April 2004 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

Well my take on this is this: Install the applications first and test that they are working first before you run any hardening scripts. That way if something stops working after you've run the hardening script, you're sure that the problem has been brought about by the scripts and thus you can reverse the scripts actions one by one until you find the cause. On the actual hardening, there is a script for hardening SuSE linux systems called harden_suse or hard_suse or something similar to that. Searching the CDs using yast for the string "hard" should find it. Noah. > -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] > Sent: 26 April 2004 08:50 > To: suse-security(a)suse.com > Subject: [suse-security] Hardening SuSE 9 > > > > Hi , > > I am new to Linux and am trying to implement SNORT on SuSE > linux 9 with > MYSQL , APACHE + PHP and NTOP. I have few questions : > > - I am looking at securing the box and trying to find some hardening > scripts for the same could someone help me . > > - secondly, should I harden the box before installing SNORT > and the rest of > the apps or after? > > > Thanks for you help in advance. > > Regards, > Ajay Venkatesh > >

3 3

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

> -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] <snip> > Next , There is no package or script in the CDs like "hard" > or "harden_suse" , could this be a third party application. > and if so where can I find it. I used to pick these up from http://www.suse.de/~marc O hope they are still there. However I do my own hardening these days so I do not use the script anymore. > and one more, the hardening script , will it be the same for > all the versions of SuSE ( i.e 8.0 , 8.0 and 9.0 etc) Someone has pointed out that it hasn't been updated in a while so it may be wiser to read the actual script that implement what it does yourself or edit it to fit your system rather than just run it. Noah.

1 0

Hardening SuSE 9
by Ajay Venkatesh 26 Apr '04

26 Apr '04

Hi , I am new to Linux and am trying to implement SNORT on SuSE linux 9 with MYSQL , APACHE + PHP and NTOP. I have few questions : - I am looking at securing the box and trying to find some hardening scripts for the same could someone help me . - secondly, should I harden the box before installing SNORT and the rest of the apps or after? Thanks for you help in advance. Regards, Ajay Venkatesh

1 0

ssh and lock
by Murat Akca 25 Apr '04

25 Apr '04

Hi; We have a problem with ssh.We are using Suse 9.0 and Intel server with 1 GB RAM. When we connect our server via SSH sometimes it locks the machine. I have looked /var/log/messages and could not found anything. Mostly we encountered this problem when our internet connection speed is slow. Do u have any idea? Is there a log for SSH? Best Regards; Murat

4 3

SuSE 8.0: problem with ethereal update
by Armin Schoech 24 Apr '04

24 Apr '04

Hi ! I'm still runnning some SuSE 8.0 servers. When I tried to update the ethereal package wo the newest version 0.10.3-10 I get the following error (fou4s / rpm output): ************************ * ERROR: Update failed * ************************ error: failed dependencies: libethereal.0 is needed by ethereal-0.10.3-10 libwiretap.0 is needed by ethereal-0.10.3-10 Updating works smoothless on SuSE 9.0 were the mentioned libraries are provided by the new updated ethereal-0.10.3.11.rpm package. I suspect they were accidentally missed from the SuSE 8.0 rpm ? Or can I get them by installing some other package on my 8.0 system ? Thanks, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

ip_setsockopt() msfilter exploit
by Philippe Vogel 23 Apr '04

23 Apr '04

Hi! What's with the ip_setsockopt() exploit: http://isec.pl/vulnerabilities/isec-0015-msfilter.txt Are there any patches yet? Which versions of SuSE-Linux are vulnerable? Philippe

1 0

Unwanted file deletion
by Keith Hopper 22 Apr '04

22 Apr '04

Greetings, I believe that the subject of this note might come under the aegis of security - as I have certainly lost some files due to some SuSE configuration script or other. For many months now I have had a soft link from /etc/gtk-2.0 to the directory containing - among other things - the file gdk-pixbuf.loaders which is central to the graphic display of the ROX Filer system. Imagine my horror this morning when loggging on, to receive an error message from the ROX filer indicating that it could not find the file /etc/gtk-2.0/gdk-pixbuf.loaders. Opening an X terminal was kindly done by ROX Session and I discovered to my horror that the directory /etc/gtk-2.0 was now a real directory with a file REMOVE_IN_PROGRESS in it. Now the message in that file indicated that some gnome software was now to be found in /opt/gnome (which doesn't really concern me) but that I should re-install everything else - but it didn't care to indicate what 'else' might be involved. I found a copy of the original gdk-pixbuf.loaders file and re-made the link - but am rather worried that not only the link was destroyed - but also the contents of the directory to which it was pointing when YaST re-built yesterday (after uninstalling a superceded version of Amaya). This seems to me to be an integrity problem which comes under security so far as I am concerned. I presume others have had this happen too. What must be done to stop this automagic file removal?? I don't want to lose all of some vital package due to actions being taken behind my back! Keith Hopper -- City Desk Waikato University [PGP key available if desired]

3 3

SuSEfirewall2 and DHCP in DMZ
by Barry Gill 22 Apr '04

22 Apr '04

Hello All, I wish to set up a SuSEfirewall2 server acting as a NAT gateway wiht three interfaces. I have a Lucent firewall connecting to the web but want to be able to set up access rules on who on my internal LAN can access which of my servers. My question is, how do I configure SuSEfirewall2 so that my DMZ (eth1) and my LAN (eth2) are a) both in the same subnet, b) DHCP server in the DMZ is available for DHCP requests from LAN workstations, and c) enable Netbios over TCP traffic to move through the eth2 to eth1 (and vice versa) ports. Essentially this box will be doing NOTHING other than NAT and routing between the three ports. any help would be appreciated. Thanks Barry

1 0

how about the new multicast kernel exploit?
by Andreas Bittner 21 Apr '04

21 Apr '04

http://www.isec.pl/vulnerabilities04.html any upcoming patches? thanks and cheers, andy

5 5

Log Entry Quesiton
by Eric Kahklen 19 Apr '04

19 Apr '04

I got this entry in my log and I haven't done any user changes recently. The only thing I've done is run the Yast2 online update for some of the recent security patches. Apr 18 10:15:17 gateway usermod[30787]: change user `wwwrun' GID from `8' to `8' Apr 18 10:15:17 gateway usermod[30788]: change user `wwwrun' shell from `/bin/false' to `/bin/false' Thanks, Eric --

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by Marc Samendinger 19 Apr '04

19 Apr '04

> -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: Monday, April 19, 2004 1:00 PM > > > > Check your "services option" in > /etc/sysconfig/SuSefirewall2. FTP ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have > its high ports > >open and the server should have ports 20 and 21 open. 20 and 21 on the server are for active ftp, passive ftp would be 21 and unprivileged port > I don´t get that. I thought passive FTP is used so that I > don´t have to keep > these higher ports open if I only want to download stuff. If > not, what´s the > point ? The point is all the connection are established by your machine. You can use connection tracking to securely open the high ports on your machine "by demand" The imho best explanation about active and passive ftp is http://slacksite.com/other/ftp.html HTH marc

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Opening ports 20 and 21 locally just allows remote users to be able to connect to YOUR ftp server and not the other way round. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 14:00 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > > > Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP > > ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have its high > >ports open and the server should have ports 20 and 21 open. > > I don´t get that. I thought passive FTP is used so that I > don´t have to keep these higher ports open if I only want to > download stuff. If not, what´s the point ? > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

> Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP ports must > be declared in the "EXT" services. The ports 20 and 21 are declared in the "EXT" services. >Actually it is the other way round. You machine should have its high ports >open and the server should have ports 20 and 21 open. I don´t get that. I thought passive FTP is used so that I don´t have to keep these higher ports open if I only want to download stuff. If not, what´s the point ?

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Actually it is the other way round. You machine should have its high ports open and the server should have ports 20 and 21 open. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 12:38 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > This is a transcript of my firewall log when I try to connect > to ftp.suse.de : > > Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 > OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 > TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 > DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) > > Passive FTP is activated. The way I understood passive FTP > the server is supposed to have its higher ports open, while > the downloading computer only has to have ports 20 or 21 > open. My /etc/sysconfig/SuSEfirewall does include a > FW_FORWARD-rule which opens these ports to the entire net, > FW_FORWARD =" > AAA.BBB.CCC.0/6,0/0,tcp,20:21 " > > however I don´t get any kind of FTP, neither upload nor download. > > What´s wrong with my setup ? > > Thanks, > > Jörg > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

This is a transcript of my firewall log when I try to connect to ftp.suse.de : Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) Passive FTP is activated. The way I understood passive FTP the server is supposed to have its higher ports open, while the downloading computer only has to have ports 20 or 21 open. My /etc/sysconfig/SuSEfirewall does include a FW_FORWARD-rule which opens these ports to the entire net, FW_FORWARD =" AAA.BBB.CCC.0/6,0/0,tcp,20:21 " however I don´t get any kind of FTP, neither upload nor download. What´s wrong with my setup ? Thanks, Jörg

1 0

Kernel source not matching kernel update
by Keith Roberts 19 Apr '04

19 Apr '04

Hi everyone. I have now installed the latest kernel update for SuSE 8.1. The two packages are: k_deflt-2.4.21-203.i586.rpm kernel-source-2.4.21-201.i586.rpm I have run # make cloneconfig && make dep in /usr/src/linux. I get the following error when doing make install in the nv source directory: # make install Unable to determine kernel version. make: *** [select_makefile] Error 1 Can anyone help me with this please as I cannot use X11 now? Kind Regards - Keith Roberts

6 12

Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

Hi ! I seem to have a problem regarding my firewall configuration. I want to allow my users FTP access to Internet FTP servers. However, for this to work it seems I have to allow communication over the higher ports (1024:65000) via a forwarding rule like : FW_FORWARD =" XXX.YYY.ZZZ.0/6,0./0,tcp,1024:65000" XXX.YYY.ZZZ.0/6 stands for my IP-range, these are official static IPs. I am not happy with this at all because it would leave my domain wide open, but how can I handle this differently ? I use SuSE 8.0 Pro. Thanks for the help, Jörg

2 3

Re: Limits in /etc/group and useradd infinity loop
by Vyacheslav S.Kulchitskee 19 Apr '04

19 Apr '04

Yesterday i'm found the same problem - useradd stop working. This is small workaround, which help me to solve problem: 1. delete string with "GROUPS=" from /etc/default/useradd (i'm found, that all new accounts belong to additional groups "uucp, dialout, audio, video", but i don't need this) After that all created users well be belong to default group "users" 2. create new "fake" group - /usr/sbin/groupadd fake 3. move existing users from additional groups "uucp, dialout, audio, video" to new group - /usr/sbin/usermod -G fake $username (i wrote small perl-script, which make this operation) 4. remove "fake" group - /usr/sbin/groupdel fake 5. play with /usr/sbin/useradd many-many times! :) PS. Sorry for my english... ------------ Vyacheslav S. Kulchitskee --- а?таматычна Ваш легкий поиск ТУТ! http://go.tut.by

2 1

Re: [suse-security] Kernel source not matching kernel update
by Keith Roberts 18 Apr '04

18 Apr '04

On Sun, 18 Apr 2004, Anders Johansson wrote: > To: suse-security(a)suse.com > From: Anders Johansson <andjoh(a)rydsbo.net> > Subject: Re: [suse-security] Kernel source not matching kernel update > > On Sunday 18 April 2004 21:19, Keith Roberts wrote: > > When I use the nvidia-installer it always compiles the > > nvidia kernel-driver interface for me, as no other options > > are found, even though I use the standard SuSE 8.1 k_deflt > > kernel. > > Right, according to the README, for suse versions 8.1 and below, they are > supposed to provide RPMs. And there is one for the 2.4.19 kernel at > ftp://download.nvidia.com/XFree86/Linux-x86/1.0-5336/ > > although there doesn't seem to be one for the new 2.4.21 kernel > > but the advise seems a bit confused, since they seem to say both to install > the rpm *and* run the installer, which seems a bit redundant. > > Anyways, note that the README suggests that the nvidia installer isn't > intended to work with 8.1, which is as you discovered yourself Perhaps that's where I went wrong. I got most of the install done with nvidia-installer. then had to finish it off by hand myself. Keith Roberts

1 0

Kernel source not matching kernel update
by Keith Roberts 18 Apr '04

18 Apr '04

Hi everyone. I have just downloaded the latest kernel update for SuSE 8.1. The two packages are: k_deflt-2.4.21-203.i586.rpm kernel-source-2.4.21-201.i586.rpm Surely the source should be patch 203 as well? Will this cause problems with compiling the nvidia driver, ie unresolved kernel symbols? Kind Regards - Keith Roberts

2 1

RE: [suse-security] Kernel source not matching kernel update
by GarUlbricht7＠netscape.net 17 Apr '04

17 Apr '04

Keith Roberts <lists(a)kar.eclipse.co.uk> wrote: > >Hi everyone. > > I have just downloaded the latest kernel update for SuSE 8.1. > > The two packages are: > > k_deflt-2.4.21-203.i586.rpm > > kernel-source-2.4.21-201.i586.rpm > > Surely the source should be patch 203 as well? > > Will this cause problems with compiling the nvidia driver, > ie unresolved kernel symbols? > > Kind Regards - Keith Roberts > Hi Keith, If You re-read Date the Wed, 14 Apr 2004 17:44:16 +0200 (CEST) From: Thomas Biege for Package: Linux Kernel Announcement-ID: SuSE-SA:2004:009 http://www.suse.com/de/security/2004_09_kernel.html You will notice that for SuSE 8.1 that k_deflt is labled: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_deflt-2.4.21-203.i58… 0669fd902f68e9b788d2db1cc8eac71a Whereas: the kernel-source is labled: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/kernel-source-2.4.21-2… ef72aafd7907a68c33efe1749d5a9569 This appears to match what you have downloaded. SuSE has done similar numbering changes. IIWY, I wouldn't worry about it. Friendly greetings, Gar -- In the Beginning was the Command Line ---Neal Stephenson -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Re: [suse-security] Limits in /etc/group and useradd infinity loop
by Sebastian Krahmer 16 Apr '04

16 Apr '04

Hi, > Maxim Cherniavsky wrote: > > > > I've found strange problems with useradd program. Suddenly useradd stops > > to work and begins to eat memory till system crash. > > Sad but true that there's absolutely no response from SuSE. :-( Sorry for the delay, as you have probably seen, there have been a lot of updates yesterday; and especially kernel updates require two eyes per involved persons on it :-) We are investigating the useradd issue already. thanks a lot for the report, Sebastian -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

2 1

xinetd anonymous ftp
by John Charlton 16 Apr '04

16 Apr '04

I looked back through a few months of messages on this list and so far have not seen anything to address this anonymous ftp error: I am having the following error accessing SuSE 9.0 server from the internet after loging in as anonymous with jdc(a)CharltonCorp.com as password. ftp> ls 200 EPRT command successful. 435 Can't build data connection: Illegal seek. ftp> When I login from the local network as anonymous it works fine. The only problem I had with configuration is that in the xinetd configuration for ftpd, the user and group come up as --default--. I cannot change these and if I select 'accept' it gives me an error and I have to exit using the cancel button. The /etc/xinetd.d/ftpd file is: # default: off # description: The ftpd server serves FTP connections. It uses normal, \ # unencrypted usernames and passwords for authentication. This ftpd is \ # a port of the OpenBSD ftpd to Linux. service ftp { socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/in.ftpd server_args = -l -l -d disable = no } I added the -l -l -d to get more logging, but it doesn't have any affect on /var/log/xinetd.log ro /var/log/ftpd The /etc/hosts.allow is: in.ftpd : ALL : ALLOW in.ftpd : UNKNOWN : ALLOW As a part of testing I added the follow /etc/ftpaccess file: class local real,guest,anonymous 198.162.100.* class remote anonymous * autogroup ftp remote log transfers inbound,outbound

2 2

RE: [SPAM] - RE: [suse-security] System Update and Online Update - Email found in subject
by Gao, Ruidong 16 Apr '04

16 Apr '04

Thanks. I feel fou4s is better than YOU. My kernel is k_deflt-2.4.19-120 and YOU can not detect the new kernel patch for me by running system update. I have tried with SUSE site. The question is that the site is password protected. Is there workaround of it or how can I get the login info. Ben On Apr 16, Gao, Ruidong <Ruidong.Gao(a)landesk.com> wrote: > Where is patch description file in disk. Is that bundled with fou4s or > SUSE. Where can I find a template of it? The patch descriptions are on the FTP Server. You can use any of them as template, e.g. http://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse/i386/update/8.2/patc hes/XFree86-51260 > I came to run fou4s and ended up with following error message: > ---------------------------- > linux:/home/ben # fou4s -u > You are using ftp.gwdg.de and a business product, this will probably not work. > [...] > What's wrong with it. You need to use sdb.suse.de as update server and supply SuSEUser and SuSEPassword in fou4s.conf, because updates for business products are on password protected servers. I'll make the error message more clear in the next version. Markus

2 1

Mozilla S/Mime buffer overflow security hole
by Bob Pearson 16 Apr '04

16 Apr '04

Does anyone know if Mozilla 1.6 is also vulnerable? I don't see patches for Mozilla 1.6 or Mozilla 1.7 beta as yet. Best Regards. -- _/_/_/ Bob Pearson gottadoit(a)mailsnare.net _/_/_/ i) Nil disputandum de gustibus. _/_/_/ ii) Dum spiro, spero!

2 1