October 2005 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Strange log entries
by Mitch Thompson 07 Oct '05

07 Oct '05

On Thursday 06 October 2005 16:31, Lyle Giese wrote: > Yea, ok that answers the question about what treason uncloaked is, but > doens't give me any answers about why klogd seemed to restart or is this > the kernal's way of handing this issue? > > Lyle > Ok, look at "man klogd" and do a search for "state". Near the end, there is a section on "Signal Handling". Read that section. The paragraph that starts with "Provided that..." will give you the next piece of the puzzle: it will tell you why klogd restarted. Mitch

1 0

RE: [suse-security] account lockout after x incorrect attempts???
by Baenen Eric P Contr AFRL/HEC 06 Oct '05

06 Oct '05

I agree whole-heartedly with your point - it is a stupid, useless measure that leaves us open for major denial of service attacks... And I have stated this to 'upper IS management' - however we have been given no choice - it is 'corporate' policy - policy as usual, made by people who don't understand the technology -- and as usual, we have to live with the consequences. The SUSE secure alternative of login delays (ours set to 20 seconds) quite effectively deters brute force attacks and logging of failed login attempts with notification gives us indications when "something isn't right" - but unfortunately we don't have a say in the matter. Thanks, Eric > > We have a number of SUSE 9.x workstations - and recently we've been > > mandated to have them adhere to a corporate IT security policy that > > requires account lockout after a certain number of incorrect login > > attempts. > > > > .... > > Look for this under Bone-Headed Security. > > Imagine this policy is successfully implemented. Then > *anyone* could lock anyone else out of their account (aka a > DOS) simply by trying to log into it. This policy opens the > door to all kinds of mischief. It would even worse if it's > going to be used to log in from the internet. > Then you might as well give Al Qaida an on/off switch to your > email system. > > > hth, > korporal ken, civilian

3 2

Susefirewall2 rdp access nightmare
by Chadley Wilson 06 Oct '05

06 Oct '05

Greetings, could some one please assist me here, I need to open a port on our firewall for rdp port 3389 I have added the port number to allowed service on the external zone under advanced. We still can't rdp remote machines on the internet. We also have a machine internally which must be accessable from internet. How can I do this on Susefirewall2, I canpost you my iptables-save if you need it! TIA -- -- Chadley Wilson Production Line Superintendant Pinnacle Micro Manufacturers of Proline Computers ==================================== Exercise freedom, Use LINUX =====================================

2 3

Re: [suse-security] Susefirewall2 rdp access nightmare
by Polarizer 06 Oct '05

06 Oct '05

Try to examine the packet flow with some logging rules on the gate. [1]iptables -I INPUT --jump LOG -p tcp --dport 3389 [2]iptables -I INPUT --jump LOG -p tcp --sport 3389 [3]iptables -I OUTPUT --jump LOG -p tcp --dport 3389 [4]iptables -I OUTPUT --jump LOG -p tcp --sport 3389 intranet|dmz --- [1][4] gate|firewall [3][2] ---- internet|ext.rdp And yes, it's a good idea to put your rdp-server into the dmz! the polarizer http://www.codixx.de/polarizer.html

2 1

Strange log entries
by Lyle Giese 06 Oct '05

06 Oct '05

I have a machine running SuSE v8.2 pro running Apache v2.0.54(installed from Apache source) and found this in the logs this morning: Oct 5 19:38:43 linux2 kernel: TCP: Treason uncloaked! Peer 211.136.182.106:46312/80 shrinks window 3980592615:3980594075. Repaired. Oct 5 19:38:43 linux2 kernel: klogd 1.4.1, ---------- state change ---------- Oct 5 19:38:43 linux2 kernel: Inspecting /boot/System.map-2.4.20-64GB-SMP Oct 5 19:38:43 linux2 kernel: Loaded 21295 symbols from /boot/System.map-2.4.20-64GB-SMP. Oct 5 19:38:43 linux2 kernel: Symbols match kernel version 2.4.20. Oct 5 19:38:43 linux2 kernel: Loaded 1624 symbols from 31 modules. Oct 5 19:38:44 linux2 kernel: TCP: Treason uncloaked! Peer 211.136.182.106:46312/80 shrinks window 3980592615:3980594075. Repaired. Oct 5 19:38:46 linux2 kernel: TCP: Treason uncloaked! Peer 211.136.182.106:46312/80 shrinks window 3980592615:3980594075. Repaired. Not sure what this means. When I found these this morning, I went snooping on the system. rkhunter and chkrootkit show nothing unusual. I don't see anything unusual anywhere except netstat showed a bunch of connects to tcp port 22 from 218.103.185.218 in TimeWait state. They went away after I restarted NCFTPD(yes, I am using a third party ftp server) a couple of times. Not sure if these are related or if someone was trying a DoS attack on ftp. Thanks for any insight on these two issues. Lyle Giese LCR Computer Services, Inc.

3 2

Re: [suse-security] Strange log entries
by m3047＠inwa.net 06 Oct '05

06 Oct '05

I'm going to speak out of turn based on some knowledge of TCP, and without looking at the source to determine what actually triggers the messages (you could, perhaps should, do that). Both peers in a TCP connection advertise a window size to the other peer, which is the buffer available to the other end. This does float up and down as the sender sends data and the receiver pulls it out of the buffer. (There is some interesting stuff in the RFCs about zero windows and silly windows, if you care to read.) A peer is not required to immediately advertise a larger size window. However, the one thing a peer is never supposed to do is to advertize a certain window size and then subsequently advertise a window size which is less than ((previously advertised size) - (data received)). (There is also some disparagement of the use of RST to refuse a connection, FWIW. If you've played much with printers and such you know what I'm talking about.) I don't recall the use of "treason" in the RFCs in this context, although there is an amusing suggestion in one of the RFCs for DNS about shooting people... At 9:38 AM 10/6/05, Lyle Giese wrote: >I have a machine running SuSE v8.2 pro running Apache v2.0.54(installed >from Apache source) and found this in the logs this morning: > > >Oct 5 19:38:43 linux2 kernel: TCP: Treason uncloaked! Peer >211.136.182.106:46312/80 shrinks window 3980592615:3980594075. Repaired. >[...] -- Fred Morris http://www.inwa.net/~m3047/contact.html

2 1

SuSEFirewall2 weblogger
by Bruno Cochofel 05 Oct '05

05 Oct '05

> > >Must have to do with the conversion function for month short names from >locale at the beginning of the script > I managed to find that SuSEFirewall2 doesn't respect the locale definitions of the system, so the function for retrieving abbreviated month names from Portuguese (I'm from Portugal) to numbers didn't work. In /var/log/firewall month names come in English. So I did the following: # get the short name of months according to the locale # thanks to Bill Garrett <memesis at users.sourceforge.net> #my(%m); #my($month_nb); #for $month_nb (0..11) { # $m{strftime("%b", 0, 0, 0, 1, $month_nb, 96)}=sprintf("%02d",$month_nb+1); #} #my($key); #foreach $key (keys %m) { # print $key,"-",$m{$key},"\n"; #} # hash para os meses do ano my(%m); %m = ('Jan' => 1, 'Feb' => 2, 'Mar' => 3, 'Abr' => 4, 'May' => 5, 'Jun' => 6, 'Jul' => 7, 'Aug' => 8, 'Set' => 9, 'Oct' => 10, 'Nov' => 11, 'Dez' => 12); Please correct me for the abbrev. names. Bruno

2 1

Two questions about hosts.allow and sshd
by Selena Kyle 05 Oct '05

05 Oct '05

Hello! I've actually never subscribed, because anytime I had a question, I could just google and find it already asked by somebody else at some point, and read the answers there. Unfortunately, that's no longer the case. at least with this inquiry.. Alright, before I ask the question, here's the background information. About Me: - I'm using SuSE 9.3, and I've updated using all of the most recent security patches. - I'm a newbie to linux as an Admin, but I've been a light user for a couple of years - I understand programming better than I do networking (I know enough to pass Network +, but don't have much working knowledge .... yet) About My Machine: - There are two IP addresses (which are actually the same computer) that I currently interact with on a a regular basis. x.x.x.98 and x.x.x.64 (the x's are in the place of numbers to mask the actual computer). If you run a traceroute to either IP, it'll resolve to domain.ext, but if you do a reverse lookup of domain.ext, it'll always come up with only one of the IPs. As a result, the following appears in my /var/log/messages: Oct 4 02:51:25 localhost sshd: warning: /etc/hosts.allow, line 67: can't verify hostname: getaddrinfo(domain.ext) didn't return ::ffff:x.x.x.98 Oct 4 02:51:27 localhost sshd[13932]: Address x.x.x.98 maps to domain.ext, but this does not map back to the address - POSSIBLE BREAKIN ATTEMPT! - Now, obviously this means that if I set a line in hosts.allow for ALL : .domain.ext : PARANOID, it denies it because my system is paranoid and thinks this is a spoofed domain. I currently have both IP addresses in my allow list, so I can at least login from this server (it's a friend's server, and I have no power to modify his DNS settings). And On With The Question: WITHOUT telling sshd to stop warning me when it can't resolve an domain to who it claims to be (because I like that it does that!), how can I essentially tell it "If domain.ext resolves to this ip or this other ip, don't warn and just act like everything's normal" ? Both IP addresses are static. I am *NOT* the administrator of the machine, so I can't dig through his DNS settings to figure out why his domain is assigned to two IPs to begin with, and I can't get it to report the "official" IP when making connects to my box. I know the easy answer is to just "ignore those lines in the logs", but I get a LOT of traffic from that server, so it really does cause a clog issue when I do a cat /var/log/messages | grep Oct 04 , or something similar. And no, I don't use a log analyzing program yet -- I'm still trying to learn about security, and I believe that understanding the raw files on practical level FIRST is important before expecting any script or program to analyze them for me (plus I just prefer the command line most of the time anyway). Any and all responses greatly appreciated. :-) (And for bonus points, not nearly as important because it still functions from a security standpoint, but I'm a girl so I'm annoyed that it doesn't LOOK how I want it to! *laughs*) How come the following line in hosts.deny works and displays a message to the attempted incoming user: in.telnetd: ALL: twist /bin/echo -e "Shoo!" but this one doesn't sshd: ALL: twist /bin/echo "Shoo!"

2 1

Re: [suse-security] Two questions about hosts.allow and sshd
by Polarizer 05 Oct '05

05 Oct '05

Simply put both ip/domain entries in your /etc/hosts and ensure that search order in /etc/nsswitch.conf is set to "hosts: files dns" > sshd: ALL: twist /bin/echo "Shoo!" I think you dont want to do that. It'll revoke ssh session. Mayby it is overlayed by an entry in hosts.allow?! Try man sshd and search for /etc/motd to send user a message on login. Check too: man sshd_config (search usedns) Hope that helps The polarizers 2cent http://www.codixx.de/polarizer.html

2 1

account lockout after x incorrect attempts???
by Baenen Eric P Contr AFRL/HEC 05 Oct '05

05 Oct '05

Hello, We have a number of SUSE 9.x workstations - and recently we've been mandated to have them adhere to a corporate IT security policy that requires account lockout after a certain number of incorrect login attempts. Has anyone ever worked with a solution for this for SUSE 9.x? a pam module perhaps? an LDAP based solution? At this point we're looking for any solution - commercial or open source. Thanks, Eric Eric Baenen Project Manager - Scientific Network Environments General Dynamics - Advanced Information Systems Phone: 937-255-8180 FAX: 937-255-8845 2255 H Street (AFRL/HEC) Area B Bldg 248 Rm 108 Wright Patterson AFB, OH 45433

3 2