September 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] re: strange but true
by Ben 28 Sep '04

28 Sep '04

On Tue, 28 Sep 2004 08:49:21 +0000 (GMT), Armin Schoech <schoech(a)iap-kborn.de> wrote: > Hi, > >> Year it was a TCP connection and the port from memory was fairly high >> somewhere around 1300 or there bouts! >> hope that helps, sorry i dont have, oh hang on, yes i do >> its port 80 all of them where port 80 which is a web site aye >> but when i enters the ip numbers it comes up un known? >> > --> probably this is a virus/trojan etc. which tried to connect to a > website which has been shut-down because it provides virus updates, > trojan commands, or something like this. > > Doesn't sound too good anyways... > > Armin > > No i didnt think it sounded to good! it seems to me that linux has as many security probs as MS does?. I think ill dive into linux security over the next few months and arm myself with as much knowlege as pos. do you know of any linux dist's that are on the safer side as far as security goes? as i am pretty much a newbie (only got into linux the last 2-3 months) but have learn a heap in that time and am considering doing a gentoo install that ive herd can be done using knoppix. But im rather hooked on SuSE 9.1 and will endevour to learn as much on security and SuSE as i can, This mail list has been awesome and i learn alot from peoples problems and answers. Thanks to everyone who devotes their time here for people like me that really appreciates and learns a heap. Yours...Ben -- Using Opera's revolutionary e-mail client: http://www.opera.com/m2/

2 1

Re: [suse-security] Making SuSE 9.1 a router?? HOW??
by John Andersen 28 Sep '04

28 Sep '04

On Saturday 25 September 2004 02:02 pm, melissad wrote: > Am reading the docs on iptables now. It seems then that I have what I > need for the interfaces. I will reconfigure the Cisco router behind > that and play with some connectivity. www.shorewall.net Makes Iptables easy, and much more flexible than the SuSE firewall. You may find you don't need the cisco anymore and can hook the SuSE box directly to the internet. -- _____________________________________ John Andersen

4 7

IPSEC Openswan firewalling
by Dimitris Stamatoulis 27 Sep '04

27 Sep '04

Dear all, I have a linux box with suse 9.1 distro and I have set-up an ipsec tunnel using Openswan with a PIX 515. Of course there is no ipsec0 interface because of the 2.6 kernel. I am using my own application which is dealing with tcp sockets. The application is working fine through the ipsec tunnel. The problem I have is that I cannot put any firewalling regarding my tcp ports beacuse there is no ipsec0 interface to apply iptables, which means that if someone puts a linux box on my hub(where my linux box is), he can access my tcp listening ports, even though my tunnel is established. How can I prevent this? What can I do? I have not used at all racoon,setkey etc.. Only Openswan. -- Thanks in advance, Dimitris Stamatoulis

1 0

Re: [suse-security] Mozilla 1.7.3
by Marcus Meissner 27 Sep '04

27 Sep '04

On Mon, Sep 27, 2004 at 03:16:09PM +0100, Anthony Edwards wrote: > On Mon, Sep 27, 2004 at 04:06:30PM +0200, Marcus Meissner wrote: > > > This is not the official mozilla upgrade RPM from SuSE. > > > > rpm -Uvh mozilla......rpm > > > > on the commandline to upgrade with this one. > > Hi Marcus > > Many thanks. The issue is, though, that after upgrading Mozilla using > the rpm -Uvh command, Flash, Acrobat, RealPlayer etc no longer work. > > There are instructions at: > > http://portal.suse.com/sdb/en/2002/09/mozilla.html > > However, these instructions do not work either; running: > > SuSEconfig --module mozilla (as root) results in an error message > ("module mozilla not found" I believe is the syntax) and so one then > has a broken Mozilla from that point on. > > Any ideas? Its not an official SuSE RPM, so of course the integration broke. Ciao, Marcus

1 0

Mozilla 1.7.3
by Anthony Edwards 27 Sep '04

27 Sep '04

ftp://ftp.suse.com/pub/projects/mozilla/1.7.3/README-1.7.3 states: These packages are based on the 1.7.2 release but contain all security fixes which are done with 1.7.3 release. Unfortunately though, packages appear to have been built for SuSE 9.0 & 9.1 only. I own a copy of 9.1, but am currently running 8.2 on both my production workstations and have no present plans to upgrade due to time pressures and the disruption involved. Are there any plans to build and release a package for SuSE 8.2? TIA. -- Anthony Edwards anthony.edwards(a)uk.easynet.net

3 5

Kismet -- Orinoco Error
by Doug Foster 27 Sep '04

27 Sep '04

Whenever I run Kismet from Suse 9.1, I get the well-known "kernel: eth1: Error -5 writing packet to BAP " error showing up in the logs. Eventually the logs fill so fast that the computer becomes non-responsive. Interestingly, the problem does not occur whenever the computer associates with an AP before launching Kismet. The solution at http://www.kismetwireless.net/Forum/General/Messages/1058245225.517217 didn't work for me. Has anyone else had this Orinoco problem and if so, how did you fix it? -- Doug

1 0

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

Re: [suse-security] Making SuSE 9.1 a router?? HOW??
by John Andersen 25 Sep '04

25 Sep '04

On Saturday 25 September 2004 12:31 pm, melissad wrote: > So, how do I: > 1. force the eth0 (1.2.168.x.y) to be the external interface with > its default gateway and SuSE FW to see it as that > 2. set eth0 (192.168.x.y) as the default gateway for the internal > interface (or is this set in ip-tables)? > 3. If in ip-tables, what do I set for the default gateway for the > internal interface? It helps to think of it as Machines have default gateways, but interfaces don't. Machines connected to the internal interface need to point to that IP (172.16.16.1) as THEIR default gateway. But the SuSE box itself needs to point to its upstream (internet side) partner as ITS default gateway. So if the SuSE boxes eth0 (192.168.x.y) connects to the internet (presumably via a router) then your SuSE box's Default gateway is the IP of the router - usually 192.168.x.1. Boxes only have one default gateway, usually the IP of the next box upstream. -- _____________________________________ John Andersen

1 0

RE: [suse-security] Handling DoS Attacks from within
by GarUlbricht7＠netscape.net 25 Sep '04

25 Sep '04

Lucky Leavell wrote on Sat Sep 25 2004 - 05:08:42 CEST http://lists.suse.com/archive/suse-security/2004-Sep/0238.html > We are a small ISP using wireless (radio, not cellular) links and have > been experiencing increasing incidents of DoS (SYN Flood and smurf) > attacks. When first encountered, we built and deployed a bridging > firewall using SuSE 9.1 and Shorewall which does exactly what it is > designed to do: filter traffic entering > or leaving the subnet it protects. > >However, the statistics reveal that most of our attacks originate within >the subnet and not from the outside (internet). We have been using >ethereal to capture traffic and, using that to ID the source, cut them off >only to have the attack resume from another system on the subnet... (snip) > > Since most of our customers us M$ systems, > we are thinking we have several infested with some sort of worm > or trojan but it is a daunting task to identify the culprit > and remedy the situation. > ----<text trimmed>--- > >Questions: > > 1. What tools other than ethereal should we use? > 2. Is there any other protective measure we can take to fend > off the attacks from within our own networks given that > we do not have total control of the network as a corporate > user would? > 3. (snip) > > Any suggestions would be GREATLY appreciated > including other lists we might frequent. > > Thank you, > Lucky Leavell > Hi Lucky, Earlier today I read: http://www.securityfocus.com/columnists/267 It might have an idea or two you can use because it seems to me that your first problem is how to educate your customers to aid you in solving the problem. As one reviewer of the above article said: Sooner or later it comes down to the Human Firewall guarding the network Friendly greetings, -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Handling DoS Attacks from within
by Lucky Leavell 25 Sep '04

25 Sep '04

We are a small ISP using wireless (radio, not cellular) links and have been experiencing increasing incidents of DoS (SYN Flood and smurf) attacks. When first encountered, we built and deployed a bridging firewall using SuSE 9.1 and Shorewall which does exactly what it is designed to do: filter traffic entering or leaving the subnet it protects. However, the statistics reveal that most of our attacks originate within the subnet and not from the outside (internet). We have been using ethereal to capture traffic and, using that to ID the source, cut them off only to have the attack resume from another system on the subnet. For example, Machine A will syn flood B but it also affects every other user on the subnet by consuming bandwidth. If we shut A off, then shortly, C will attack D, etc. Since most of our customers us M$ systems, we are thinking we have several infested with some sort of worm or trojan but it is a daunting task to identify the culprit and remedy the situation. What we have done: 1. Implement a bridging firewall to protect against attacks from the outside. 2. Inplement full email filtering using SuSE/Postfix/amavis-new/ clamAV/spamassassin. 3. Attempt to identify and deal with infested systems (Really the customers' responsibility but ...) Questions: 1. What tools other than ethereal should we use? 2. Is there any other protective measure we can take to fend off the attacks from within our own networks given that we do not have total control of the network as a corporate user would? 3. Are these particular worms or trojans which operate like this? Any suggestions would be GREATLY appreciated including other lists we might frequent. Thank you, Lucky Leavell

1 0