November 2004 - openSUSE Security - openSUSE Mailing Lists

Failed attempts, block address
by MB 02 Jan '05

02 Jan '05

Hi list, Been getting a ton of attempts on my ssh/ftp connections as of late, first they started with the usual script kids trying the admin/guest/etc on the ssh connection, now i get people trying all sorts of stupid usernames with blank passwords on the ftp connection. 1. Is there a way to block an IP, either perm. or for set period of time for SSH attempts 2. Is there a simular way for VSFTP I'm sure i could block the address's manually, but i'd like it if it was automated? say for 6 attempts? Matt SuSE 9.1 --------------------------------- Do you Yahoo!? Yahoo! Mail - You care about security. So do we.

7 7

Detection of DoS Attacks on Webserver
by Markus Roth 23 Dec '04

23 Dec '04

Hi! I'm currently doing my diploma work. its about detecting HTTP-DoS Attacks on web servers. it tries to detect this attacks based on statistical anomalies of the requests. it looks at the request rate (with an exponential moving average), the period in which a client is active, the time distribution of the requests (chi square), the return status of the web server and the distribution of the URI's hit. till now, it looks pretty promising but one very important factor is unaccounted, the coast of a single request! what i like to do is calculating a coast for each request, so that request that charge the CPU more or demand lots of bandwidth, have a higher suspicious level. the hole analysis process is done on the logfile of a web server. to train the system old logfiles are feed. after that the system switches to live mode and watches the access logfile (like tail -f) for changes and tries to detect attacks in "real time" (with the possibility to block them via an apache module or the firewall (time based rule)). some companies in switzerland sponsored their logfiles to develop the system. the bad thing, non of this logfiles contains the time to handle the requests! now my question, is somebody willing to give me some log data in combined format but with the time to handle a request. apache2 would log this with the "%D" parameter in microseconds. logfiles with about 100'000 - x'000'000 requests would be optimal. you can anonimize your logdata with http://sourceforge.net/projects/anonlog/ if you like or have to. an other thing which would be very interesting is if somebody has logfiles where script kiddies tried to bring down a web server with lots of requests to cpu intensive dynamic pages or got attacked in an other way. if you think i'm running in the wrong direction with this project or have other things on your mind which i should consider, please let my know! regards markus roth

7 14

intruder in home system 8.2 prof
by Martin 02 Dec '04

02 Dec '04

Recently I notice a large increase in spam related to recent transactions I've made. I ordered pharmaceuticals on line and now get increased spam from thos type of business. I inquired about credit card fraud and get spam. Could this mean there is some kind of binary running in my system which sends information about my activities. I've heard about something called spyware. I believe my system has some kind of suse 8.2 supplied software firewall but don't know where or how to configure it. How would I find and remove any such unwanted intruder?

6 6

Re: [suse-security] intruder in home system 8.2 prof
by GarUlbricht7＠netscape.net 30 Nov '04

30 Nov '04

John Andersen wrote on Tue Nov 30 2004 - 09:10:36 CET: > > On Monday 29 November 2004 05:17 pm, Martin wrote: >> Recently I notice a large increase in spam >> related to recent transactions I've made. >> I ordered pharmaceuticals on line ... > > So YOUR the one!!! > > You buy from spammers you reap what you sow. > Hi Martin, For your info, The State of Washington, USA has fairly tough laws against spam. But if you do business with a "on-line pharmaceuticals co" all bets are off -- under the "recent business exception" you have given them a license to spam you to death. IIWY, I would strongly consider "getting a new email address" Also you didn't say how you paid them, But if it was by credit card, IIWY, I would have my bank issue me a new credit card. Better safe than sorry. It is also good to have a firewall.. See Mike's comments on how: http://lists.suse.com/archive/suse-security/2004-Nov/0138.html HTH, Gar -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Re: [suse-security] SuSEfirewall2 blocks SMB traffic
by tmp＠nitwit.de 29 Nov '04

29 Nov '04

On Monday 29 November 2004 16:06, Johannes Becker wrote: > When this works, I would strongly recommend to allow the samba ports to be Unfortunately it doesn't :-\

2 2

Cross Platform Java Plugin Security Risk
by Tiscali Gary D Chance 29 Nov '04

29 Nov '04

How can we tell if SuSE 9.2 has the latest Java Plugin version which is not vulnerable to this potential security problem. No precise details are given in this article: "Java bug could hit PC operating systems" 17:51 24 November 04 NewScientist.com news service http://www.newscientist.com/news/news.jsp?id=ns99996724 Does anyone know any more details about this and possible risks? Gary

5 4

Re: [suse-security] strange ssh behaviour with "PermitRootLogin yes"
by Cristian Veronesi 29 Nov '04

29 Nov '04

Richard Ems wrote: > Yes this behavior is normal! > > If you set "PermitRootLogin no" then root logins are NOT permitted! (you > wrote: "Both of them have "PermitRootLogin no" in /etc/ssh/sshd_config") > > Or did I miss something? Sorry, it seems I didn't explained me too well, so I'm replying to the list. In the 3.4p1-215 box if I enter the right root password I keep getting the "Permission denied, please try again." message. This, for me, is normal behaviour. In the openssh-3.4p1-263 box, it I enter the right root password the remote host immediatly truncates the SSH connection. This, for me, is a strange behaviour, so I was asking the list about that. Thank you. Kind regards, -- Cristian Veronesi - C.R.P.A. S.p.A. - Reggio Emilia, Italy The only truly safe way to avoid Outlook problems is to avoid using Outlook.

1 0

strange ssh behaviour with "PermitRootLogin yes"
by Cristian Veronesi 29 Nov '04

29 Nov '04

I hope this is the right place to ask... This problem seems to be related to openssh-3.4p1-263 on SUSE SLES8. It happens on two different boxes that run this version. A third SUSE SLES8 box with openssh-3.4p1-215 does not show this behaviour. Both of them have "PermitRootLogin no" in /etc/ssh/sshd_config, all other SSHD options were left untouched after installation. Here's what it happens: me@mybox:~> ssh root@remotebox root@remotebox's password: <wrong root password> Permission denied, please try again. root@remotebox's password: <right root password> Connection closed by 1.2.3.4 me@mybox:~> Here's the relevant info that appear on remote box's /var/log/messages: Nov 29 15:16:23 remotebox sshd[23921]: Failed password for root from ::ffff:5.6.7.8 port 33862 Nov 29 15:16:25 remotebox sshd[23921]: ROOT LOGIN REFUSED FROM ::ffff:5.6.7.8 Nov 29 15:16:25 remotebox sshd[23921]: Failed password for root from ::ffff:5.6.7.8 port 33862 Nov 29 15:16:25 remotebox sshd[23921]: fatal: monitor_read: unsupported request: 32 Is this behaviour normal? Thank you. Kind regards, -- Cristian Veronesi - C.R.P.A. S.p.A. - Reggio Emilia, Italy The only truly safe way to avoid Outlook problems is to avoid using Outlook.

1 0

SuSEfirewall2 blocks SMB traffic
by tmp＠nitwit.de 28 Nov '04

28 Nov '04

Hi! I do have some problems configuring SuSEfirewall2 for Samba client+server use. My machine is connected to a router and so is other machine. Does somebody see what I am doing wrong? FW_QUICKMODE="no" FW_DEV_EXT="eth-id-00:0d:87:39:28:9c" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="1214 4662 6882 microsoft-ds netbios-dgm netbios-ns netbios-ssn ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="139 445" FW_SERVICES_INT_UDP="137 138" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" FW_SERVICES_EXT_RPC="" FW_SERVICES_DMZ_RPC="" FW_SERVICES_INT_RPC="" FW_ANTISPOOF="no" FW_IPv6="" FW_IPv6_REJECT_OUTGOING="yes" FW_IPSEC_TRUST="no" FW_LOG="" FW_SERVICES_DROP_EXT="" FW_SERVICES_REJECT_EXT="0/0,tcp,113" FW_LOG_LIMIT=""

3 10

Re: [suse-security] SuSEfirewall2 blocks SMB traffic
by tmp＠nitwit.de 28 Nov '04

28 Nov '04

On Sunday 28 November 2004 12:40, Johannes Becker wrote: > 1.) allow samba ports for external interface (FW_SERVICES_EXT instead of > FW_SERVICES_INT), > 2.) FW_SERVICE_SAMBA = "ext" (instead of "yes"). > > Good luck and regards, No luck... :-(

1 0