June 2004 - openSUSE Security - openSUSE Mailing Lists

Pam_mount on SuSe 9.1
by Rob Keeling 09 Jun '04

09 Jun '04

I am trying to install SuSE 9.1 as a workstation in a NT 4 Domain network. The default suse 9.1 install installed winbind etc, and configured them allowing me to log on to ssh with a NT username and password. I now want to configure pam_mount to mount a subdirectory of the unix home directory as the NT home directory. I had configured this on an old SuSE 8.1 box, so I think /etc/pam_mount.conf should be OK. However, having added auth and session lines for pam_mount into /etc/pam.d/sshd I can only get to the stage that in /var/log/messages I see pam_mount: error trying to retrieve authtok from auth code How do I enable pam_mount? My /etc/pam.d/sshd file is as follows #%PAM-1.0 auth required pam_unix2.so set_secrpc auth required pam_nologin.so auth required pam_env.so auth optional pam_mount.so use_first_pass account required pam_unix2.so account required pam_nologin.so password required pam_pwcheck.so password required pam_unix2.so use_first_pass use_authtok session required pam_unix2.so # trace or debug session required pam_limits.so session optional pam_mount.so use_first_pass # Enable the following line to get resmgr support for # ssh sessions (see /usr/share/doc/packages/resmgr/README.SuSE) #session optional pam_resmgr.so fake_ttyname Thanks Rob Keeling -- I love deadlines. I love the whooshing noise they make as they go by. - Douglas Adams -------------------------------------------------------

1 0

NFS over SSH
by January Weiner 08 Jun '04

08 Jun '04

Hello, I'm desperately trying to set up a secure file sharing server. It should support both user authentification and data encryption. It will run in a non-secure LAN and provide about 15 users with their home directories. My first idea was to use NFS over SSH. However, for this you need to specify the ports rpc / nfs /nfslock use. It seems that in SuSE there is no way of specifying the nfslock port, is this correct? What am I doing wrong? How to do NFS over SSH in SuSE? Samba would also be a possibility, however there are a couple of problems with that one: 1) problem with high UID's, we have UIDs >> 65535 and the mounted samba shares do not get proper permissions 2) is it true that Samba does not support special files (like sockets), thus rendering this file system unusable for the purpose of mounting home directories to use e.g. with KDE (which needs to create sockets)? Am I wrong? What other possibilities are there? Best regards, January Weiner -- ------------ January Weiner 3 ---------------------+--------------- Division of Bioinformatics, University of Muenster | Schloßplatz 4 (+49)(251)8321634 | D48149 Münster http://www.uni-muenster.de/Biologie.Botanik/ebb/ | Germany

8 14

Kerberos GDM login
by Ness, Todd 07 Jun '04

07 Jun '04

I have set up a SuSE8.1 workstation to authenticate against an AD domain. I can login fine with ssh. I was getting the same error with ssh but fixed it with some sshd options. But, when I login from the console I get kicked right back out. Relevant log entries: Jun 7 07:27:12 SSPRJDS20TEST login: (pam_krb5) initialize_method: pam_sm_authenticate Jun 7 07:27:12 SSPRJDS20TEST login: (pam_krb5) initialize_method: allocating pam_krb5_state Jun 7 07:27:12 SSPRJDS20TEST login: (pam_krb5) initialize_method: success Jun 7 07:27:15 SSPRJDS20TEST login: (pam_krb5) pam_sm_authenticate: result for user `test004': Success Jun 7 07:27:16 SSPRJDS20TEST login: (pam_krb5) pam_sm_open_session: OK Jun 7 07:27:16 SSPRJDS20TEST login: (pam_krb5) initialize_method: pam_sm_setcred Jun 7 07:27:16 SSPRJDS20TEST login: (pam_krb5) initialize_method: success Jun 7 07:27:16 SSPRJDS20TEST login: (pam_krb5) pam_sm_setcred: result for user `test004': Error in service module Jun 7 07:27:16 SSPRJDS20TEST login: Error in service module Jun 7 07:27:16 SSPRJDS20TEST login: (pam_krb5) cleanup_state /etc/pam.d/gdm: #%PAM-1.0 auth sufficient pam_krb5.so missing_keytab_ok \ putenv_direct auth required pam_unix2.so nullok #set_secrpc account required pam_unix2.so password required pam_unix2.so #strict=false session required pam_unix2.so debug # trace or none session required pam_mkhomedir.so skel=/etc/skel umask=0022 session required pam_devperm.so session optional pam_console.so Pam_krb5 = pam_krb5-1.0.3-311 Any clues.

1 0

SUSE 9.1 POSTFIX 2.1 GREYLISTS ?
by peter.kanters＠nl.abnamro.com 07 Jun '04

07 Jun '04

Hi List, is there any experiance using GREYLIST configuration in postfix ?? Is POSTFIX 2.1 needed to use greylists? Is there an update to POSTFIX 2.1. expected in the near future on SUSE 9.1. ? Best regards, Peter. --------------------------------------------------------------------------- This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. ABN AMRO Bank N.V. (including its group companies) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. ABN AMRO Bank N.V. (or its group companies) does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference. ---------------------------------------------------------------------------

6 5

T-Online abuse address ignoring complaints
by Arjen de Korte 07 Jun '04

07 Jun '04

For the past two months, I have received many automated warnings that supposedly my mailserver was sending spam and/or virusses. It turned out quickly that the real sender of this junk is a T-Online user with a dialup account who sends out daily runs of probably his/her whole addressbook and sometimes spoofs the e-mail address I used to subscribe to this list. The person may be reading this list, so if your IP address today is 'pD951F606.dip.t-dialin.net[217.81.246.6]', you badly need to clean up your system. I has been sending virusses steadily since March 19th. I have sent numerous complaints about this to the abuse address of T-Online and T-IPnet already, with logfiles indicating the times and IP addresses from where the junk came from. To no avail, they have done nothing so far, other than complaining once about the encoding of the attachments, which they thought was base64 while in fact it was 7bit (readable in any mailreader). What other options do I have to stop this system for further distributing virusses? Best regards, Arjen

7 7

uptime/kernel Problem on 9.0?
by Sven 'Darkman' Michels 07 Jun '04

07 Jun '04

Hi there, this morning i noticed that one of my boxes has an uptime for 9 days. Well, nothing special you would say/think, but: this box was booted on 19th feb this year. The logs, last and some remote logins can confirm that, but nearly all applications running on this box, even init, have now a start date 9 days back. It looks a bit like uptime wrapped around to zero after 99 days. This box is running kernel 2.4.21-144-athlon. I know that this is not the latest kernel around etc, just wanna ask if someone knows about that? I will update this box in a few days but i would like to get this confirmed instead of waiting another 100 days ;) Regards, Sven

2 1

Re: [suse-security] Fwd: Undelivered Mail Returned to Sender
by Marc Samendinger 05 Jun '04

05 Jun '04

I'm sorry Arjen if you'll get this message twice I was to fast in sending the mail > -----Original Message----- > From: Arjen de Korte [mailto:suse-security@de-korte.org] > Sent: Saturday, June 05, 2004 11:58 AM > > > Read the message again. It was send from 'MAILER-DAEMON(a)suse.de' to > 'suse-security(a)de-korte.org'. The latter was the spoofed > sender address, so > it was indeed a reply to sender. I hope you will take another look at the message. > Subject: Undelivered Mail Returned to Sender > Date: Friday 04 June 2004 10:20 > From: MAILER-DAEMON(a)suse.de (Mail Delivery System) > To: suse-security(a)de-korte.org This mail got sent to you from the Mailer-Daemon. > This is the Postfix program at host hermes.suse.de. the server that sent this mail was hermes > I'm sorry to have to inform you that the message returned > below could not be delivered to one or more destinations. > *snip* > > <25866(a)suse.de>: unknown user: "25866" it tells you the user 25866 does not exist. Now we'll come to the mail that got sent to 25866(a)suse.de > Encapsulated message > > Received: from scanhost.suse.de (scanhost.suse.de [10.0.0.5]) > by hermes.suse.de (Postfix) with ESMTP id 85C238C9D > for <25866(a)suse.de>; Fri, 4 Jun 2004 10:20:20 +0200 (CEST) as you can see it got sent to 25866(a)suse.de > Received: from suse.de (pD951F606.dip.t-dialin.net [217.81.246.6]) > by Cantor.suse.de (Postfix) with ESMTP id 4B95668F3BE > for <25866(a)suse.de>; Fri, 4 Jun 2004 10:13:32 +0200 (CEST) > From: suse-security(a)de-korte.org Here is your spoofed sender adress > To: 25866(a)suse.de > Subject: Re: Your music > Date: Fri, 4 Jun 2004 10:26:56 +0200 > MIME-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Message-Id: <20040604081332.4B95668F3BE(a)Cantor.suse.de> > X-AMaViS-Alert: INFECTED, message contains virus: Worm.SomeFool.Gen-1 > X-Converted-To-Plain-Text: from multipart/mixed by demime 1.1d > X-Converted-To-Plain-Text: Alternative section used was text/plain > > Please have a look at the attached file. the e-mail text of the original e-mail sent from spoofed suse-security(a)de-korte.org to 25866(a)suse.de > [the SUSE virus scanner removed an attachment of type > application/octet-stream > which had a name of mp3music.pif] > [if you need the message in its original form including all > attachments, > please ask the SENDER for a version free of viruses] This one got added by the suse virusscanner, thats why it tells the recipient he/she should ask the SENDER for the attachement. Now this modified mail should be delivered to 25866(a)suse.de. Which doesn't exist... > End of encapsulated message > > Theres usually no problem in doing so because its a notice > to your own > > users. > > Which is not the case here. It is. 1. Virus e-mail from spoofed suse-security(a)de-korte.org to 25866(a)suse.de is sent 2. scanhost.suse.de scans the mail vor viruses and removes the attachement, but inserts a warning that the attachement got removed 3. scanhost.suse.de relays the mail to hermes.suse.de which propbably is the server hosting the suse mails. 4. user 25866(a)suse.de does not exist, so hermes sends a bounce to the (spoofed) sender > > The mail you got was just a legit "User Unknown" bounce. > > You are a perfect example of people falling in the trap I was > warning for. I still say its a legit bounce. I'm awaiting your answer and wonder if you will prove me wrong. > Best reagards, > Arjen marc

1 0

Re: [suse-security] T-Online abuse address ignoring complaints
by m3047＠inwa.net 05 Jun '04

05 Jun '04

Getting OT, but I guess I'll add to the noise once.. hopefully more signal than noise. Human factors argument follows. At 12:57 PM 6/5/04, Ralph Seichter wrote: >[...] >If you could convice your bosses to do so, I'd very much doubt their >intelligence. Why? How much business do they do with the people using those addresses? >Why not block China or the USA aswell? Why not live on >an IT island? As a matter of fact, and I'm in the USA, but I have noticed that I do block significant parts of certain countries (no, not Germany AFAIK) at my own firewall; it's a simple expedient, and I suppose it reduces the amount of e-mail problems as a side effect. I also block certain companies which provide certain "services" (and in the current climate, what is the distinction?). Do you really want to see my firewall logs? Come on, look at where your problem traffic originates and tell me there isn't some coherence. (I also run a 'bot motel on one web server.) Furthermore yes there is a certain block of addresses belonging to a German ISP which doesn't get access to our FTP server at my day job; I've also been authorized once to call up an ISP and tell them we were no longer going to accept traffic from their block if they could not identify the party using a certain range within it (does it matter for our purposes here whether we blocked the ISP or they divulged the party?). This is simply another cost-benefit equation: how much legitimate interest do I get from these people, versus grief? If anybody from one of these blocks was denied access and wrote me saying "hey, I'm one of the good guys" and could support it (no list trolls, won't work; you have to find me through the usual channels to make a case), I'll punch a hole for them. My point is that yes, in spite of the clouded vision produced when one's head is in the clouds of idealism, the Internet is Balkanized. In fact, is it not as Balkanized (at least in the USA) as when DARPA and the US educational backbone provided significant (free) bandwidth. Most of us do live on "IT islands" as a practical matter: we visit a limited number of web sites, we exchange e-mail with a limited number of people or entities, we share certain interests and goals which inform our exchanges of information. We deploy technology to facilitate such exchanges at our convenience, not to make it easy for random parties to exercise a misconstructed form of "free speech". In addition to the islands of common interest, you can also look at this as a "web of trust". People want to declare technological solutions to these "problems" but, as with electronic voting, it's a solution in search of a problem. In either of these paradigms, there is no great harm to selective blocking; "island hopping" is often possible and of course when you visit some other island you may very well encounter a visitor from yet another island somewhere and decide that a closer affiliation is in order. This is technology reflecting the human limitations on the dissemination and absorption of knowledge. On a day to day basis, my life is a whole lot simpler and less worrisome if I restrict access when traffic analysis indicates there is a locus of annoying activity (by the way there are automated tools such as snort which can be set up to do just this); I don't need PGP keys, for instance, as an excuse to exercise reasonable human judgement. In fact, trusting technology is no substitute for human judgement (it can only be an adjunct unless you truly want a Balkanized internet). I agree that people should be "liberal in what they accept, conservative in what they send" which is an underlying precept echoed in numerous RFCs. But at the end of the day, my IT island is mine, and you're a visitor on it and you're expected to act like one; and when I visit someone else's IT island I respect it as theirs and try to comport myself, as a visitor, in such a fashion as is likely to allow me to visit again in the future... provided I want to be able to visit again in the future. This includes not filling their logs or inboxes with garbage (it's not a perfect world, I do send some autoreplies to e-mail for instance), not poking around on weird ports, trying to maintain some relevance in my contributions (difficult at times), and so forth. It's not a perfect world of course, and I try to forgive people's trespasses as I wish them to forgive mine; but when there's nothing coming from somewhere but noise... I just don't have a problem with people electing to block or restrict access, in fact I completely understand. fin. -- Fred Morris, speaking for Fred Morris Consulting, not InWa.net (they're just my ISP) fredm3047(a)inwa.net (I-ACK)

1 0

Re: [suse-security] Fwd: Undelivered Mail Returned to Sender
by Marc Samendinger 05 Jun '04

05 Jun '04

> -----Original Message----- > From: Arjen de Korte [mailto:suse-security@de-korte.org] > Sent: Friday, June 04, 2004 11:24 AM > To: suse-security(a)suse.com > > > Please folks, this is exactly the reason why you should NOT > send bounces in > reply to virusses. I'm very disappointed that SuSE is still > not aware of the > implications of this annoying behaviour. To summarize, only > send warnings to > authenticated senders otherwise you might be sending it to a > spoofed sender > address. Ehm, just for the records. The virus warning you got was not a reply to the sender telling the sender he is probably infected, but a mail to the recipient that someone sent an infected e-mail to him. Theres usually no problem in doing so because its a notice to your own users. The mail you got was just a legit "User Unknown" bounce. The problem is that scanhost.suse.de does not know which users are legit for suse.de. Or even better Cantor.suse.de shouldn't even accept the message. Hint: relay_recipient_maps Hint ;) marc

2 1

about ssh tunnels (-R option)
by Emiliano Sutil 04 Jun '04

04 Jun '04

Hello, I´m trying to make inverse ssh tunnels to access the vnc server of a client machine. MYPC ------------------->SSH server ---------------->PC vncserver - Internet --publicIP - PrivateIP ------- vncviewer 192.168.1.215 192.168.0.200 To do this I use this command: ssh -f -C -N -g -R 5910:192.168.1.215:5910 PublicIP (ssh server) My problem is that with this command the socket that listen on the SSH server is on the localhost interface 127.0.0.1 so If I connect to the ssh server and run vncviewer 127.0.0.1:10 I reach the vncserver on MYPC, but if run from the PC machine vncviewer 192.168.0.200:10 I can´t connect because it does not accept connections to that interface at the 5910 port. finally, my question is that is it possible to allow the connection from de PC machine so I reach the vncserver in MYPC machine Thanks P.D: My latest test with openvpn works very well, I make a openvpn connection from MYPC to PC and I reach the vncserver without any problem, but now I want to do the same with ssh, Emiliano Sutil

2 1