October 2005 - openSUSE Security - openSUSE Mailing Lists

keywords: amavisd-new, X-Headers.
by suse-list 31 Oct '05

31 Oct '05

I have mailserver based on SuSE 9.3, with amavisd-new. All works fine except the line, added by amavisd to e-mails. > X-Virus-Scanned: by amavisd-new at Relay2.suse.de > Subject: [suse-sles-e] Remounting NFS share: unknown mount option v3 > X-Virus-Scanned: amavisd-new at my.domain.tld <<<<- this line I want a line like X-Virus-Scanned: amavisd-new at mail.my.domain.tld $mydomain in amavisd.conf is not the solution, so what is parm controllin this X-Header? Only way i see is redefine some vars in amavisd perl code. And by the way default install of SuSE 9.3 with postfix and amavisd-new do not allow attachments of some MS-like files - .exe's and so on. Even if you mv 1.exe to 1_exe, file (n) utility detects ms-pe executable. Any thoughts?

3 2

Under DDoS Attack
by media Formel4 31 Oct '05

31 Oct '05

Hi list, sorry for the double-post but my thread opener was in reply to another post which confuses the mailinglist structure... #################################################################### Hi list, right now we're experiencing a (for me) very uncommon DDoS attack against one of our webservers. Looking with netstat we find hundreds of established connections to our Apache webserver, but nothing in the logs - which means the attacker opens up a connection (not only a SYN request as in SYN flood attacks) and then blocks the Apache child until it hits timeout. This attack comes from thousands of IP numbers (bots?) all over the world. Question is: - Is it possible with spoofed IP numbers to establish connections to port 80? As far as I know you should get stuck after "SYN". I'm asking that, because tracing back the IPs in question I find very often unrouted areas and non-reachable (but maybe firewalled) IPs. Also I found a group of 300 IPs coming from an american company network. I contacted them and they stated too, that those IPs were not in use and not routed right now... - How can I secure this server and/or stop this attack? Thanks, Ralf Koch

11 13

Re: [suse-security] Under DDoS Attack
by Timothy Hall 30 Oct '05

30 Oct '05

Another suggestion... "I don't think that works out. Whenever I might send a FIN - what prevents my Apache from being attacked from the same bot after seconds again?" You mentioned that it happening from the same bot(s) again and again... Am I wrong? If you are able to produce a list using netstat and output it into a text file, you may then be able to narrow down networks from which the attack is originating. Afterwards, you can contact your upstream ISP and they will be more than happy to block the rogue traffic from reaching your network. They are quite happy to work with folks on things such as this as very often the traffic also effects others that they host services for by simply 'busying' things up with useless traffic... good luck!!! >>> Syv Ritch <suse(a)911networks.com> 10/27/05 12:51 PM >>> media Formel4 wrote: > - Is it possible with spoofed IP numbers to establish connections to > port 80? As far as I know you should get stuck after "SYN". > I'm asking that, because tracing back the IPs in question I find very > often unrouted areas and non-reachable (but maybe firewalled) IPs. > > Also I found a group of 300 IPs coming from an american company network. > I contacted them and they stated too, that those IPs were not in use and > not routed right now... > > > > - How can I secure this server and/or stop this attack? I think that you are looking at wrong point. Preventing a DDOS is not the job of the web server, but the job of the router/firewall. "Real routers/firewalls" will deal easily with these problems. - No spoofing of IPs through validation where the packet comes from... - No fragmented packets - Limit the number of open/unfinished connections... Cisco Pix 501, 515... depending on size and volumes Cisco 1811... Not cheap but when configured properly, guaranteed to work. -- Thanks http://www.911networks.com When the network has to work Cisco/Microsoft -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

8 10

Re: [suse-security] Under DDoS Attack
by Timothy Hall 28 Oct '05

28 Oct '05

i have heard of organizations/providers doing that. i have even had them DO IT. it depends on how many locations the DDoS bots are attacking from, are they on a certain AS (look up autonomous system if you don't know what an AS is, traceroute.org also has listings of various ASs by country) or from domains/IP blocks that will not excessively restrict access to the resource being hosted... this will work with blocks of IPs under the control of a certain authority, but again, it depends on how many places it is coming from. for example if your site is in X language and the attacks are coming from ASs from areas where Y language is generaly spoken, it may well be that your upstream provider/organization can block the address blocks (or some of them) and get rid of the load without seriously impacting the service you offer anymore than it already has been. there are also documented cases of universities and companies having some success with such a method. does this mean it will work in EVERY circumstance? no. sometimes the only way is to move services to another IP and sometimes that isn't practical either. >>> Allen <gorebofh(a)comcast.net> 10/27/05 23:14 PM >>> On Thu, Oct 27, 2005 at 11:59:54PM +0200, b@rry wrote: > >As I said - its a root server. Nothing in front but the pure internet... > > > > Why not have a firewall in front of it? Root server or no, something that > can manage the connections to the box with relatively low connection > timeouts? Maybe just maybe, because a firewall isn't going to do a THING against a DDOS attack? And for the other person who said call the ISP so they can "set the router to block the packets"..... Lol, if it was hat easy Yahoo, Microsoft and SCO wouldn't have been taken down. -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Under DDoS Attack
by Timothy Hall 27 Oct '05

27 Oct '05

Owie... >>> Markus Roth <mroth(a)netlabs.ch> 10/27/05 12:07 PM >>> Timothy Hall wrote: >Hello! > >http://www.nuclearelephant.com/projects/mod_evasive/ > >You may try this when you get a chance... It very well may help prevent >it from happening in the future... > > > if i remember it right, this just works when actual request are sent, which is not the case. bad luck >Let me know how it goes... > >tele2win > > > >>>>media Formel4 <info(a)formel4.de> 10/27/05 11:40 AM >>> >>>> >>>> >Markus Roth schrieb: > > >>media Formel4 wrote: >> >> >> >>>Question is: >>> >>>- Is it possible with spoofed IP numbers to establish connections to >>>port 80? As far as I know you should get stuck after "SYN". >>> I'm asking that, because tracing back the IPs in question I find >>>very often unrouted areas and non-reachable (but maybe firewalled) >>> >>> >IPs. > > >>i would say no (else the school was pretty useless ;-) >> >> > >"There are more things in heaven and earth, Horatio, then are drempt of >in your philosophy." > >Maybe you can send a spoofed SYN followed by a (or a dozen?) spoofed ACK > >where you "guess" the correct seq_num/ack_num? I'm not sure if this is >not possible... > > > >>>- How can I secure this server and/or stop this attack? >>> >>> >>this attack is very mean and it succeeds almost always (even if you >> >> >just > > >>do it from a single attacking machine). >>i would do a search on google, there are definitively others who were >>under the same sort of attack. >> >> > >All Ideas they produce is something like "Change the IP" - which is IMHO > >not a good solution, because not everything on that server is hostname >driven... > > > >>just some thoughts about how it could be possible to protect (at least >> >> >a > > >>bit). maybe it's possible to let netfilters connection tracking do the >> >> > > > >>work for you. if you got it installed on your machine just enable it >> >> >(by > > >>writing a simple rule, something like "iptables -A INPUT -p tcp >> >> >--dport > > >>80 --state NEW,ESTABLISHED -j ACCEPT") and then set the size of the >>connection table to some small number (check google how to do it). the >> >> > > > >>idea behind it is, that i assume (i didn't try it or investigated in >>it!!) that the connection tracking will always drop the connection >> >> >that > > >>was the longest non active and so the connections that send something >>should be kept alive and the "just open" sessions would be dropped. >> >> >if > > >>you set the number to 100 or something, the backend httpd process >> >> >should > > >>be protected (maybe). but take care that connection tracking doesn't >>lock you out as it is used on all connection (not just the one you >> >> >write > > >>a rule for) >> >> > >That might be worth a thought. Right now I've got a script running >checking the web server and when MaxClients is reached for more then 20 >seconds, all IPs are collected and every IP that was more then 5 times >in that collection get blocked. I've got now a list of more then 4700 >IPs blocked and the attack is still going on... > > > >>good luck >> >> > >Thanks, guess I need it... > >Ralf Koch > > >

1 0

Re: [suse-security] Under DDoS Attack
by Timothy Hall 27 Oct '05

27 Oct '05

Hello! http://www.nuclearelephant.com/projects/mod_evasive/ You may try this when you get a chance... It very well may help prevent it from happening in the future... Let me know how it goes... tele2win >>> media Formel4 <info(a)formel4.de> 10/27/05 11:40 AM >>> Markus Roth schrieb: > media Formel4 wrote: > >> Question is: >> >> - Is it possible with spoofed IP numbers to establish connections to >> port 80? As far as I know you should get stuck after "SYN". >> I'm asking that, because tracing back the IPs in question I find >> very often unrouted areas and non-reachable (but maybe firewalled) IPs. > > > i would say no (else the school was pretty useless ;-) "There are more things in heaven and earth, Horatio, then are drempt of in your philosophy." Maybe you can send a spoofed SYN followed by a (or a dozen?) spoofed ACK where you "guess" the correct seq_num/ack_num? I'm not sure if this is not possible... > >> >> - How can I secure this server and/or stop this attack? > > > this attack is very mean and it succeeds almost always (even if you just > do it from a single attacking machine). > i would do a search on google, there are definitively others who were > under the same sort of attack. All Ideas they produce is something like "Change the IP" - which is IMHO not a good solution, because not everything on that server is hostname driven... > > just some thoughts about how it could be possible to protect (at least a > bit). maybe it's possible to let netfilters connection tracking do the > work for you. if you got it installed on your machine just enable it (by > writing a simple rule, something like "iptables -A INPUT -p tcp --dport > 80 --state NEW,ESTABLISHED -j ACCEPT") and then set the size of the > connection table to some small number (check google how to do it). the > idea behind it is, that i assume (i didn't try it or investigated in > it!!) that the connection tracking will always drop the connection that > was the longest non active and so the connections that send something > should be kept alive and the "just open" sessions would be dropped. if > you set the number to 100 or something, the backend httpd process should > be protected (maybe). but take care that connection tracking doesn't > lock you out as it is used on all connection (not just the one you write > a rule for) That might be worth a thought. Right now I've got a script running checking the web server and when MaxClients is reached for more then 20 seconds, all IPs are collected and every IP that was more then 5 times in that collection get blocked. I've got now a list of more then 4700 IPs blocked and the attack is still going on... > good luck Thanks, guess I need it... Ralf Koch -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

RE: [suse-security] wildcard for reverse proxy via apache ?
by Dörfler Andreas 27 Oct '05

27 Oct '05

hi there, of corse i tried that, its basic ;), but it doesnt work greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ > > -----Original Message----- > From: Alexander.Kessinger(a)HelvetiaPatria.ch > [mailto:Alexander.Kessinger@... > Sent: Tuesday, October 25, 2005 12:05 PM > To: Dörfler Andreas > Cc: suse-security(a)suse.com > Subject: RE: [suse-security] wildcard for reverse proxy via apache ? > > > > Yes sure, stupid :%~ > Then you certainly have tried do work with the asterisk after the / ? > > e.g. ProxyPass /* http://111.111.111.111/ > ProxyPassReverse /* http://111.111.111.111/ > ProxyPass /www/* http://111.111.111.111/ > ProxyPassReverse /www/* http://111.111.111.111/ > > Greetz > Alex >

4 4

Re: [suse-security] Under DDoS Attack...
by media Formel4 27 Oct '05

27 Oct '05

e.mueller schrieb: > >> >> - How can I secure this server and/or stop this attack? > > > Are you sure it is an attack in the first place? I would try to look in > the connects first with tcpdump to distinguish between your webserver > being mentioned on for example slashdot or heise and an DDOS attack ... That is what I did. Checking with strace and tcpdump shows, that after opening the connection there is no data transmitted until the Apache process times out. Also: If it is a huge mass of regular connections, you should get at least notifications in the access_log. Thanks, Ralf

1 0

Re: [suse-security] Proxyconfig over Yast
by Wade Grant 26 Oct '05

26 Oct '05

I think /usr/etc/passwd Good luck. wade G. "Privilege becomes arrogance. Arrogance promotes injustice. The seed of ruin blossom." Frank Herbert. 1984. God Emperor of Dune. >>> "Vornberger Achim" <achim.vornberger(a)eon-is.com> 10/26/05 08:43AM >>> Hi! Who can tell me where yast stores the information about the proxy user authentification (proxy user name / proxy password)? Yast => Network Services => Proxy With kind regards / Mit freundlichen Grüßen Achim Vornberger OPOO / Systemadministration T + 49 931 300-1029 F + 49 931 300-1519 achim.vornberger(a)eon-is.com E.ON IS GmbH Bismarckstrasse 9 - 11 D-97080 Würzburg www.eon-is.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Proxyconfig over Yast
by Vornberger Achim 26 Oct '05

26 Oct '05

Hi! Who can tell me where yast stores the information about the proxy user authentification (proxy user name / proxy password)? Yast => Network Services => Proxy With kind regards / Mit freundlichen Grüßen Achim Vornberger OPOO / Systemadministration T + 49 931 300-1029 F + 49 931 300-1519 achim.vornberger(a)eon-is.com E.ON IS GmbH Bismarckstrasse 9 - 11 D-97080 Würzburg www.eon-is.com

1 0