January 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] closing port 6000 (fwd)
by Keith Roberts 20 Jan '04

20 Jan '04

Take Two! here is the script I use to start the Xwindow system, without X listening for incoming tcp connections. #!/bin/sh # # /usr/X11R6/bin/runX-no-listen # a simple script wrapper to start the X11 server # without listening for tcp connections. # last updated 2003-08-13 startx -- -nolisten tcp # end of wrapper works ok for me under SuSE 8.1 pro HTH Keith Roberts ---------- Forwarded message ---------- To: david <david(a)radikalsystems.com> From: Lindomar Santos <lindomar(a)pop-am.rnp.br> Subject: Re: [suse-security] closing port 6000 Hi David, You have to edit /etc/opt/kde3/share/config/kdm/Xservers :0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp ps: In suse box 8.2 __|__ By Lindomar, o---*--(*)--*---o http://wecanstopspam.org On Tue, 20 Jan 2004, david wrote: > I dont want to filter the port, I want to close it > i dont understand why i easly can close port 6000 on slackware and mandrake > but suse just cant > > > On Tuesday 20 January 2004 9:03 am, Philippe Vogel wrote: > > > david wrote: > > > > is there another configuration file to close this port ? > > > > > > /etc/opt/kde3/share/config/kdm > > > > > > This may/should be a link (or /opt/... should be) > > > > With yast you can configure there is no remote access to X. > > > > If you want to have ports not closed but in steath mode you will have to > > patch iptables with the grsecurity iptables-patch (you will need kernel > > sources as well). > > This patch implements steathmode for filtering (afaik this will even not > > work with ack-packets scans). > > > > Philippe > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

maybe off topic, ports ftp
by piet 20 Jan '04

20 Jan '04

as for the apache server one can use port 8080 instead of 80. Is something likewise possible for ftp (pureftp in my case) to use something else as 20&21 say 8020&8021 or so. I would like to ftp to my server but it shouldn't be to obvious. Another question I struggle with how to configure ftp & apache in such a way that I can drag and drop files by means a browser on a remote box to upload files to the server after a login. with regards, piet

10 15

Hi
by poeml＠suse.de 20 Jan '04

20 Jan '04

Test =) rdlfhqs -- Test, yep.

20 25

Re: ALERT - GroupShield ticket number OB7_1074610853_SV0023_1 was generated
by Philippe Vogel 20 Jan '04

20 Jan '04

Here you see a working header check (as my mail did not include any attachement): > Action Taken: > The message was quarantined and replaced with a text informing the recipient > of the action taken. > > To: > suse-security(a)suse.com <suse-security(a)suse.com> > > From: > Philippe Vogel <filiaap(a)freenet.de> > > Sent: > 853835904,29613926 > > Subject: > [suse-security] Amavis... interesting > > Attachment Details:- > > Attachment Name: N/A > File: Infected.msg > Infected? Yes It is only checked wheather or not some context is inside a mail. > Repaired? No > Blocked? No > Deleted? No > Virus Name: Suspicious IFrame.a Philippe

1 0

Online Update Security
by Zoran Cvetkovic 20 Jan '04

20 Jan '04

Hallo, Suse's online update is using http or ftp to download patches and updated packages from numerous mirrors. What cryptographical checks are done to the downloaded packages to ensure that they are what they pretend to be? I belive that rpms buildin signatures are used? Am I right, or are other precautions done by YOU? Is there any documentation about that ? best regards Zoran Cvetkovic

3 2

Sophos Anti-Virus IDE alert: W32/Bagle-A (fwd)
by Keith Roberts 19 Jan '04

19 Jan '04

Perhaps Suse needs to scan all mail for this list for viruses? Some information here. ---------- Forwarded message ---------- To: notification(a)lists.sophos.com From: Sophos Alert System <notification-return(a)lists.sophos.com> Subject: Sophos Anti-Virus IDE alert: W32/Bagle-A Name: W32/Bagle-A Aliases: W32.Beagle.A@mm, Win32.Bbgle.A@mm Type: Win32 worm Date: 19 January 2004 A virus identity (IDE) file which provides protection is available now from the Latest virus identities section, and will be incorporated into the March 2004 (3.79) release of Sophos Anti-Virus. Sophos has received several reports of this worm from the wild. Information about W32/Bagle-A can be found at: http://www.sophos.com/virusinfo/analyses/w32baglea.html Download the IDE file from: http://www.sophos.com/downloads/ide/bagle-a.ide Download all the IDE files available for the current version of Sophos Anti-Virus in a single compressed file. The file is available in two formats: Zip file: http://www.sophos.com/downloads/ide/ides.zip Self-extracting file: http://www.sophos.com/downloads/ide/ides.exe Read about how to use IDE files at http://www.sophos.com/downloads/ide/using.html --------------------------------------------------------------------- To unsubscribe, email: notification-unsubscribe(a)lists.sophos.com For additional commands, email: notification-faq(a)lists.sophos.com

2 1

The Eclipse Internet VIRUSshield Service Detected VIRUS (W32/Bagle@MM) in mail to you (from <suse-security-return-21086-lists=kar.eclipse.co.uk@suse.com>)
by Keith Roberts 19 Jan '04

19 Jan '04

Greetings! Nice to know my ISP detected and blocked this virus from the list. FYI ---------- Forwarded message ---------- To: undisclosed-recipients: ; From: virusalert(a)eclipse.net.uk Subject: The Eclipse Internet VIRUSshield Service Detected VIRUS (W32/Bagle@MM) in mail to you (from <suse-security-return-21086-lists=kar.eclipse.co.uk(a)suse.com>) VIRUS ALERT We are sorry, but it appears you have been sent an email that contained virus: W32/Bagle@MM The email was NOT delivered. This is for information only, no further action is required. Sender: (<suse-security-return-21086-lists=kar.eclipse.co.uk(a)suse.com>) Recipient: lists(a)kar.eclipse.co.uk Quarantine Ref: /var/virusmails/virus-20040119-155802-28197-01-68 * Please note that many viruses may fake the sender address. __DATA__

1 0

enough freaking RE: HI's!
by Brock Hensley 19 Jan '04

19 Jan '04

enough allready. next subject. -- Brock Hensley Hi-Tech Companies http://www.Hi-TechCompanies.com/ Phone: 269.488.7788x112 1.800.968.1155x112 Fax: 269.488.7799 Mobile: 269.267.5406 This communication is intended solely for the use of the addressee and may contain information that is legally privileged, confidential or exempt from disclosure. If you are not the intended recipient, please note that any dissemination, distribution, or copying of this communication is strictly prohibited. Anyone who receives this message in error should notify the sender immediately and delete it from his or her computer. If you suspect e-mail abuse please contact abuse(a)hi-techcompanies.com Notice: Attachments are automatically scanned for viruses using the Kaspersky Engine.

1 0

virus from the list
by Kenneth Schneider 19 Jan '04

19 Jan '04

The following message had attachment(s) which contained the viruses: >From : suse-security-return-21086-suseseclist=rtsx.com(a)suse.com To : ken(a)rtsx.com Subject : Date : Mon, 19 Jan 2004 12:59:04 -0400 Message-ID: <kpjfmncoyejjuiljgkc(a)suse.de> Attachment Virus name Action taken ------------------------------------------------------------------------------ dgvxokpkxv.exe ??? Removed Thought this could be tracked by the Message-ID. -- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2)

2 1

imap access changes /etc/sasldb
by Mathias Homann 19 Jan '04

19 Jan '04

help! since recently, an imap access changes /etc/sasldb! doent matter if the client is outlook express or kmail, after the imap access, /etc/sasldb has a new timestamp and a different md5sum, but the passwords themself are thill the same. started like one week ago, but tripwire doesnt notice anything strange. any ideas? system in question is a suse 8.0 with all patches installed. bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

2 1