January 2004 - openSUSE Security - openSUSE Mailing Lists

Check Mail (Probable ATACK)
by João Reis 22 Jan '04

22 Jan '04

Hi to all, I have mail report made by the lire command and i see some strange things (or think they are). Here is a part of my log Summary of delivery for the most common domains. Sender's Domain Deliveries % Total % Domain Status -------------------------------------------- ---------- ------- -------- mkt-l21.net 4845 44.9 44.9 check_mail 4845 44.9 100.0 only-best-things.com 3633 33.7 33.7 check_mail 3633 33.7 100.0 The domains mkt-l21.net and only-best-things.com are unknown to me.... My pop3 port is open to the world but why are these domains always cheking their mail on my mail server? Is this a kind of atack to my machine ? How should i deny the access to these domains ? Thanks Joao Reis

1 0

Thank you for your inquiry. (fwd)
by Keith Roberts 22 Jan '04

22 Jan '04

Hi. I have just sent a message to the list, and got this email back. Anyone else on the list getting this spam again. Regards - Keith Roberts ---------- Forwarded message ---------- To: Keith Roberts <lists(a)kar.eclipse.co.uk> From: "maillist(a)promotionfactory.net" <maillist(a)promotionfactory.net> Subject: Thank you for your inquiry. Please reply to this e-mail to receive our current specials. If others should get this, include their e-mail also.

2 1

Re: [suse-security] closing port 6000
by Keith Roberts 22 Jan '04

22 Jan '04

Sorry about that. I originally hit the send button, instead of Ctrl-R, to read a file. I resent again to the list - sometimes my POST's to this list don't it make for some strange reason. I'm running SuSE 8.1, and have this script in /usr/X11/bin - the same place as startx. #!/bin/sh # # /usr/X11R6/bin/runX-no-listen # # a simple script wrapper to start the X11 server # without listening for tcp connections. # # last updated 2003-08-13 startx -- -nolisten tcp # end of wrapper On Thu, 22 Jan 2004 GarUlbricht7(a)netscape.net wrote: > To: Keith Roberts <lists(a)kar.eclipse.co.uk> > From: GarUlbricht7(a)netscape.net > Subject: Re: [suse-security] closing port 6000 > > Keith Roberts <lists(a)kar.eclipse.co.uk> wrote: > > > > >I've had problems with this too. > > > >My workaround what I use now is instead of starting Xwindows > >with startx from the console, I use the following script. > > > > > > > > > > > > > >On Tue, 20 Jan 2004, Lindomar Santos wrote: > > > >> To: david <david(a)radikalsystems.com> > >> From: Lindomar Santos <lindomar(a)pop-am.rnp.br> > >> Subject: Re: [suse-security] closing port 6000 > >> > -----<snip>---- > > Keith, > there was no script shown, > did you decide not to include it ??? > > Friendly greetings > > __________________________________________________________________ > New! Unlimited Netscape Internet Service. > Only $9.95 a month -- Sign up today at http://isp.netscape.com/register > Act now to get a personalized email address! > > Netscape. Just the Net You Need. >

1 0

/usr/sbin/compartment fails to chroot for non-root user
by Tom Knight 22 Jan '04

22 Jan '04

I'm trying to build a chroot jail for ssh for a user (called update), using /usr/sbin/compartment. The /etc/passwd entry for user "update" looks like this: update:x:5000:65534:Update User:/home/update:/bin/compart.jail /bin/compart.jail reads: #!/bin/bash strace -v -s 250 -ff -F -qix -o problem /usr/sbin/compartment --chroot /home/update.jail /bin/bash (That strace call is just there for debugging, of course...) * `su update` (the user) fails with the error "Error chrooting to /home/update.jail" * Any non-root user running `/usr/sbin/compartment --chroot /home/update.jail /bin/bash` fails with the same error. * Root _can_ run this file, and ends up in jail. Looking at the file "problem" that strace creates tells me that: <snip> [400e10cd] chroot("/home/update.jail") = -1 EPERM (Operation not permitted) [400e0702] brk(0x804f000) = 0x804f000 [400dae34] write(2, "Error chrooting to /home/update.jail\n", 37) = 37 [400e0702] brk(0x8052000) = 0x8052000 [400ace5d] time([1074677991]) = 1074677991 <snip> (The rest of the file can be given, of course) Okay, now if the user tries to simply `chroot /home/update.jail`, he gets the error: "chroot: cannot change root directory to /home/update.jail: Operation not permitted" The permissions on the directory /home/update.jail look like this: 0 drwxrwxrwx 7 update nogroup 224 2004-01-21 09:38 . 0 drwxr-xr-x 9 root root 216 2004-01-20 16:19 .. 4 -rw------- 1 update nogroup 45 2004-01-21 09:39 .bash_history 0 drwxr-xr-x 2 update nogroup 240 2004-01-21 08:54 bin 0 drwxr-xr-x 2 update nogroup 96 2004-01-20 16:00 dev 0 drwxr-xr-x 2 update nogroup 128 2004-01-21 09:08 etc 1 drwxr-xr-x 3 update nogroup 568 2004-01-21 09:20 lib 112 -rw-r--r-- 1 update nogroup 113188 2004-01-21 09:39 problem 0 drwxr-xr-x 4 update nogroup 96 2004-01-20 15:02 usr I don't think the update user's home direstory of /home/update makes a difference, I've changed it without any effect. I think I could probably use sudo to give update the ability to use chroot, but then I have a chroot user with slightly higher privs than is ideal. Any ideas on how to solve this? Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

4 5

Re: [suse-security] Auto-Updating-2
by Brock Hensley 21 Jan '04

21 Jan '04

I do not get emails... I have forwarding setup right (I get emails to root all the time) so I know thats not just my prob. What did you do to setup online update? PS. I'm using SuSe 9 -B Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 Jonathan Hull wrote: > Hi Brock, > > On my box, running Suse 8.2, I get e-mail (sent to > root) everytime online update runs, listing all of the > updates and which ones were installed. > > Thanks and hope this helps, > > Jonathan. > > P.S. for some reason, suse-security wont except my > e-mail, so I couldn't post this to the list. > > --- Brock Hensley <bhensley(a)hi-techcompanies.com> > wrote: > >>"... >> >>Unusual System Events >>=-=-=-=-=-=-=-=-=-=-= >>Jan 21 03:00:00 linux /USR/SBIN/CRON[31017]: (root) >>CMD (online_update ) >> >>..." >> >>Every wednesday at 3am this cron runs, but it is not >>in the crontab... >> >>I had configured YaSt2 at one point, through the >>"graphical" interface >>(gui through a terminal?), to auto-update, but I >>don't know if this is >>working or not... how can I make sure it is working, >>ie; get reports of >>success/failure/what it does? or how can i disable >>this yast2 completely >>so I can use the fou4s utility. I need a solution >>that will download and >>install updates on a regularly schedule, completely >>hands off. >> >>Thank You, >>-Brock Hensley >> >>-- >>Brock Hensley >>Hi-Tech Companies >>http://www.Hi-TechCompanies.com/ >>Phone: 269.488.7788x112 >> 1.800.968.1155x112 >>Fax: 269.488.7799 >>Mobile: 269.267.5406 >> >>This communication is intended solely for the use of >>the addressee and may contain information that is >>legally privileged, confidential or exempt from >>disclosure. If you are not the intended recipient, >>please note that any dissemination, distribution, or >>copying of this communication is strictly >>prohibited. Anyone who receives this message in >>error should notify the sender immediately and >>delete it from his or her computer. >> >>If you suspect e-mail abuse please contact >>abuse(a)hi-techcompanies.com >> >>Notice: Attachments are automatically scanned for >>viruses using the Kaspersky Engine. >> >> >> >>-- >>Check the headers for your unsubscription address >>For additional commands, e-mail: >>suse-security-help(a)suse.com >>Security-related bug reports go to security(a)suse.de, >>not here >> > > > > ===== > ~~ > Jonathan Hull > jon(a)hull.name > > __________________________________ > Do you Yahoo!? > Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes > http://hotjobs.sweepstakes.yahoo.com/signingbonus > > This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

Auto-Updating-2
by Brock Hensley 21 Jan '04

21 Jan '04

"... Unusual System Events =-=-=-=-=-=-=-=-=-=-= Jan 21 03:00:00 linux /USR/SBIN/CRON[31017]: (root) CMD (online_update ) ..." Every wednesday at 3am this cron runs, but it is not in the crontab... I had configured YaSt2 at one point, through the "graphical" interface (gui through a terminal?), to auto-update, but I don't know if this is working or not... how can I make sure it is working, ie; get reports of success/failure/what it does? or how can i disable this yast2 completely so I can use the fou4s utility. I need a solution that will download and install updates on a regularly schedule, completely hands off. Thank You, -Brock Hensley -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

Sendmail TLS package for 9.0
by Drew J. Como 21 Jan '04

21 Jan '04

All, Does anyone have a TLS-enabled Sendmail package for SuSE 9.0? I have been searching high and low and cannot come up with one (other than building Sendmail from scratch.) I've checked the FTP's and all I found was the base package. Please advise. Thanks! ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com BASCOM Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

6 9

RE: [suse-security] closing port 6000
by Hemsley, Trevor 21 Jan '04

21 Jan '04

You can add bind-adress = 127.0.0.1 under the [mysqld] heading in /etc/my.cnf -----Original Message----- From: Markus Gaugusch [mailto:markus@gaugusch.at] Sent: 20 January 2004 22:34 To: gregor Cc: SuSE-Security Subject: Re: [suse-security] closing port 6000 On Jan 20, gregor <linuxELCH(a)gmx.de> wrote: > I also had the problem until now, but this solution works for me too. > The only ports open at this time are ssh / 22 and mysql / 3306, and i want to > close port 3306. > could you please tell me how to do this? Add to the init script /etc/init.d/mysql in the else branch of the start) section the following line (between the other options) --bind-address=127.0.0.1 \ (don't forget the trailing backslash!) I really wonder, why this isn't even configurable with a config file/yast...? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \ -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Amavis... interesting
by Arjen Runsink 21 Jan '04

21 Jan '04

Hi Brad I am cc'ing this to the list too. Quoting brad(a)crisp.net: > Did you, perhaps, spell 'amaia' wrong? I did a search for it on > Sourceforge, > but came up empty. I'm going to be setting up an amavis proxy > shortly, which > is why I ask... Yes, it should be Maia http://www.renaissoft.com/projects/maia/index.php BB, Arjen

1 0

closing port 6000
by david 20 Jan '04

20 Jan '04

how do i close the port 6000 ? i had try editing the /etc/X11/xdm/Xservers, and /opt/kde3/share/config/kdm/ Xservers, and add the "-nolisten tcp" switch but nothing happens... is there another configuration file to close this port ? Thanks

10 12