March 2004 - openSUSE Security - openSUSE Mailing Lists

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

Bridging Firewall with traffic-shaping
by Guido Tschakert 01 Apr '04

01 Apr '04

Hello, I want to install a Bridge between our dsl-router and company network. Major task should be traffic shaping but an extra firewall wouldn't be that bad. I found that in the standard kernel bridge is compiled as module and I have no problem in loading the module, but I did not find any point to start configure the bridge! Has anybody out there build a bridge with SuSE 8.2 (or higher) and could tell me some links and hints to configure a bridge guido

5 6

RE: [suse-security] Odd FW Log
by Peer Stefan 31 Mar '04

31 Mar '04

Hi, > From: Tom Knight [mailto:thomas.knight@ahds.ac.uk] > I have no problem with people scanning me, it's the "SuSE-FW-ACCEPT" > bit that makes me concerned... I though that that meant the packet > had been accepted (and passed through) the firewall, or am I misinter- > preting this? Do you have FW_ALLOW_INCOMING_HIGHPORTS_TCP or FW_ALLOW_INCOMING_HIGHPORTS_UDP set to yes? If so, then it's normal behaviour. A high port is any port higher than 1023, which includes 1433. > Tom. regards, Stefan

2 1

Odd FW Log
by Tom Knight 31 Mar '04

31 Mar '04

I'm seeing odd thiungs in my FW log. Running SLES 8, all YOU updates applied. Machine has v. limited services (ssh, apache, tomcat, mysql, postfix). Ports 80 and 8080 have just been opened globally, but this happened before then. The only other ports available (22, 3306) are to a few systems locally. Only one nic is configured (and plugged in), eth1. The SuSE FW set up is as comes out of the box except as detailed above, although I had more logging turned on initially... umm, the extra logging is in effect for the entires below. (Log _all_ dropped packets). Question: Why am I seeing these connections being acceppted and dropped on port 1433?? Log (grepped): Mar 31 05:37:02 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=xxx SRC=66.7.157.125 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=59278 DF PROTO=TCP SPT=44435 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 05:37:02 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=66.7.157.125 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=59278 DF PROTO=TCP SPT=44435 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:56 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=00:0f:1f:02:28:80:00:09:11:7a:20:00:08:00 SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=40393 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:56 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=40393 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:59 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=41111 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:59 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=41111 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) No, my machine isn't called xxx. The same goes for the IP/MAC address. Any ideas? TIA, Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

3 4

Strange Bind log messages
by Markus Gaugusch 31 Mar '04

31 Mar '04

Since a week or so the following message has started to appear in my logs: inet-gw named[25917]: refused query on non-query socket from [206.223.115.112].30221 Does anyone know what is going on there? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

Re: Your document
by thomas＠ruchs.de 31 Mar '04

31 Mar '04

Your document is attached. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of your_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

AW: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by Rasp, Robert 31 Mar '04

31 Mar '04

Hello David, i dont want to give wrong info to you :-( I use SpamAssassin 2.55 and my rbl_check's are stored in "20_head_tests.cf" gate:/usr/share/spamassassin # grep check_rbl * 20_head_tests.cf:#header RCVD_IN_OSIRUSOFT_COM rbleval:check_rbl('osirusoft', 'relays.osirusoft.com.') 20_head_tests.cf:#header X_OSIRU_OPEN_RELAY rbleval:check_rbl_results_for('osirusoft', '127.0.0.2') 20_head_tests.cf:#header X_OSIRU_DUL rbleval:check_rbl_results_for('osirusoft', '127.0.0.3') 20_head_tests.cf:#header X_OSIRU_SPAM_SRC rbleval:check_rbl_results_for('osirusoft', '127.0.0.4') 20_head_tests.cf:#header X_OSIRU_SPAMWARE_SITE rbleval:check_rbl_results_for('osirusoft', '127.0.0.6') 20_head_tests.cf:#header X_OSIRU_DUL_FH rbleval:check_rbl('osirusoft-dul-firsthop', 'relays.osirusoft.com.') 20_head_tests.cf:# the new first arg for check_rbl() indicates what type of check it is; 20_head_tests.cf:header RCVD_IN_RELAYS_ORDB_ORG rbleval:check_rbl('relay', 'relays.ordb.org.') 20_head_tests.cf:header RCVD_IN_SBL rbleval:check_rbl('relay', 'sbl.spamhaus.org.') 20_head_tests.cf:#header RCVD_IN_ORBS rbleval:check_rbl('relay', 'orbs.dorkslayers.com.') 20_head_tests.cf:header RCVD_IN_OPM rbleval:check_rbl('relay', 'opm.blitzed.org.') 20_head_tests.cf:#header RCVD_IN_DSBL rbleval:check_rbl('relay', 'list.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_MULTIHOP_DSBL rbleval:check_rbl('multihop', 'multihop.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_UNCONFIRMED_DSBL rbleval:check_rbl('relay', 'unconfirmed.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_RFCI rbleval:check_rbl('rfci', 'ipwhois.rfc-ignorant.org.') 20_head_tests.cf:header HABEAS_HIL rbleval:check_rbl('hil', 'hil.habeas.com.') 20_head_tests.cf:header RCVD_IN_BONDEDSENDER rbleval:check_rbl('relay', 'query.bondedsender.org.') 20_head_tests.cf:#header RCVD_IN_BL_SPAMCOP_NET rbleval:check_rbl('spamcop', 'bl.spamcop.net.') 20_head_tests.cf:#header RCVD_IN_RBL rbleval:check_rbl('rbl', 'blackholes.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_RSS rbleval:check_rbl('relay', 'relays.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL rbleval:check_rbl('dialup', 'dialups.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL_FH rbleval:check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.') 20_head_tests.cf:header RCVD_IN_NJABL rbleval:check_rbl('njabl', 'dnsbl.njabl.org.') 20_head_tests.cf:header X_NJABL_OPEN_PROXY rbleval:check_rbl_results_for('njabl', '127.0.0.2') 20_head_tests.cf:header X_NJABL_DIALUP rbleval:check_rbl_results_for('njabl', '127.0.0.3') CU Robert -----Ursprüngliche Nachricht----- Von: David Huecking [mailto:d.huecking@gmx.net] Gesendet: Sonntag, 28. März 2004 01:04 An: suse-security(a)suse.com Betreff: Re: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd Hi Robert, first thanks for your hint, but I think that SpamAssassin when run from amavisd-new doesn't get its configuration out of the local.cf file, but from the $sa_* entries in the amavisd.conf. There I found an entry: $sa_local_tests_only = 1; No I set this to 0, so non-local test will be performed(?) and I will see what will happen with realtime blacklisting which I think are non-local tests. BTW I found the check_rbl string in 20_dnsbl_tests.cf and not in 20_head_tests.cf. 8-) Anyway I'm looking for a possibility of Bayes filtering if possible with white- and black-listing per user with my setup. Maybe I will try to integrate dspam (Homepage: http://www.nuclearelephant.com/projects/dspam/ ;German article: http://www.pro-linux.de/news/2004/6620.html) into postfix. But as I'm no postfix configuration hero I will need some time (for reading the Postfix book I ordered...). ;-> On Samstag, 27. März 2004 16:17, Rasp, Robert wrote: > i use spamassassin with qmail and i dont use a per-user-config. > The first few weeks it worked very good but then the spamlevel begun to > increase. Now i enabled RBL-Check. By default RBL is disabled in local.cf. > This works very good but you have to look for servers that are offline or > very slow. I simple tested all the servers in > "/usr/share/spamassassin/20_head_tests.cf" (grep "check_rbl" > 20_head_tests.cf). You can use nslookup for that. > I disabled every slow server with '#'..... -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

10 15

freeswan-1.99: cannot respond to IPsec SA
by Dennis Leist 30 Mar '04

30 Mar '04

Hi all, Due to troubles with freeswan-2.04_1.4.8-12 I try to use freeswan-1.99_0.9.34-80 (www.suse.de/~garloff/linux/FreeSWAN/). /---------------\ /---------------\ /---------------\ /---------------\ | Linux 2.4.19 | | Speed Touch | | W-Lan Router | | WINX W2k | | 62.210.20.146 |<----| 62.210.20.145 |<----| WAN-IP: |<---| W-LAN-IP: | | SuSE 9.0 | | No NAT at all | | 213.39.205.80 | | 192.168.1.99 | \---------------/ \---------------/ \---------------/ \---------------/ VPN-Server: SuSE 9.0, SpeedTouch: static IP, freeswan-1.99_0.9.34-80 <snip v/l/m> vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: cannot respond to IPsec SA request because no connection is known for 62.206.19.146[C=DE, ST=Hamburg, L=Hamburg, CN=<Admin CN>]:17/0...213.39.205.80[C=DE, ST=Koeln, CN=<User CN>]:17/1701==={192.168.1.99/32} vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_ID_INFORMATION to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: received Delete SA payload: deleting ISAKMP State #2 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80: deleting connection "w2k-client" instance with peer 213.39.205.80 <snap v/l/m> What do I need to change in ipsec.conf to make it run? I donn't understand the first error. What is wrong with my ipsec.conf? If you need any more information, I'll be glad to provide it !! Thanks in advance. <snip ipsec.conf> config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=yes conn %default keyingtries=0 disablearrivalcheck=no authby=rsasig leftrsasigkey=%cert rightrsasigkey=%cert conn w2k-client left=62.210.20.146 leftnexthop=62.210.20.145 leftrsasigkey=%cert leftcert=gatecert.pem leftprotoport=17/0 right=%any rightrsasigkey=%cert pfs=no rightsubnet=192.168.1.99/32 rightprotoport=17/1701 keyingtries=0 disablearrivalcheck=no auto=add <snap : ipsec.conf>

2 2

Hidden message
by marco＠hkservice.com 30 Mar '04

30 Mar '04

[cid:nhrteompnc.jpeg] [the SUSE virus scanner removed an attachment of type image/jpeg which had a name of nhrteompnc.jpeg] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses] [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of TextDocument.zip] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Re: [suse-security] Netfilter Bug -- kernel 2.4.20
by Mark Tinka 30 Mar '04

30 Mar '04

--- Philippe Vogel <philippe(a)fb7-fg6.uni-duisburg.de> wrote: > > > We uses cisco routers as well, but no WCCP in > our > > > network. > > > Maybe it depends on your WCCP-Patch > > > (http://www.sublime.com.au/squid-wccp/). > > > > i haven't yet setup the caching service, i am just > > getting ready to do that.. i like to read up on > all > > sorts of things before i do.. > > > > i've setup a transparent squid cache before, but > this > > was 2 yrs ago, on SuSE Linux 7.2 Pro with kernel > > 2.2.19-SMP, and using route-maps (not WCCP) on > Cisco > > for transparent redirection.. > > Why do you use the cisco for that? > Your linux box can do taht as well. > Security (int/ext/dmz)? well, that was 2 yrs ago.. and also because i am an ISP, so my customers use a 'router' as a gateway, and not a Linux box.. i need to have a way to redirect HTTP requests to the cache server, without having the customers know about it.. > > > > make cloneconfig > > > make dep > > > > > > to get a copy of the config of the SuSE kernel? > > > This may help configureing the right things. > > > > i see.. good tip.. do u mean i could clone the > running > > config of the pre-installed SuSE kernel, and then > add > > anything else i need before i build..?.. > > No! > > (*) > > cd /usr/src/linux > make cloneconfig > make dep > > Maybe you apply your patch with the patch command to > the source before (*) > cloning the config. > If there are any minor or mayor changes the compiler > will ask you for > missing options. > After make dep you can compile your own modules. > The same with iptables if you use a newer one. Cool, thanks! > > Philippe > Regards, Mark. __________________________________ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html

3 3

Re: Here
by bjornts＠mi.uib.no 30 Mar '04

30 Mar '04

Here is the file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of yours.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

CryptoAPI & losetup under SuSE 8.2
by Thomas Gaertner 29 Mar '04

29 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hello List, I want to setup encrypted loopback devices using CryptoAPI from kernel 2.4.25. So my problem is, that the tools from util-linux which is from 8.2 are not aware of the CryptoAPI drivers. Does anybody know, where to get the correct util-linux package, as well as the patches needed to make it using the CryptoAPI implementation from kernel 2.4.25? Thanks... - -- Thomas Gaertner ( host leela ) Brandenburg Technical University at Cottbus - --------------------------------------------------------------- Please send only plain ASCII-Mail. In case your Mail will be turned down, use <Dr.Zoidberg-Earth at gmx dot net>. But beware - I check this mailbox only once a day. - -- Stop Nemo! No seawater fish in hands of unexperienced children! - --- PGP-Public-Key http://www-stud.informatik.tu-cottbus.de/~tgaertne/public-pgp-2048.04232001… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQGb/DVRxDogMOg+VAQGd1QgAxAJoXH/qLiqK/2Nu3p9OsO6YeNUh54FN HXdUJ8a9Iv6w1HXQzC8uamuarTrgdTP7ttsl0THRkr5e0df79dpeSB27pmOCWSrg 26oHaMaK6OrpjzzSgC8qG/Si4kfCrseGmi2GeZW+paRG9nWlOeBBkxJbhZLWsc8t 9fv3gzys6oboK4Mp+FkW8YU4muQaxzrMnfAamJj9j06Xd4Rx31IaS09ITtcXBcV5 hLznk8/Qj3qn91GbdeLDvt3VKNnjZyR4bh6X2c4Thisggw0DKZxI38JZeDAzocvp 7ppuK/KsbN26bclaL2WpzV/nb59ls1TBy3wpdgZ6NNBXSdeuOgS2Ug== =F/ZH -----END PGP SIGNATURE-----

2 1

Re: Approved
by d.huecking＠gmx.net 29 Mar '04

29 Mar '04

Here is the file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of all_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Weah, hello! :-)
by marc＠SUSE.DE 28 Mar '04

28 Mar '04

I don't bite, weah! password -- 31271 [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of Info.zip] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

AW: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by Rasp, Robert 28 Mar '04

28 Mar '04

Hello David, i use spamassassin with qmail and i dont use a per-user-config. The first few weeks it worked very good but then the spamlevel begun to increase. Now i enabled RBL-Check. By default RBL is disabled in local.cf. This works very good but you have to look for servers that are offline or very slow. I simple tested all the servers in "/usr/share/spamassassin/20_head_tests.cf" (grep "check_rbl" 20_head_tests.cf). You can use nslookup for that. I disabled every slow server with '#'..... CU Robert -----Ursprüngliche Nachricht----- Von: David Huecking [mailto:d.huecking@gmx.net] Gesendet: Samstag, 27. März 2004 13:59 An: suse-security(a)suse.com Betreff: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Fw: mail-server: error report
by Marc Samendinger 26 Mar '04

26 Mar '04

> -----Original Message----- > From: Philippe Vogel [mailto:filiaap@freenet.de] > Sent: Friday, March 26, 2004 2:07 PM > > > Is there a possibility to unsuscribe this account? > I always get this back after posting to the list - equal wich > content (and > this nerves me!). > > Here a sample of the content: *snip* > > > > Send mail to "owner-mail-server(a)rtfm.mit.edu" to contact a > real person > > (We have a limited amount of time to answer questions, so > please read > > the help file before sending questions.) Have you ever tried to contact the owner? Either the above mentioned e-mail or postmaster@ should get you in contact with someone that knows what to do. I would think the people at MIT are capable to resolve your "problem" (if its really the MIT mailserver sending those mails). marc

1 0

RE: [suse-security] Fw: mail-server: error report
by Barry Gill 26 Mar '04

26 Mar '04

Philippe Vogel <filiaap(a)freenet.de> wrote the Mar 26, 2004 3:06 PM: > Is there a possibility to unsuscribe this account? > I always get this back after posting to the list - equal wich content (and > this nerves me!). I have already set up a filter for that domain to send it straight to /dev/null

1 0

Fw: mail-server: error report
by Philippe Vogel 26 Mar '04

26 Mar '04

Is there a possibility to unsuscribe this account? I always get this back after posting to the list - equal wich content (and this nerves me!). Here a sample of the content: ----- Original Message ----- From: <mail-server(a)rtfm.mit.edu> To: "Philippe Vogel" <filiaap(a)freenet.de> Sent: Friday, March 26, 2004 11:23 AM Subject: mail-server: error report > -----cut here----- > Errors were encountered by the mail server while parsing your message to it. > An annotated copy of your message is below. The annotations of each command > line are as follows (lines not annotated were not treated as commands by the > server): > - Could not be processed (e.g., missing file, illegal vote). > X Is not valid. > R Skipped because it is a repeat of a previous request in > the same message. > + Successfully interpreted. > Note that the server ignores the remainder of a message if it encounters > 20 errors in it. > Furthermore, only the first 20 requests in a message are honored. > > Output of successful commands will be sent under separate cover. > > X > hi all.. > X > > X > i am preparing to run Squid-2.5 on my SuSE Linux 8.2 > X > Professional server, and i want to do run in > X > transparent mode using the 2.4 kernel WCCP module with > X > a Cisco router... > X > > X > as i get along, i've noticed a problem with Netfilter > X > -- a bug that causes the automatic redirection of HTTP > X > packets to Squid's 3128 port to hang... this bug has > X > been reported in kernel 2.4.20, and SuSE Linux 8.2 Pro > X > is running kernel 2.4.20-108 (latest update)... > > X My Box: > > X SuSE 8.2 > X uname -a > X Linux <Host> 2.4.20-64GB-SMP > > X No patch to iptables, redirect int -> 8080 dansguardian -> 3128 squid -> no > X problem. > X We uses cisco routers as well, but no WCCP in our network. > X Maybe it depends on your WCCP-Patch (http://www.sublime.com.au/squid-wccp/). > [error limit reached; remainder of message ignored] > > The most common error in requests to the mail server is specifying an > incorrect file name. Other common errors include: > * incorrect case in file names (case IS significant when requesting files); > * including a signature or other extra text without a "quit" command > before it. > > Commands should be sent to "mail-server(a)rtfm.mit.edu". > > For general information on using the mail server, send a message > to "mail-server(a)rtfm.mit.edu" with a body of: > > help > > For a listing of top-level files and directories available at this > site, send a message to "mail-server(a)rtfm.mit.edu" with a body of: > > index > > Send mail to "owner-mail-server(a)rtfm.mit.edu" to contact a real person > (We have a limited amount of time to answer questions, so please read > the help file before sending questions.) > -----cut here----- >

2 1

impossible log message
by Selcuk Ozturk 26 Mar '04

26 Mar '04

I see occasionally copies of the following line in my email server's log. I looked at the kernel source and found point where this message is output. But, that portion of the code is marked as an 'impossible' case by comment. Obviously, that's not true. My question is whether this message has any security or stability consequences. I never had any problems with that server but, it would be good to hear if somebody has a more definitive answer. -- Mar 25 20:05:12 mail1 kernel: neigh_timer_handler(): timer & !nud_in_timer -- Selcuk PS: My server is a dual Xeon system running Suse 8.1.

1 0

Netfilter Bug -- kernel 2.4.20
by Mark Tinka 26 Mar '04

26 Mar '04

hi all.. i am preparing to run Squid-2.5 on my SuSE Linux 8.2 Professional server, and i want to do run in transparent mode using the 2.4 kernel WCCP module with a Cisco router... as i get along, i've noticed a problem with Netfilter -- a bug that causes the automatic redirection of HTTP packets to Squid's 3128 port to hang... this bug has been reported in kernel 2.4.20, and SuSE Linux 8.2 Pro is running kernel 2.4.20-108 (latest update)... i wonder - has SuSE patched the kernel of this bug..?.. please see below for the bug report as well as the patch for it... ------------------------------- Hello, netfilter guys. We run transparent web caches using ipt_REDIRECT, and after upgrading to 2.4.20, found that conntrack table overflows after a week or so. Quick examination showed large number of entries in SYN_SENT state with super long timeouts exist. The offending change was in include/linux/list.h. list_del() now zeros prev and next pointer of list_head, which circumvents is_confirmed() test. This didn't cause troubles to most conntrack entries which disappear by timing out. But as our cache was bypassing some of the connections, the machine was seeing only one way stream of packets (!IPS_SEEN_REPLY). And when the originating host terminates a bypassed connection by sending out RST packets, the corresponding entry is repeatedly removed from hash with death_by_tiemout() and soon confirmed again adding jiffies to expire time every time. Applying the following patch solved the problem. As I'm not on the list, please CC to me any comments regarding this problem. Thank you a lot for great netfilter. --- linux-2.4.20-orig/include/linux/netfilter_ipv4/listhelp.h 2003-02-20 16:48:27.000000000 +0900 +++ linux-2.4.20-rmap-pm/include/linux/netfilter_ipv4/listhelp.h 2003-02-20 16:45:30.000000000 +0900 @@ -57,10 +57,13 @@ if (!list_inlist(head, oldentry)) \ printk("LIST_DELETE: %s:%u `%s'(%p) not in %s.\n", \ __FILE__, __LINE__, #oldentry, oldentry, #head); \ - else list_del((struct list_head *)oldentry); \ + else __list_del(((struct list_head *)oldentry)->prev, \ + ((struct list_head *)oldentry)->next); \ } while(0) #else -#define LIST_DELETE(head, oldentry) list_del((struct list_head *)oldentry) +#define LIST_DELETE(head, oldentry) \ + __list_del(((struct list_head *)oldentry)->prev, \ + ((struct list_head *)oldentry)->next) #endif /* Append. */ ------------------------------------ all help appreciated... __________________________________ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html

3 5

Iptables affected by h323-vulnerability
by Thorsten Büker 26 Mar '04

26 Mar '04

Dear all, According to a security advice published by DFN-CERT [1] in january we deactivated iptables-based forwarding of h323-connections on our gateway. This service was based h323_conntrack-module for kernel 2.4.20, built from latest patch-o-matic. We consider to use video-conferencing again, because netfilter [3] still didn't publish any information whether iptables are affected by this leak. Does anybody of you know the opposite, i.e. iptables are affected by this vulnerability? [1] -> http://cert.uni-stuttgart.de/archive/win-sec-ssc/2004/01/msg00033.html [2] -> http://www.netfilter.org/security/index.html Thanks in advance and kind regards, Thorsten -- Thorsten Büker * Bärenstr. 19-21 / WG 3106 * 52064 Aachen Tel 0241 - 8865315 * Mobil 0163 - 2572057 * http://bueker.net

1 0

Re: [suse-security] Suse 8.2 firewall configuration: blocking port 25 from the internal network
by Wilfred van Velzen 26 Mar '04

26 Mar '04

>>> Arjen de Korte <suse-security(a)de-korte.org> 2004-03-22 20:22:00 >>> > On Monday 22 March 2004 09:05, Wilfred van Velzen wrote: > > > Our policy is to let anything go out. ;-) > > That's not a policy. That's unrestricted access by default and trying to plug > all the holes you leave open. Rest assured, your users will find ways around > your blockade in no time (there are plenty forwarders available). In time > you'll find that closing everything by default and opening what's allowed to > be far easier (and secure) to administrate. This blockage was just to prevent accidental virus contaminations to bother the outside internet, not to prevent users to do certain things. > > I changed this to: > > > > iptables -A forward_int -s 192.168.0.1 -p tcp --dport 25 -j ACCEPT > > iptables -A forward_int -p tcp --dport 25 -j REJECT > > > > Because our email server needs to be able to go through! > > Since you have left everything wide open, you could put all of this in one > line: > > iptables -A forward_int -s ! 192.168.0.1/32 -p tcp --dport 25 -j DROP Ok. Do I need to specify the interface here? Or won't this prevent smtp connections from the outside to reach the mailserver on the inside? > It is almost always better to DROP connections, than to REJECT them. Since the > SuSEfirewall2 scripts provides a pretty CPU intensive set of rules by > default, it makes sense to keep your own additions as limited as possible. On the outside sure, but on the inside of a firewall? I want to keep the machine's on the inside running as fast as possible. Dropping might slow them down a bit... Met vriendelijke groet / Best regards, Wilfred van Velzen -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

2 1

RE: [suse-security] OpenSSL - Nesus Scan
by Urquidi, Julio 25 Mar '04

25 Mar '04

I had the same question about openssh a while ago. Here's the response I got... > I just updated SuSE openssh from 2.9.9p2-141 to 2.9.9p2-154, but Nessus > still reports the following... > > I thought by updating this package, I wouldn't see the alert messages from > Nessus anymore... > > (TEXT basically saying that openssh is not current) > > Is this normal behavior when it comes to SSH on SuSE? Why does it continue > to show as a problem? Yes, this is normal behavor. NESUS only checks the Service-Version to validate if the service is exploitable or not. NESUS does not try a exploit at all. But our actual ssh-version includes all necesary patches to make ssh secure. The patches are backported to our released ssh-version, because we does not release new version without complete code audit. with kind regards, your SUSE LINUX Support Services-Team -----Original Message----- From: Eric Kahklen [mailto:eric@kahklen.com] Sent: Thursday, March 25, 2004 9:26 AM To: Suse-Security Subject: [suse-security] OpenSSL - Nesus Scan I just ran a nessus scan and it showed OpenSSL vulnerable even though I updated my server when the security fix cam out. Here is the results for OpenSSL. I checked my version and it is OpenSSL 0.9.7b 10 Apr 2003. Either I didn't get my correct version or the update didn't apply. Here is what Nesus said: results|10.0.0|10.0.0.4|https (443/tcp)|11875|Security Hole|The remote host seem to be running a version of OpenSSL which is older than 0.9.6k or 0.9.7c. \n\nThere is a heap corruption bug in this version which might be exploited by an\nattacker to gain a shell on this host.\n\nSolution : If you are running OpenSSL, Upgrade to version 0.9.6k or 0.9.7c or newer\nRisk factor : High\nCVE : CVE-2003-0543, CVE-2003-0544, CVE-2003-0545\nBID : 8732\nOther references : IAVA:2003-A-0027, RHSA:RHSA-2003:291-01, SuSE:SUSE-SA:2003:043\n results|10.0.0|10.0.0.4|www (80/tcp)|11853|Security Warning|\nThe remote host appears to be running a version of Apache 2.x which is older \nthan 2.0.48.\n\nThis version is vulnerable to a bug which may allow a rogue CGI to disable\nthe httpd service by issuing over 4K of data to stderr.\n\nTo exploit this flaw, an attacker would need the ability to upload a rogue\nCGI script to this server and to have it executed by the Apache daemon (httpd).\n\nSolution : Upgrade to version 2.0.48 when it is available\nSee also : http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030 \nRisk factor : Low\nCVE : CVE-2002-0061, CAN-2003-0789, CAN-2003-0542\nBID : 8926\n Thank you, Eric -- ______________________________________________________________________ Eric Kahklen Seattle, WA -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

OpenSSL - Nesus Scan
by Eric Kahklen 25 Mar '04

25 Mar '04

I just ran a nessus scan and it showed OpenSSL vulnerable even though I updated my server when the security fix cam out. Here is the results for OpenSSL. I checked my version and it is OpenSSL 0.9.7b 10 Apr 2003. Either I didn't get my correct version or the update didn't apply. Here is what Nesus said: results|10.0.0|10.0.0.4|https (443/tcp)|11875|Security Hole|The remote host seem to be running a version of OpenSSL which is older than 0.9.6k or 0.9.7c. \n\nThere is a heap corruption bug in this version which might be exploited by an\nattacker to gain a shell on this host.\n\nSolution : If you are running OpenSSL, Upgrade to version 0.9.6k or 0.9.7c or newer\nRisk factor : High\nCVE : CVE-2003-0543, CVE-2003-0544, CVE-2003-0545\nBID : 8732\nOther references : IAVA:2003-A-0027, RHSA:RHSA-2003:291-01, SuSE:SUSE-SA:2003:043\n results|10.0.0|10.0.0.4|www (80/tcp)|11853|Security Warning|\nThe remote host appears to be running a version of Apache 2.x which is older \nthan 2.0.48.\n\nThis version is vulnerable to a bug which may allow a rogue CGI to disable\nthe httpd service by issuing over 4K of data to stderr.\n\nTo exploit this flaw, an attacker would need the ability to upload a rogue\nCGI script to this server and to have it executed by the Apache daemon (httpd).\n\nSolution : Upgrade to version 2.0.48 when it is available\nSee also : http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030 \nRisk factor : Low\nCVE : CVE-2002-0061, CAN-2003-0789, CAN-2003-0542\nBID : 8926\n Thank you, Eric -- ______________________________________________________________________ Eric Kahklen Seattle, WA

1 0

Eclipse and SuSE Firewall
by Ivan Yosifov 25 Mar '04

25 Mar '04

Hello All, I am having a big problem with the Java IDE Eclipse - both with the version packed with SuSE 9.0 Pro and with latest 3.0 Milestone.I am posting this message to this particular list because the problem is actually a SuSE Firewall config problem.When starting a debug session with the firewall NOT running everything works fine.However when the firewall is up the first time I run the debugger it displays a "Finding free socket .... 66%" message and looks dead for the next 15 minutes.Eventually it connects and works properly.The next time I start the debugger in the same eclipse session it connects immediately , no waiting.I suspect Eclipse is doing some sort of port-probing to find out where the java remote debugging infrastructure is listening for connections and the firewall is making this scan a VERY slow process.I have experimented with different firewall configs , but no effect.Since localhost is scanning itself this can not be considered an attack.My exact question is : How do it tell the firewall to allow localhost to do ANYTHING with itself and other hosts , ie how do disable any processing on packets comming from localhost. Thanks in advance , I am really desperate. Ivan Yosifov.

2 2