September 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] IPSEC - SuSE 9.1 - Shorewall 2.x
by t.henneberger＠hcs-computer.de 22 Sep '04

22 Sep '04

Hey Philipp > From: philipp.rusch(a)rusch-edv.de > To: suse-security(a)suse.com > Hi all, > > I use the same setup in production with Suse 8.1 / 8.2 and 9.0, > IPSEC-VPN with Freeswan and Shorewall as firewall. > ipsec.conf is modified for this new setup, main difference is > the kernel 2.6.x > > what happens: > - I don't see an interface "ipsec0" or similar anymore when I startup IPSEC Native IPsec doesn't have a virtual interface anymore, you only get this with KLIPS. > - I get errors in firewall logs about connection attempts from my road- > warriors on port 4500 (???) what's this ? UDP port 4500 is the ESP-Protocoll, I guess thats why your Roadwarriors are acting strange, too. Best Regards Thomas

2 2

strange: Open Ports, not owned by processes, SuSe 9.1
by Markus Gerke 22 Sep '04

22 Sep '04

Dear list! I encountered a strange behaviour of my 9.1-Installation. The system is listening to TCP-ports (for example 1024, 996) but I don't know which processes are assigned to it and I did not start a service. Here is the netstat -atp output right after boot (runlevel 3): Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:967 *:* LISTEN 4602/ypbind tcp 0 0 ipi230.ipi.:netbios-ssn *:* LISTEN 5260/smbd tcp 0 0 *:sunrpc *:* LISTEN 4403/portmap tcp 0 0 ipi230.ipi:microsoft-ds *:* LISTEN 5260/smbd tcp 0 0 *:ssh *:* LISTEN 4576/sshd That is OK, but after approx. 10 min. an additional port is open: Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 *:1024 *:* LISTEN - tcp 0 0 *:967 *:* LISTEN 4602/ypbind tcp 0 0 ipi230.ipi.:netbios-ssn *:* LISTEN 5260/smbd tcp 0 0 *:sunrpc *:* LISTEN 4403/portmap tcp 0 0 ipi230.ipi:microsoft-ds *:* LISTEN 5260/smbd tcp 0 0 *:ssh *:* LISTEN 4576/sshd There is no process assigned to 1024. I checked the system with chkrootkit and rkhunter, both negative. Do you know this behaviour? Is this a backdoor? Before I encountered this problem the system was permanently running in runlevel 5, also runninng CUPS. Perhaps this has something to do with the vulnerability solved with the patch from Sept. 15? Regards, Markus

3 3

Suse 9.0->apache2->mod_auth_ldap->bug ? When the fix will be available ?
by Dmitry Novosjolov 22 Sep '04

22 Sep '04

Hello All, I have a strange behavior of the module mod_auth_ldap in apache2 in suse 9.0: when configuring basic authentication like that: <VirtualHost *:80> ServerName default.domain.com DocumentRoot /www/default/htdocs <Directory /www/default/htdocs> order allow,deny AllowOverride All allow from 123.123.123.123 AuthLDAPUrl ldap://ldap.domain.com:389/dc=domain,dc=com?uid?sub? (objectclass=person) AuthLDAPBindDN cn=server,ou=services,dc=domain,dc=com AuthLDAPBindPassword password AuthType Basic AuthName "LDAP-Protected resource" require valid-user Satisfy any </Directory> </VirtualHost> when accessing not from trusted IP 123.123.123.123 the following thing happens: 1. a password dialog opens, to enable user to provide a correct password - good thing 2. intentionaly type INCORRECT user/password combination, submit. Get access denied with another dialog opening - good thing 3. Now type CORRECT user/password combination, still get access denied - not a good thing, probably bug ???!!!??? Note1: if you type in the first attempt correct user/password combination - no bad thing happen. Note2: could not find anything related explainig to that behavior in bug reports of apache, however that problem is fixed in the most recent release (see below) Note3: Nothing bad is seen in apache's log files after a failure. I use default version of apache2 package shipped with Suse 9.0: apache2-2.0.47-63 with prefork package. Update to the latest apache2 package available by the moment at ftp.suse.com (apache2-2.0.48-139) - does not help. Tests were made on two separate installations of Suse 9.0 system. The problem is fixed when building apache2-2.0.51 from sources, but the question is WHEN the fixed version will be available in updated at ftp.suse.com ? I really need it :) -- Best Regards, Novosjolov Dmitry

1 0

postfix
by Paul Ikanza 22 Sep '04

22 Sep '04

My Postfix keeps dying, some one give me some ideas on what could be wrong with it please.

3 2

ldconfig binding order correct ?
by Christian Volkmann 21 Sep '04

21 Sep '04

Hi SuSE security community, ldconfig / ld.so seems to include /usr/local/lib first and before /usr/lib. Is this the right order to load libraries ? Due some installation (self compiled version + suse-package) of nessus I found this "strange behavoir". /usr/sbin/nessusd started with the "self compiled" /usr/local/lib/* files. I expected this order only with a set LD_LIBRARY_PATH. May be it's define to take the pathes of /etc/ld.so.conf first. Does somebody an official definition of the "ld.so.conf" order ? Best regards, Christian PS: It's not a security problem until somebody is able to write a modified library to /usr/local/lib which is taken earlier than the /usr/lib/...

1 0

IPSEC - SuSE 9.1 - Shorewall 2.x
by Philipp Rusch 21 Sep '04

21 Sep '04

Hi all, I use the same setup in production with Suse 8.1 / 8.2 and 9.0, IPSEC-VPN with Freeswan and Shorewall as firewall. ipsec.conf is modified for this new setup, main difference is the kernel 2.6.x what happens: - I don't see an interface "ipsec0" or similar anymore when I startup IPSEC - I get errors in firewall logs about connection attempts from my road- warriors on port 4500 (???) what's this ? - My gateway "sees" the attempts to exchange SA info on port 500, but never gets farther as to complain about incomplete packets. Clients are W2K and WXP, both work ok with other freeswan connections and the same way to produce x.509 certs. Any hints ? Regards, Mit freundlichen Grüßen, Philipp Rusch ----------------------------------------------------------------- | EDV Beratung Rusch EDP Consulting Rusch | | Philipp Rusch IBM Certified AS/400 Specialist | | Am Errlich 9 WWW : http://www.rusch-edv.de/ | | D-61191 Rosbach, Mailto: Philipp.Rusch(a)rusch-edv.de | | Germany Ust.-ID: DE 157 548 731 | | Phone: (+49) 6003 3972 Mobile : (+49) 172 89 86 230 | | Fax : (+49) 6003 3795 | | | ----------------------------------------------------------------- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte den Absender und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser E-Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

ssl errors from imaps
by Aubrey King 21 Sep '04

21 Sep '04

I have been trying to set up this server for days and to no avail. I tried the docs here: http://portal.suse.com/sdb/en/2003/05/imap_ssl.html but they do not work, as I get the following errors in my /var/log/mail.err: Sep 21 14:32:35 ross1 imapd[11431]: Unable to load certificate from /etc/ssl/certs/imapd-192.168.0.199.pem, host=[192.168.0.6] Sep 21 14:32:35 ross1 imapd[11431]: SSL error status: error:0906D06C:PEM routines:PEM_read_bio:no start line Sep 21 14:32:35 ross1 imapd[11431]: SSL error status: error:140DC009:SSL routines:SSL_CTX_use_certificate_chain_file:PEM lib Where is the signing of the certs in the instructions? What is this error? Aubrey King Global Crossing, Ltd. IP Systems Engineering Systems Administrator

1 0

startup and shutdown
by Sébastien V 21 Sep '04

21 Sep '04

hi, I made a small shell script(firewall) and i want to launch this script when suse linux boot and shut down this script when i close suse linux. how can i do that? best regards sebastien _________________________________________________________________ MSN Search, le moteur de recherche qui pense comme vous ! http://search.msn.fr/worldwide.asp

5 4

Re: [suse-security] SELinux
by Marc Samendinger 21 Sep '04

21 Sep '04

On Tue, Sep 21, 2004 at 02:40:11PM +0200, suse(a)bortal.de wrote: > > I have not started the forensics on this box. Pulled it offline and > > left it running until I can get to it. > > You left it "running" ? If you leave your system running you can examine the content that is loaded in memory. > > > > I suspect, but cannot confirm, that it was via SSHv1 that I > > inadvertantly left enabled in webmin. > > > > SuSE want the HD image? > > I doubt it...it's not SuSE`s fault anyway :) No doubt about that, but maybe they want to play around with it? I'd ask your local honeynet project, I bet they'll be interessted in it. marc

2 1

SELinux
by Jophn Deo 21 Sep '04

21 Sep '04

Hello, I would like to know if SuSE has plans to integrate SELinux in YAST.For example with the other security setting ,easy local . ....paranoid local. Would be revolutionair if SuSE had a GUI interface in YAST to SELinux. Dreams are deceptive. My question is: Are there specific SuSE SELinux howto's or other documents regarding SELinux on SuSE 9.1 ? 1)Do i have to recompile the kernel 2)Is SELinux policy implementing ready on SuSE 9.1 ? 3)Are there SuSE 9.1 policy examples? kind regards, Jophn Deo

4 4