February 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Securing Remote Shell Access via PHP Module
by mailings - kunstwerke.designs 03 Feb '04

03 Feb '04

On Feb 3, mailings - kunstwerke.designs <mailings(a)kunstwerkedesigns.de> wrote: >> Hi People, >> >> need some advice in securing two suSe Linux 8.2 Server which should >> communicate through a remote Shell running on wwwrun ( PHP driven ). >> Servers are both secured with portsentry. > > >>I don't really understand what you mean by "php driven remote shell". Can >>you tell us the software that you are using? I am using a PHP Script i wrote to connect via ssh from a website on my Webserver to the remote one. Its only a process opened via proc_open() in PHP with which i join the shell remotely from my webserver using ssh2. >> Any hints / advices what else i should do to keep the risk down to a >> minimum? > > >>I would at least install a custom kernel with grsecurity patch, forbid >>users to see processes of other users and enable as many of the >>other security options as possible (some break e.g. java, so watch out). >>Of course, always watch your logfiles (logcheck) and apply security >>updates when they come out (fou4s). >>Markus Got to read something more about grsec patch, nice idea. Thanks ben

1 0

Securing Remote Shell Access via PHP Module
by mailings - kunstwerke.designs 03 Feb '04

03 Feb '04

Hi People, need some advice in securing two suSe Linux 8.2 Server which should communicate through a remote Shell running on wwwrun ( PHP driven ). Servers are both secured with portsentry. Any hints / advices what else i should do to keep the risk down to a minimum? Best Regards ben

2 1

low ports and a regular user
by seve7 03 Feb '04

03 Feb '04

just because this would make my life simpler, is there a way to allow some user (or group, etc) to execute a program that listens on a low port? a specific low port? thanks --r dorothy@oz: ~> ls lion scarecrow tinman dorothy@oz: ~> find . -name home There's no place like home.

1 0

RE: [suse-security] Is it iptables enough?
by Sturgis, Grant 03 Feb '04

03 Feb '04

SuSEFirewall is just an administration wrapper for iptables. > -----Original Message----- > From: John [mailto:isofroni@cc.uoi.gr] > Sent: Friday, January 30, 2004 12:49 PM > To: suse-security(a)suse.com > Subject: [suse-security] Is it iptables enough? > > > Is it iptables enough with the built-in firewall to secure a > SL 9.0 box? > This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

8 9

samba 3.0, winbind is not updating userlist - only on restart
by Markus Feilner 02 Feb '04

02 Feb '04

Hello List, I have successfuly brought samba 3.0 on SuSE (8.1,8.2,9.0) to work together with an Active Directory Server. I have (also successfully) enabled squid to use winbind for authentication for internet access. (I need winbind, because only members of a certain AD Group are allowed to access the internet.) Kerberos is running fine. My Problem is: After I add a new user to the AD: With wbinfo -a user%password i can successfully authenticate the new user. ("challenge/response password authentication succeeded") But the list i recieve from wbinfo -u does not show this user until winbind is started over. Why? Note that I have not defined a winbind cache time parameter in my smb.conf, and winbind is running with the -B option for dual server mode. I have searched samba + mailling list archives, but I have not found anything, same at google and new zealand wikis.. Please help! Thank you! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0

chkroot claims top infected
by dh 02 Feb '04

02 Feb '04

I brought up this issue on the SuSE English List (SLE) and it was suggested that I should pass my information along to this list. What follows is a cut and past of the thread from SLE... I just ran chkroot (chkrootkit-0.43, Sat Dec 27 2003) and it gave the results Checking `top'... INFECTED and Checking `lkm'... You have 5 process hidden for ps command I found these commands were in an rpm updated w/ synaptic recently, ps_2003.11.17-18_i586.rpm. The file can be found at ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people top's size is 81.5kb and has a modified date of 2004-01-20 #top -h top: procps version 3.1.14 As further investigation I installed the previous rpm (ps-2003.9.20-6.i586.rpm) from SuSE and then ran checkroot again, this time no errors were reported. Then reinstalled the rpm from the apt repository and the errors appear again. I know this doesn't mean that I haven't been rooted but it really points a finger at the ps_2003.11.17-18_i586.rpm from ftp://ftp.gwdg.de/pub/linux/suse/apt/SuSE/9.0-i386/RPMS.suse-people (the apt archive) If so anyone using apt for their upgrades should be concerned about this. Continuing my investigation I booted up my test machine w/ SuSE 9.0 ran checkrootkit and it showed all clean. Then I used synaptic and updated ps (ps_2003.11.17-18_i586.rpm) and nothing else then I ran chkroot again and the errors are there. Anders Johansson wrote (from 3 separate messages): chkrootkit is reacting to the string /prof in top. That string isn't in the src.rpm, but it is in the binary. That alone is very suspicious. It does look like kraxel's binaries are infected. I wonder what other niceties are in the binaries in the apt repo The suspicious ps package is identical on suse.com and on gwdg.de, so it seems that if something has been compromised it's on suse.com. The problem is in the "top" in the ps package from /pub/people/kraxel The top binary in that contains the string "/prof", which chkrootkit detects as a sign of an infected binary That string isn't in the src.rpm from kraxel's directory, and if you rebuild the rpm from that src.rpm you also won't see that string. And finally a long quote from Ivan Sergio Borgonovo : I've done all these things Installed ps through apt Installed ps from DVD Compiled and installed ps from ftp.suse.com Installed chkrootkit from source Installed chkrootkit from apt and the result ranged from no infected packages, no modules loaded to, top or/and ps infected and hidden modules etc... I doubt that just substituting 2 binaries I can "unload" trojan modules. I gave a look at the sources of chkrootkit and discovered which binary was checking for "hidden" modules. I discovered it has an option -v and got this output stige:~ # chkproc -v PID 3: not in ps output PID 4: not in ps output PID 5: not in ps output PID 6: not in ps output You have 4 process hidden for ps command then I did... // edited to fit in email stige:~ # ps aux USER PID VSZ RSS TTY STAT START TIME COMMAND root 1 620 256 ? S 22:00 0:04 init [3] root 2 0 0 ? SW 22:00 0:00 [keventd] root 0 0 0 ? SWN 22:00 0:00 [ksoftirqd_CPU0] root 0 0 0 ? SW 22:00 0:00 [kswapd] root 0 0 0 ? SW 22:00 0:00 [bdflush] root 0 0 0 ? SW 22:00 0:00 [kupdated] root 8 0 0 ? SW 22:00 0:00 [khubd] root 9 0 0 ? SW< 22:00 0:00 [mdrecoveryd] Curiously enough /proc/3 is actually ksoftirqd_CPU0 /proc/4 is kswapd ... bdflush, kupdated out of panic mode: reasonable??? So there you have it. I would love to post back to the SLE and apt4SuSE lists that this is a non-issue but if there really is a problem then I am sure that the great minds on this list will be able to help. Thanks for your time and I do apologize if I've broken any etiquette, I just don't have time to read the whole FAQ, or search the archives right now . -- dh

2 2

automatic acquiring kerberos tickets
by Markus Feilner 02 Feb '04

02 Feb '04

Hello List, I have samba 3.0 on SuSE 8.1/8.2/9.0, (and debian) integrated in an Active directory. Works fine, Squid as Proxy uses winbind - ADS-Authentication. This of course only works as long as a valid kerberos ticket exists. How can I automatically recieve a ticket? kinit + cronjob won't work, (thank god - i don't need to save a passphrase on the system), because the password is required. I heard about keytabs and a key exchange system, but was not able to get information about that. Can anybody help me with that? Thank you! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

1 0