February 2005 - openSUSE Security - openSUSE Mailing Lists

SSH attacks.
by Bruce Smith 04 Feb '05

04 Feb '05

I'm sure most people have seen tons of invalid SSH login attempts by some fairly new cracking program that guesses userid's and passwords. The problem is getting worse and more frequent. I was wondering if there is any way to configure SSH to block an IP after a certain number of invalid logins, for a certain amount of time. (i.e. after 5 bad logins, block the IP for a hour). Or maybe there is a IDS that can do that? I looked at snort and can't find anything about SSH. BTW, I'm aware of other ways to make SSH more secure, like not allowing password authentication and only allowing RSA/DSA keys, changing the port SSH listens on, port knocking, etc. I just thought that automatic IP blocking, like I ask about above, would be a good idea under some circumstances. - BS

4 5

Re: [suse-security] SSH attacks.
by Michael Weber 04 Feb '05

04 Feb '05

Swatch is your friend! It watches log files in real time (within a second or two, anyway) and reacts just like you want. Have it watch the security log file for failed attempts from a single IP and run an IPTABLES command when a count is reached within a certain time period. -Michael >>> Bruce Smith <blubdog(a)gmail.com> 02/03 9:09 AM >>> I'm sure most people have seen tons of invalid SSH login attempts by some fairly new cracking program that guesses userid's and passwords. The problem is getting worse and more frequent. I was wondering if there is any way to configure SSH to block an IP after a certain number of invalid logins, for a certain amount of time. (i.e. after 5 bad logins, block the IP for a hour). Or maybe there is a IDS that can do that? I looked at snort and can't find anything about SSH. BTW, I'm aware of other ways to make SSH more secure, like not allowing password authentication and only allowing RSA/DSA keys, changing the port SSH listens on, port knocking, etc. I just thought that automatic IP blocking, like I ask about above, would be a good idea under some circumstances. - BS -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here CONFIDENTIALITY NOTICE: This communication and any attached or enclosed files may contain information that is privileged, confidential, proprietary and/or otherwise protected from disclosure under applicable law ("Confidential Information"). Any review, retransmission, publication, dissemination, distribution, forwarding, printing, copying, storing, saving or other use or disclosure of this communication and/or the Confidential Information, or taking any action in reliance thereon, by an individual or entity other than the intended recipient(s) is strictly prohibited. This communication and the Confidential Information are intended solely for the use of the individual(s) and/or entity(ies) to which this communication is addressed. If you are not the intended recipient(s) (or responsible for delivery to said recipient(s)), please be advised that you have received this communication in error and have an obligation to promptly inform the sender by reply e-mail or facsimile and to permanently delete, shred or otherwise destroy, in its entirety, this original communication and all copies thereof, whether in electronic or hard copy format.

2 1

Recent Clamav Security Update for 9.1 & 9.2
by Scott Leighton 03 Feb '05

03 Feb '05

I have a 9.2 system at home and a 9.1 at work, both were updated this week with a YOU update that referenced a security update for Clamav. From the description in YOU, I was left with the distinct impression that Clamav was going to be updated to the latest release, yet, my logs indicate that Clamav is still complaining about be out of date... ClamAV update process started at Mon Jan 31 18:48:19 2005 WARNING: Your ClamAV installation is OUTDATED - please update immediately! WARNING: Local version: 0.80 Recommended version: 0.81 main.cvd is up to date (version: 29, sigs: 29086, f-level: 3, builder: tomek) daily.cvd is up to date (version: 694, sigs: 979, f-level: 4, builder: ccordes) WARNING: Your ClamAV installation is OUTDATED - please update immediately! WARNING: Current functionality level = 3, required = 4 So, if the recent YOU update didn't bring it up to version 0.81, what _did_ it do? Scott -- POPFile, the OpenSource EMail Classifier http://popfile.sourceforge.net/ Linux 2.6.8-24.11-default x86_64

4 4

iptables -m string
by Dave Lists 03 Feb '05

03 Feb '05

Hi, As I am using packages where ever possible, is it possible to get a package that will enable iptables to be used with the -m string option? Dave.

1 0

PAM - passwords with numbers and upper case letters
by oxielc＠yahoo.it 01 Feb '05

01 Feb '05

Hello Gurus: SuSE 9.2 Pro. I need to make that my users put at least 1 number and 1 upper case letter in their 8 characters long passwords's. I've read all the docs, readmes and mans, and searched google for examples, follow them, it should be working already but not clue why not. My files are: /etc/security/pam_pwcheck.conf : password: minlen=8 cracklib nullok blowfish debug remember=12 /etc/security/pam_unix2.conf : auth: account: password: session: none /etc/default/passwd: CRYPT=blowfish CRYPT_FILES=blowfish BLOWFISH_CRYPT_FILES=10 CRYPT_YP=des /etc/pam.d/passwd : #%PAM-1.0 auth required pam_unix2.so nullok account required pam_unix2.so password required pam_cracklib.so retry=3 debug ucredit=-1 dcredit=-1 ocredit=0 lcredit=0 minlen=8 password required pam_pwcheck.so use_authtok password required pam_unix2.so use_first_pass use_authtok session required pam_unix2.so Best Regards Oxiel ______________________________________________________________________ Yahoo! Mail: 6MB di spazio gratuito, 30MB per i tuoi allegati, l'antivirus, il filtro Anti-spam http://it.yahoo.com/mail_it/foot/?http://it.mail.yahoo.com/

1 1

AW: [suse-security] ClamAv 0.80 -> 0.81?
by Dörfler Andreas 01 Feb '05

01 Feb '05

hello andrew, hello list, scott leighton asked that 6 hours ago ;) [suse-security] Recent Clamav Security Update for 9.1 & 9.2 zlib 1.2.2 is needed for the update (i compile clamav from source). anyone knows if there is a zlib 1.2.2 rpm for suse 9.2 ? didnt find a file at suse-ftp´s and rpm-find and the 1.2.1 got a old security hole. greetings andy >-----Ursprüngliche Nachricht----- >Von: Andrew [mailto:andrew2005@ledge.co.za] >Gesendet: Dienstag, 1. Februar 2005 09:54 >An: suse-security(a)suse.com >Betreff: [suse-security] ClamAv 0.80 -> 0.81? > > >Hello list > >I read that Mandrake has issued a security notice for ClamAV - >handling of base64 embedded images and zip Denial of service. >Is SuSE going to have a similar update? (And if not, is there >a recommendation on updating by some other means.) > >ClamAV's freshclam is complaining about being out of date - >presumably because of these reasons. > >susesvr:~ # online_update -V >Types of patches to be installed: security recommended >patchlevel Server URL: >ftp://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse >Server Name: Germany: GWD GÃ¶ttingen (ftp) >Directory File: >Path 0: ./i386/update/9.1/patches >No patches have been installed. > >susesvr:~ # freshclam >ClamAV update process started at Tue Feb 1 10:51:18 2005 >WARNING: Your ClamAV installation is OUTDATED - please update >immediately! >WARNING: Local version: 0.80 Recommended version: 0.81 >main.cvd is up to date (version: 29, sigs: 29086, f-level: 3, >builder: tomek) daily.cvd is up to date (version: 694, sigs: >979, f-level: 4, builder: ccordes) >WARNING: Your ClamAV installation is OUTDATED - please update >immediately! >WARNING: Current functionality level = 3, required = 4 > >susesvr:~ # cat /etc/*release >SuSE Linux 9.1 (i586) >VERSION = 9.1 > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here >

2 1

RE: [suse-security] Basics needed: receive mail but mail headercontains no 'for'
by Preusse, Mathias 01 Feb '05

01 Feb '05

Hi Miguel, > From: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] > Sent: Monday, January 31, 2005 10:29 AM > > On Mon, 2005-01-31 at 10:02, Preusse, Mathias wrote: > > The mail header, so i can see it with outlook, seems to be broken. > > Example: > > > > Microsoft Mail Internet Headers Version 2.0 > > Received: from our.mailgateway.de ([a.b.c.d]) by > internal.mailserver.de with Microsoft SMTPSVC(5.0.2195.5329); > > Mon, 31 Jan 2005 01:38:49 +0100 > > Received: from egan.earth9.com ([207.254.32.6]) > > by citation.freezemail.com > > (InterMail vK.4.04.00.00 781-3[3 > > > > This mail goes direktly to a user, not to a postbox for unknown user. > > It contains no 'for' or message id. > > I know, that any Mail header could be manipulated, but i thougt, > > there must be at last a target user (for) to sort it in a available postbox. > > Can you see/post the mail source in Outlook ? It's an empty mail. No from, no to, no cc, no subject, no body. Only this header from outlook options view like i posted. Last Source is changing in every mail (faked). But i think, it is not the last, the header seems to be cutted.

1 0

ClamAv 0.80 -> 0.81?
by Andrew 01 Feb '05

01 Feb '05

Hello list I read that Mandrake has issued a security notice for ClamAV - handling of base64 embedded images and zip Denial of service. Is SuSE going to have a similar update? (And if not, is there a recommendation on updating by some other means.) ClamAV's freshclam is complaining about being out of date - presumably because of these reasons. susesvr:~ # online_update -V Types of patches to be installed: security recommended patchlevel Server URL: ftp://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse Server Name: Germany: GWD GÃ¶ttingen (ftp) Directory File: Path 0: ./i386/update/9.1/patches No patches have been installed. susesvr:~ # freshclam ClamAV update process started at Tue Feb 1 10:51:18 2005 WARNING: Your ClamAV installation is OUTDATED - please update immediately! WARNING: Local version: 0.80 Recommended version: 0.81 main.cvd is up to date (version: 29, sigs: 29086, f-level: 3, builder: tomek) daily.cvd is up to date (version: 694, sigs: 979, f-level: 4, builder: ccordes) WARNING: Your ClamAV installation is OUTDATED - please update immediately! WARNING: Current functionality level = 3, required = 4 susesvr:~ # cat /etc/*release SuSE Linux 9.1 (i586) VERSION = 9.1

1 0

RE: [suse-security] Basics needed: receive mail but mail header contains no 'for'
by Preusse, Mathias 01 Feb '05

01 Feb '05

Hi Tom, > From: Thomas Knight [mailto:thomas.knight@ahds.ac.uk] > Sent: Monday, January 31, 2005 11:09 AM > > > From: Preusse, Mathias [mailto:Mathias.Preusse@ProACTIV.de] > > Sent: 31 January 2005 09:02 > > The mail header, so i can see it with outlook, seems to be broken. > > Example: > > > > Microsoft Mail Internet Headers Version 2.0 > > Received: from our.mailgateway.de ([a.b.c.d]) by > > internal.mailserver.de with Microsoft SMTPSVC(5.0.2195.5329); > > Mon, 31 Jan 2005 01:38:49 +0100 > > Received: from egan.earth9.com ([207.254.32.6]) > > by citation.freezemail.com > > (InterMail vK.4.04.00.00 781-3[3 > > > Is this the entire header as shown in "View -> Options"? yes. Exact copy & paste from view.

1 0

vpnd error codes
by Miguel Albuquerque 01 Feb '05

01 Feb '05

does anybody know what means "peer link failed, reason=2" in a vpnd connection ? I've being googling for a while but no success... any hints ? -- ______________________________________________________________ «¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»«¤»¥«¤»§«¤»¥«¤» ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ CODALIS SA www.codalis.ch 17, rue de la Fontenette, CAROUGE TEL : +41 22 827 30 30 FAX : +41 22 827 30 33 ______________________________________________________________ «¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»«¤»¥«¤»§«¤»¥«¤» ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

1 0