's provided for SuSE 8.1 are for version 2.4.21-168, but the kernel sources are for version 2.4.21-169. Looking here: ftp://ftp.suse.com/pub/suse/i386/update/8.1/kernel/2.4.21-20040105 We find these RPM's: k_deflt-2.4.21-168.i586.rpm k_athlon-2.4.21-168.i586.rpm k_smp-2.4.21-168.i586.rpm etc. ^^^ But these sources kernel-source-2.4.21-169.tar.bz2 ^^^ Am I being needlessly compulsive in wanting an exact match on the version numbers? -------------------------------------------------------------------- Warren Jones | To keep every cog and wheel is the first Fluke Corporation | precaution of intelligent tinkering. Everett, Washington, USA | -- Aldo Leopold

5 4

WG: [suse-security] WPA und Linux (SuSE9.0)
by Christian Lange 07 Jan '04

07 Jan '04

Excuse, of course i meant " ... which supports wpa:" Christian Hello Thomas,, as far as i know there is only one driver which supports wep: Have a look at: http://www.linuxant.com Regards, Christian > -----Ursprüngliche Nachricht----- > Von: Thomas Ruch [mailto:thomas@ruchs.de] > Gesendet: Dienstag, 6. Januar 2004 10:42 > An: suse-security(a)suse.com > Betreff: [suse-security] WPA und Linux (SuSE9.0) > > > Hallo allerseits und ein Gesundes Neues, > > Ich habe die Ferienzeit genutzt und ein wenig gebastelt, unter > anderem habe > ich festgestellt, dass mein Wireless-AP auch WPA anstatt WEP zur > Absicherung > kann. Leider fehlen mir dazu ein paar Basisinfos, die ich mir wohl noch > besorgen muss. > Wichtiger wäre mir aber, was ich zur Nutzung von WPA unter Linux tun muss > und ob dies mit meinen alten Tekram-Karten (Prism 2.5) überhaupt geht. > Kann mir da jemand helfen? > > Danke Thomas > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

another 3-interface firewall problem (two external, no DMZ)
by Dr. Peter M=?ISO-8859-1?B?/A==?=nstermann 07 Jan '04

07 Jan '04

Hi, I am running a small enterprise server under Suse 9.0. The main tasks are: Masquerading an internal network, SMTP, POP3 and web serving. Everything works nice with two interfaces: eth0: 1.2.3.4 netmask 255.255.255.192 (leased line with static IP) eth1: 192.168.0.1 netmask 255.255.255.0 (internal network) with default route 1.2.3.3 Web server is listening on 1.2.3.4, SMTP on both interfaces, POP3 only at the internal interface NOW: to keep traffic costs as low as possible, we like to route the main traffic over a DSL flat rate. Configuring the DSL stuff gives the aditional ppp0 interface (PPPoE with eth2), masquerading works and I can see the web server at 1.2.3.4 due to the additional entry: iptables -A INPUT -i eth1 -s 192.168.0.0/24 -d 1.2.3.4 -j ACCEPT BUT: The address 1.2.3.4 is not responding from the outside any more. Both eth0 and ppp0 are configured as external interfaces in the SuSEfirewall configuration. I think, the problem can be seen as a sort of load balancing for the leaving IP packets. Any hints, how to get the official external IP address working again ? Best regards Peter

5 7

YOU installing wrong kernel?
by Roger Hayter 07 Jan '04

07 Jan '04

On two intel machines, 8.1 and 8.2, YOU has installed k_athlon kernel update instead of the existing k_dflt. Can this be right? -- Roger Hayter

2 1

.viminfo
by Lovette Burland 06 Jan '04

06 Jan '04

Hi When ever I tried to save a file in vi or vim I get this error message. " Can't write viminfo file /root/.viminifor" Hit ENTER or type command to continue. Any advise Lovette Burland ********************************************************************** The information contained in this e-mail message is intended only for the individuals named above. If you are not the intended recipient, you should be aware that any dissemination, distribution, forwarding or other duplication of this communication is strictly prohibited. The views expressed in this e-mail are those of the individual author and not necessarily those of Vivista Limited. Prior to taking any action based upon this e-mail message you should seek appropriate confirmation of its authenticity. If you have received this e-mail in error, please immediately notify the sender by using the e-mail reply facility. ********************************************************************** _____________________________________________________________________ This message has been checked for all known viruses on behalf of Vivista by MessageLabs. http://www.messagelabs.com or Email: mailsweeper.info(a)vivista.co.uk Vivista formerly Securicor Information Systems for further information http://www.vivista.co.uk

2 1

Spam after mail to list
by Philippe Vogel 06 Jan '04

06 Jan '04

Hi! Seems, that everytime I write to the list I get this back (see attachement) as with the any-spam-guy. Here do I see from wich account this comes? Philippe

4 3