March 2005 - openSUSE Security - openSUSE Mailing Lists

installing newer software than that in the CDs
by John 01 Apr '05

01 Apr '05

Hello I tried to install the apache 2.0.53 from SUSE's rpm. I found them in SUSE's site. i installed these rpms (apache and other related with the 2.0.53 version packages like prefork, etc) I ran YOU and i surprising found that a patch was available for apache 2.0.53. Can this be true or not? Is there any patch for apache 2.0.53 ? One more issue. I tried to install php using Yast and the rpm from the CD. After having done the proper configuration for the php support, i tried to startapache 2.0.53 but it failed and gave me an error (in the error_log) Segmation Fault (pointed the line that php get loaded) What was wrong with that? Thanks in advance John

3 5

still have problems with "kernel: ip_conntrack: table full, dropping packet."
by Ralf Ronneburger 31 Mar '05

31 Mar '05

Hi everyone, I still get the error message "kernel: ip_conntrack: table full, dropping packet." on SuSE 9.0 with SuSEfirewall2 (all updates installed) about every 2-4 weeks (there was a discussion about this some month ago, but no solution...). The only thing that seems to help when this occurs is rebooting the machine (as far as I could figure). The machine does have some servers behind it and filters about 500MB of traffic average per day. Below are some informations about the error-messages and the configuration and the state of the server when the problem occurs: linux:~ # cat /var/log/messages | grep ip_ Feb 24 12:13:05 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:09 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:15 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:20 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:24 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:38 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:39 linux kernel: ip_conntrack: table full, dropping packet. Feb 24 12:13:56 linux kernel: ip_conntrack: table full, dropping packet. linux:~ # cat /proc/net/ip_conntrack | wc -l 1913 linux:~ # cat /proc/sys/net/ipv4/ip_conntrack_max 32760 linux:~ # iptables-save | wc -l 922 Does anybody have the same problem and hopefully a solution? Any ideas how I can at least find out, which packets are dropped? Greetings, Ralf

9 16

Firefox invocation allows unintended root access
by Phil Betts 31 Mar '05

31 Mar '05

This is possibly not a SuSE specific problem, but since the two systems involved are both running 9.2 Pro, and it's their integrity that's at stake, and since I've no idea what the underlying mechanism is, I thought I'd start here ;) The situation: PC1 - SuSE 9.2 Pro AMD32 PC2 - SuSE 9.2 Pro AMD64 Run Firefox as root@PC2 for browsing local files (the files are only readable by root). Still on PC2, run ssh -X to get a shell as normal-user@PC1. Start Evolution on PC1, opening on PC2's display. Click on an http link in an email. A Firefox window opens with the link displayed. By chance, I noticed that the Adblock extension was missing and I happened to click on the About menu. I was surprised to see that it claimed to be the x86_64 version. Further investigation revealed that Evolution had connected to the root-invoked Firefox on PC2, rather than starting a fresh instance by normal-user@PC1 displaying on PC2. Had I not noticed this, it would have been easy for me to enable java/javascript and installed plugins etc., in the belief that the browser was running as normal-user@PC1. Note that Evolution is an innocent party here, just starting Firefox directly from the ssh session produces the same effect. The reason for mentioning it is that a link in an email can be a seductive way to trap the unwitting user. Also note that the situation does not appear to occur if the remote connection is not involved. I.e. when root@PC2 runs Firefox, then user@PC2 starts Firefox, this results in 2 instances of Firefox. IMHO, Firefox should only connect with an already running instance if that instance was started by the same user on the same host. It is questionable whether normal-user@PC1 should even be aware of the existence of the root@PC2 instance. Phil

3 3

RE: [suse-security] Firefox invocation allows unintended rootaccess
by Jose_Thomas＠Dell.com 31 Mar '05

31 Mar '05

Looks this problem is directly inherited from the way how X works. SELinux will be the right way to solve this problem. Thanks Jose -----Original Message----- From: Phil Betts [mailto:phil_betts@ntlworld.com] Sent: Thursday, March 31, 2005 1:52 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Firefox invocation allows unintended rootaccess On Wed, 2005-03-30 at 11:27 +0200, Marcus Meissner wrote: > Your remote side can do even more things, like snooping or inserting > keyboard input into the main X session. > > If you are on the same X Server you have basically full user access. > Of course, but that's not what one expects of a browser whose reputation is built, at least partly, on security. If you invite your trustworthy neighbour in for a drink, you'd be pretty upset if he took control of the TV remote, emptied your fridge and rearranged the furniture! > > I do not see this is as a problem, but workin as intended. > Hmm, "as intended" != "correctly" (except perhaps in Redmond). If by "intended", you mean that there should only ever be one instance of firefox per X display, then firefox is broken, because two different users on the _same_ box start independent firefox instances, each with their own set of bookmarks, cookies, extensions etc. Why should this policy be different when running a firefox from a session on a second box? The fact remains that I clicked on a link in an email message as an unprivileged user on my web-facing machine, but found that I had connected to the web as root on a machine that normally only connects to the web for system updates. I would NEVER have connected to the web for any other purpose using my root account (on either box) by choice. If the link I had clicked was actually to a page containing some malicious exploit, I would have been completely stuffed. I can't believe that this is "as intended". Also, regardless of the security implications, if I start a session on a remote box and start firefox, I do this because I want THAT user's set of bookmarks etc., not those of some arbitrary user on a different machine. As it stands, the only way to achieve this is to shut down all prior instances of firefox first, which is neither intuitive, nor desirable. As I mentioned in my original post, I don't know the details of the underlying mechanism, as it involves the interaction of X, ssh and firefox. If you have more knowledge on this, I'll be happy to raise it with the most appropriate party. My guess would be the firefox developers, but for all I know, they may just be using some connect_to_existing_instance() routine in an independently written shared library, which could mean that many apps may be subject to the same problem. Phil -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Kernel updates+ATI drivers
by Maxim A Belushkin 30 Mar '05

30 Mar '05

Are there any plans to include the ATI drivers for X.org into the YaST graphics card selection? Alternatively, is there any way to force YaST to run a specific command after each kernel update? Every kernel update breaks the ATI drivers (expected), loosing 3D support and requiring a manual re-installation of the ATI rpm which builds the driver for the current kernel... Thanks in advance!

3 2

Securing data on disk - when disk taken out of computer ?
by Robert Rozman 30 Mar '05

30 Mar '05

Hi, I'm seeking for solution, that would let me ecrypt partition of file on disk, but be somehow automatically mounted on reboot (without prompting for password) , but still secured if someone takes disk out and tries to mount on another system... I'm newbie, so please be gentle - it could be impossible to achieve... How to do this? Can I somehow sign disk to be used/mounted only in certain HW and not on another HW ? If proof solution is not possible, could I at least automate mounting of encrypted file and give at least some problems to enyone that stoles disk and tries to mount it outside PC ? Thanks in advance, regards, Rob.

2 1

CAN-2004-1073 fixed by suse ?
by BoneMachine 30 Mar '05

30 Mar '05

Hi, I've noticed a message on the Full-Disclosure mailinglist. The message states that there is no fix supplied in the vanilla kernel and that there is probably no fix in vendor supplied kernels for the CAN-2004-1074 vulnerability. The message to FD can be found at the following link: http://archives.neohapsis.com/archives/fulldisclosure/2005-03/0820.html Can any of you guys confirm that SuSE is still vulnerable? TIA Bone Machine --- "I can hardly wait Betty" - The Pixies

3 2

Susefirewall2 detailed howto
by Valentin Holban 28 Mar '05

28 Mar '05

Hello. I have: Suse 9.1 kernel 2.6.5 Susefirewall2 I would like to know how to use FW_CUSTOMRULES in order to perform more detailed filtering. If there are any docs available, or online references, please point them to me. Thx, Vali.

1 0

Re: [suse-security-announce] SUSE Security Announcement: several kernel security problems (SUSE-SA:2005:018)
by Carlos E. R. 28 Mar '05

28 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2005-03-24 at 17:29 +0100, Marcus Meissner wrote: > SUSE Security Announcement > > Package: kernel > Announcement-ID: SUSE-SA:2005:018 > Date: Thu, 24 Mar 2005 15:00:00 +0000 > Affected products: 8.2, 9.0, 9.1, 9.2 > SUSE Linux Desktop 1.0 > SUSE Linux Enterprise Server 8, 9 > Novell Linux Desktop 9 Just for the record, YOU update for SuSE 9.1 of this patch forgets to run mkinitrd. The most visible problem is the missing splash in tty1. It is not the fisrt time this happens. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCR+IstTMYHG2NR9URAsMBAJsHj4SKDNeuaTUzsr2KB9koElYMowCgiLPl 5quBxpMZpmYVHuQZucMyZzs= =EY0s -----END PGP SIGNATURE-----

4 4

mysql and kernelupdates
by Philippe Vogel 25 Mar '05

25 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! There are several exploits in the described packages, but why aren't there any packages for YOU or am I too fast with my conclusion? The normal way was to write an announcement and then provide the patch-rpm's via YOU or is there a slightly change after novell is in the business? Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQkMbk0Ng1DRVIGjBAQLn5gb9HQfh2+GLGUZk2UIzvsgwIAtSJL76hyVe Sf4PgbkDh3xnT3jfahoQnM4jtna5xemfFil1hl3VUu16MF8+Dd0Z7LFJ/LMREmJq S2QQjnT02XsiGcA2+QrZQfKkE5DlDG6jk+FH9jsZ3lPk6dnt+WGfs+PzNUMDhISz qiYJRmD3KaE35nAsDIoxe2XddsmGP6eXN/WM9ylHYQtaZj9Xw1xoYFq1ZrEA/Jqh hcXCh7Rvxxa2MPK9UGNgJcyeVNBxjxm6dmjB4gUsNC46wNypDjayNIPP4JkcllmX Ele8wfMRqxQ= =94g2 -----END PGP SIGNATURE-----

3 3

(SUSE-SA:2005:018)
by tshilson＠mmm.com 25 Mar '05

25 Mar '05

I looked at this announcement and did not find how to get the update files for my SuSE SLES 8 on zSeries. Do I need to look elsewhere for the updates? Thanks, tom - - - - - - - - - - - - Toto, I have a feeling we're not in the mainframe world any more. _/) Tom Shilson ~~~~~ Unix Team / IT Server Services Aloha Tel: 651-733-7591 tshilson at mmm dot com Fax: 651-736-7689

2 1

update process
by suse 25 Mar '05

25 Mar '05

Please, point me to manual about suse update process. We have a set of machines running suse 9.1 and want to have exact copy of ftp.suse.com/pub/suse/i386/update/9.1/ in local dir (local mirror), we are using wget, but it does not remove files absent in mentioned location. Sorry for pretty dumb question, we have no time to google/etc, just help if you can.

3 2

Re: [suse-security] mysql and kernelupdates
by Philippe Vogel 24 Mar '05

24 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 O.K. Then I was too fast and have to wait a little more time. Funny is I use Göttingen and got different types of machines which got different updates (2x smp (p3/p4), 2x single cpu (p3/p4)). On one I didn't get mysql and kernel, but on the others I got all updates. This looks a littlebit strange for me. That's the reason why I asked. Philippe Arjen de Korte schrieb: > Philippe Vogel schreef: > >> There are several exploits in the described packages, but why >> aren't there any packages for YOU or am I too fast with my >> conclusion? > > > Way too fast. Not all the mirrors are updated and that's probably > why YOU is not seeing the updates. But if you look at the (really > slow at the moment) SuSE ftp servers, the packages are there. The > GWD Göttingen servers are usually pretty fast in picking them up > and generally give better throughput (just finished downloading > them from there). > > Regards, Arjen > - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQkMgx0Ng1DRVIGjBAQIJZwb/aN/rAj6eH3YLjCMTckfJPSDKCKQGvD0y btGoAgxe7jGjA/46kNzrcvpxYjMmE8D3tQM7OkRCTNFnOtu3fk2li0gfLV87rlvg hBnwAJauPF8DjhBJd9rBZKSOn4k5Z4YDGztnewGUr0PkvjBw/F2FHMbhhMdMV/ec S3+BG6I537IU9UwyqzKPJBxMz+hwIl2f76u0herCw8OD/Jc3qvflisJJ/SvC8aTz QUeC8bEFoaj3RpsMkpmK2GMFEaoQ5IotecfF06DJB4DzBfjuHk3kae/OAwQyF5jK N5WqPNC1pqo= =tfY9 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i created a principals in the database using kadmin -l. i copied the information regarding the local host to /etc/krb5.keytab and /etc/srvtab on each local host using ktutil get. from reading the literature i am assuming /etc/krb5.keytab contains only the principals for that particular host, and not the principals for every host. --- Roland Kuhn <rkuhn(a)e18.physik.tu-muenchen.de> wrote: > Hi Paul! > > On Mar 23, 2005, at 5:36 PM, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a > > realm > > server. i have installed openssh from the distribution cdroms on all > > hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all > > hosts. > > if i am reading the suse manual correctly, i should be able to slogin > > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > Have you created host principals and stored the relevant keystashes on > the respective hosts? > > Ciao, > Roland > > -- > TU Muenchen, Physik-Department E18, James-Franck-Str. 85747 Garching > Telefon 089/289-12592; Telefax 089/289-12570 > -- > A mouse is a device used to point at > the xterm you want to type in. > Kim Alm on a.s.r. > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

2 1

Re: [suse-security] heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

usePAM is set to YES i should also mention i am running 2.6 kernel. i know that causes problems for openAFS clients. thanks for your assistance. --- Mike Rose <mr349(a)cam.ac.uk> wrote: > > Not sure this is what you need, but have you set: > > usePAM YES > > in /etc/ssh/sshd_config > > undocumented config parameter - well done openssh! > > > > Mike Rose > TCM & BSS Computer Officer > University of Cambridge > http://www.bio.phy.cam.ac.uk/ > http://www.tcm.phy.cam.ac.uk/ > http://www.phy.cam.ac.uk/research/bss/ > > On Wed, 23 Mar 2005, paul kaiser wrote: > > > i am using suse professional 9.1. > > > > i have installed heimdal (kerberos) from the distribution cdroms on a realm > > server. i have installed openssh from the distribution cdroms on all hosts. > > all the hosts are kerberos clients > > > > authentication and ticket granting appear to be working fine on all hosts. > > if i am reading the suse manual correctly, i should be able to slogin > between > > hosts without being asked for a password. > > > > this is actually working from any host to the kerberos server! > > however, slogin from the server to any other host > > and slogin between any two (non-server) hosts prompts for a password. > > > > i have recompiled openssh > > --with-pam --with-kerberos5=/usr/lib/heimdal > > but to no avail. the same prompting for password occurs. > > > > any suggestions would be appreciated! > > > > > > > > > > > > __________________________________ > > Do you Yahoo!? > > Yahoo! Sports - Sign up for Fantasy Baseball. > > http://baseball.fantasysports.yahoo.com/ > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

heimdal (kerberos) with openssh
by paul kaiser 24 Mar '05

24 Mar '05

i am using suse professional 9.1. i have installed heimdal (kerberos) from the distribution cdroms on a realm server. i have installed openssh from the distribution cdroms on all hosts. all the hosts are kerberos clients authentication and ticket granting appear to be working fine on all hosts. if i am reading the suse manual correctly, i should be able to slogin between hosts without being asked for a password. this is actually working from any host to the kerberos server! however, slogin from the server to any other host and slogin between any two (non-server) hosts prompts for a password. i have recompiled openssh --with-pam --with-kerberos5=/usr/lib/heimdal but to no avail. the same prompting for password occurs. any suggestions would be appreciated! __________________________________ Do you Yahoo!? Yahoo! Sports - Sign up for Fantasy Baseball. http://baseball.fantasysports.yahoo.com/

3 2

Enabling bittorrent in Suse 9.2 Firewall via Yast
by Thomas Frayne 24 Mar '05

24 Mar '05

I have a home laptop computer with Suse 9.2 installed, and with the default firewall configuration and no services enabled. I want to download the Knoppix iso using bittorent. To do this, I need to install bittorrent and enable the firewall to use it in Suse 9.2. I would prefer to use Yast to change the firewall configuration, but I don't know how. The bittorrent documatation indicates that I should insert the iptables rule iptables -t nat -I PREROUTING -p tcp --dport 6881:6889 -j DNAT --to- destination <host> I think that this is to open the firewall to allow other machines participating in the bittorrent download to send me parts of the iso file and get parts from me that I have already received. Is that right? I looked at Yast Firewall Configuration: Services/Edit additional services, and found that I could open ports 6881:6889 for tcp, but I don't see how to limit the uses of these ports to bittorrent. Does this have to be done? Is there a way to do it via Yast? If not, what is the best way to do a temporary iptables change to enable bittorrent without letting anything else into my computer? Should I use a script file to enable/disable bittorrent? Where should I look for information that will answer these questions?

2 1

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: edwin [mailto:edwin@nsi.co.id] > Sent: Wednesday, March 23, 2005 3:31 PM > > I implement same thing with no problem. > What is firewall you use? > Before go to squid.conf I think better to check the firewall. > firewall is ok > ifconfig eth0:1 your_external_IP_but_different_from_proxy_IP > > after that you should forward all the request to > your_external_IP_but_different_from_proxy_IP port https port forward > it to your internal_OWA_IP port 80 or 443, set this on your firewall > configuration u meen nat right ? think thats my last problem now. i can enter username and password but after that i get redirected too the private ip, funny, private ip on the net. but nat isnt the way i want to go, if i handle it that way no squid needed and its a direct access to the internal lan. isnt there any other way ? or im complete wrong ?

2 1

OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

hi there, after reading multible sites over a long time i hope im getting help via this list, im running crazy here sheme: client (www) -> squid (www - public ip) -> firewall -> owa (lan - private ip) squid.conf: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 80 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 header_access Accept-Encoding deny all never_direct allow all http_access deny all when i try the connect via https://host.domain.tld, the following error ocoured: While trying to retrieve the URL: http://srv066 The following error was encountered: * Unable to forward this request at this time. This request could not be forwarded to the origin server or to any parent caches. The most likely cause for this error is that: * The cache administrator does not allow this cache to make direct connections to origin servers, and * All configured parent caches are currently unreachable. its an urgent problem, so i hope getting help here greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \

3 2

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Philippe Vogel [mailto:filiaap@freenet.de] > Sent: Wednesday, March 23, 2005 1:05 PM > What about port-acls? > > #Recommended minimum configuration: > #acl all src 0.0.0.0/0.0.0.0 > #acl manager proto cache_object > #acl localhost src 127.0.0.1/255.255.255.255 > #acl SSL_ports port 443 563 > #acl Safe_ports port 80 # http > #acl Safe_ports port 21 # ftp > #acl Safe_ports port 443 563 # https, snews > #acl Safe_ports port 70 # gopher > #acl Safe_ports port 210 # wais > #acl Safe_ports port 1025-65535 # unregistered ports > #acl Safe_ports port 280 # http-mgmt > #acl Safe_ports port 488 # gss-http > #acl Safe_ports port 591 # filemaker > #acl Safe_ports port 777 # multiling http > #acl CONNECT method CONNECT sure my fool, added now to conf > Point #1: Before getting access to any port it is useful to get > correct acls for all used ports. > > Point #2: Is there a listen-port configured to let your squid run on > https-port? sure: https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key > Point #3: Is there a reason in caching https-content as this is > insecure as https should not be cached!? now my english have an break ... > Point #4: I would do this with safe ports: > > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports right ... added to squid.conf: extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT the connect now works but i dont recieve the formular login on 443 from outlook web access. clients moves to https://host.domain.tld/exchange request tp accept certificate (from squid), long load following and after a while it breaks with: While trying to retrieve the URL: http://srv066:443/exchange The following error was encountered: * Connection Failed The system returned: (111) Connection refused The remote host or network may be down. Please try the request again. problem i see there: its http and not https, and https is needed anyone knows if there if there changes on the owa to do ? actual config looks like this: visible_hostname host.domain.tld https_port 443 cert=/etc/squid/server.crt key=/etc/squid/server.key hosts_file /etc/squid/hosts http_port 127.0.0.1:8080 httpd_accel_host srv066 httpd_accel_port 443 httpd_accel_uses_host_header off httpd_accel_single_host on httpd_accel_with_proxy off acl acl_testmail dstdomain srv066 http_access allow acl_testmail acl to_index urlpath_regex /$ acl to_favicon urlpath_regex /favicon.ico$ acl to_exchange urlpath_regex /exchange http_access allow to_index http_access allow to_favicon http_access allow to_exchange acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl SSL_ports port 443 563 acl Safe_ports port 80 8080 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 563 # https, snews acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl Safe_ports port 3401 # snmp acl CONNECT method CONNECT http_access allow all http_access allow SSL_ports http_access deny !Safe_ports extension_methods SEARCH PROPFIND PROPATCH MKCOL MOVE BMOVE DELETE BDELETE BPROPFIND BPROPATCH REPORT

1 0

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:45 PM > > http_port 443 > # Port of Squid proxy > httpd_accel_host 192.168.55.20 > # IP address of web server > httpd_accel_port 443 > # Port of web server > httpd_accel_single_host on > # Forward uncached requests to single host > httpd_accel_with_proxy on > httpd_accel_uses_host_header off > > Try this... https_port is configured to 443, httpd_port is only a dummy done the rest, same error like befor

1 0

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:31 PM > > > > httpd_accel_host srv066 > > > While trying to retrieve the URL: http://srv066 > > Can you ping srv066 from your squid box? > > If not, you need to make httpd_accel_host a resolveable name. > Just a thought. > ping is blocked but connect on 80 and 443 are possible from this host name to ip works fine srv066 - 192.168.55.20 found in cache.log: 005/03/23 12:33:26| Failed to select source for 'http://192.168.55.20/' 2005/03/23 12:33:26| always_direct = 0 2005/03/23 12:33:26| never_direct = 1 2005/03/23 12:33:26| timedout = 0

1 0

Re: [suse-security] Linux and forkbomb - with link
by Bernhard Held 22 Mar '05

22 Mar '05

> Because we have unlimited ulimits by default. > > To fix that: > Install the "ulimit" package. > Adapt /etc/sysconfig/ulimit to your needs. Installing ulimit.rpm broke capi4hylafax, which appends the line fr:35:respawn:/usr/bin/c2faxrecv -q "/var/spool/fax" in /etc/inittab. This runs fine without ulimit.rpm, but together with initscript c2faxrecv chokes on the double quotes. I couldn't find out who's responsible for removing the quotes, therefore I simply removed them in inittab. It seems to be a long standing bug, maybe someone at suse could have a look. Bernhard

2 1

pam_ldap patch not applied correctly in 9.1 and 9.2
by Prakash Velayutham 21 Mar '05

21 Mar '05

Hi All, I have several SuSE Pro 9.0, 9.1 and 9.2 systems. One of these systems is running openldap2 server and the other systems are clients of this LDAP server and authenticate against it. I use pam_ldap and nss_ldap on the clients. Recently I realized that my users are able to change their LDAP passwords using "passwd" utility only from the 9.0 clients and not from the 9.1 and 9.2 clients. The error is something like: user@hostname:~> passwd Changing password for user. Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Can't contact LDAP server use bind to verify old password Password changed. In the clients warn logs I see something like "pam_ldap: ldap_extended_operation_s Server is unwilling to perform". After googling and searcing around for almost 2 days, I discovered that SuSE did not apply a patch to pam_ldap.c file from the pam_ldap distribution on the recent systems (at least on the 9.1 source RPM I did not see the change suggested by PADL). Here it is if anyone wants it. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, session->info->userdn); - ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password); +/* ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password);*/ ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); In 9.1 sources, I saw this instead. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, session->info->userdn); /* this doesn't appear to be necessary anymore */ ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD, old_password); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); Once I commented out the necessary line, and rebuilt the RPM I could use "passwd" to change the user password in LDAP. Regards, Prakash

1 0

Linux and forkbomb - with link
by Jim Flanagan 21 Mar '05

21 Mar '05

Sorry, my earlier post did not include the link to the story at securityfocus.com Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. http://www.securityfocus.com/columnists/308?ref=rssdebia -- Jim Flanagan linuxjim(a)jjfiii.com

9 11

AW: [suse-security] Default policy setting with iptables
by Stefan.Junge＠ssi-schaefer.de 21 Mar '05

21 Mar '05

Hi together, I think I have solved the problem. The solution is to set the flush rules for each chain iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -t nat -F iptables -X But now all dropped packets will be logged on console. Does somebody have an idea ? Thanks for help Stefan

1 0

What's the story on apache2
by BoneMachine 19 Mar '05

19 Mar '05

Hi, I received a security summery from suse (2005:008). It states that there is a vulnerability in apache2. After following the lead from the changelog of the updated suse-apache rpm i reached a bugreport at Apache. http://issues.apache.org/bugzilla/show_bug.cgi?id=27945 The thing I don't get is if the apache child process crashes or if the entire server crashes. Could this issue be exploited to bring the entire apache down? Can someone who has had trouble with this issue explain symtoms like log-messages ? TIA Bone Machine --- "Hip hip hip" - The Pixies

3 2

Re: [suse-security] Problem with SuSEfirewall and Postfix SMTP?
by Jürgen Mell 19 Mar '05

19 Mar '05

Hi, On Friday 18 March 2005 02:40, M. Edwin wrote: > Jürgen Mell wrote: > > Hi List, > > Hello > > > today we had an outage of our internet provider. The connection was > > broken for several hours during which the mail server of the internet > > provider stored our e-mails. Now after the connection is established > > again these mails are sent to our own mail server from the provider's > > server at a pretty high rate. > > > > Our system is SuSE 9.2 with Postfix 2.1.5 as the SMTP server and the > > SUSEfirewall which comes with 9.2. All current patches are applied. > > What is the setting of firewall in connection with SMTP? FW_SERVICES_EXT_TCP="http https smtp ssh ftp" Adding FW_TRUSTED_NETS="<Provider's mailserver IP>,tcp,25" did not change anything. > > > The problem now is that after a small number of mails from our > > provider the SMTP server does not accept any more connections. Instead > > it complains about timeouts, lost connections or SMTP EOFs. When > > telnetting to the server in this state a connection is made but there > > is no prompt "220 <servername> ESMT Postfix". The only way to fix this > > I found up to now is restarting Postfix (the cron job does it now > > every 3 minutes...) but that is only a very crude fix. Even setting > > the max_use parameter in main.cf to 1 to get a new smtpd for each > > connection does not help. Has anybody an idea what is causing this > > behaviour? Is it the firewall or is it Postfix or anything else who is > > limiting the connections? There are some firewall errors in the logs, > > but not nearly as many as the lost connections of the SMTP server: > > > > Mar 17 21:52:18 pluto kernel: SFW2-OUT-ERROR IN= OUT=dsl0 SRC=<our IP> > > DST=<Provider's mail server IP> LEN=52 TOS=0x00 PREC=0x00 TTL=64 > > ID=3530 DF PROTO=TCP SPT=25 DPT=58506 WINDOW=1404 RES=0x00 ACK RST > > URGP=0 OPT (0101080A015E41E40C059CEB) > > > > Any help would be greatly appriciated! > > How if someone send you email directly, or are there any email you > receive after the connection establish again. Postfix restarts the smtp daemons after some time. Then we can receive mail again for some minutes but after that the system is blocked again. > How is the record of your DNS (MX record)? nslookup with querytype=MX tells <our domain> mail exchanger = 20 <Provider's mail server>. <out domain> mail exchanger = 10 mail.<our domain>. Ciao Jürgen

5 9

Linux and forkbomb
by Jim Flanagan 18 Mar '05

18 Mar '05

Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. -- Jim Flanagan linuxjim(a)jjfiii.com

1 0

Linux and forkbomb
by Jim Flanagan 18 Mar '05

18 Mar '05

Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. -- Jim Flanagan linuxjim(a)jjfiii.com

1 0

Problem with SuSEfirewall and Postfix SMTP?
by Jürgen Mell 18 Mar '05

18 Mar '05

Hi List, today we had an outage of our internet provider. The connection was broken for several hours during which the mail server of the internet provider stored our e-mails. Now after the connection is established again these mails are sent to our own mail server from the provider's server at a pretty high rate. Our system is SuSE 9.2 with Postfix 2.1.5 as the SMTP server and the SUSEfirewall which comes with 9.2. All current patches are applied. The problem now is that after a small number of mails from our provider the SMTP server does not accept any more connections. Instead it complains about timeouts, lost connections or SMTP EOFs. When telnetting to the server in this state a connection is made but there is no prompt "220 <servername> ESMT Postfix". The only way to fix this I found up to now is restarting Postfix (the cron job does it now every 3 minutes...) but that is only a very crude fix. Even setting the max_use parameter in main.cf to 1 to get a new smtpd for each connection does not help. Has anybody an idea what is causing this behaviour? Is it the firewall or is it Postfix or anything else who is limiting the connections? There are some firewall errors in the logs, but not nearly as many as the lost connections of the SMTP server: Mar 17 21:52:18 pluto kernel: SFW2-OUT-ERROR IN= OUT=dsl0 SRC=<our IP> DST=<Provider's mail server IP> LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=3530 DF PROTO=TCP SPT=25 DPT=58506 WINDOW=1404 RES=0x00 ACK RST URGP=0 OPT (0101080A015E41E40C059CEB) Any help would be greatly appriciated! Jürgen

2 1

Linux Magazin Jahres-CD
by Patrick Holzinger 18 Mar '05

18 Mar '05

Hallo Zusammen, hat jemand zufällig, die Linux Magazin Jahres CD 2004 ich bräuchte das Heft 12/2004 im pdf Format. Danke für die Hilfe und lg Patrick

3 3

password change from LDAP client (pwdutils and shadow RPMs)
by Prakash Velayutham 17 Mar '05

17 Mar '05

Hi, I have already sent this question to openldap-software mailing list. There seems to be a whole lot of package changes between 9.0 and 9.1 SuSE Pro, that I thought of posting this here too to get experts' opinions. I have a OpenLDAP server (openldap2-2.1.22-65 RPM version) running on a SuSE Pro 9.0 server (Kernel 2.4.21-192). There are different clients connecting to this server for authentication (a mix of SuSE Pro 9.0 and 9.1 systems). I have the following packages in the 9.0 clients: pam_ldap-164-42 nss_ldap-207-80 openldap2-client-2.1.22-65 and the following in the 9.1 clients: pam_ldap-169-24 nss_ldap-215-55 openldap2-client-2.2.6-34 I want the users to be able to change their own passwords using the "passwd" command. Here are the scenarios: In the server slapd.conf, I have the following ACLs, access to attrs=userPassword by self write by anonymous auth by dn="cn=Manager,o=tchrf,c=us" write by * none access to attrs=shadowLastChange by dn="cn=Manager,o=tchrf,c=us" write by self write by * auth access to * by * read I also have the "password-hash {SSHA}" option. In all the clients, I have "pam_password exop" enabled. I am able to do the passwd change successfully from the 9.0 systems, but not from the 9.1 systems. The /var/log/messages shows an error like the following: pam_ldap: ldap_extended_operation_s Server is unwilling to perform Please help. If you need more info, please ask. Thanks, Prakash

1 0

Default policy setting with iptables
by Stefan.Junge＠ssi-schaefer.de 17 Mar '05

17 Mar '05

Hello, I have got a question concerning setting up a default policy with iptables. There is a system with kernel 2.6. I have configured a rule set in a script which will be loaded at boot time. On SuSE 8.2 there was the same rule set - and it works. Now, 1. with the kernel 2.6 I have not any logging as configured in syslog Kern.* /var/log/firewall 2. The default policy is not set as I have expected. Here is the beginning: Some basics ... And then ... iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -F iptables -t nat -F iptables -X # ======================================================================= # Loopback Devices # ======================================================================= iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT # ======================================================================== === # DROP & LOG Chain # ======================================================================== = iptables -N my_drop iptables -A my_drop -p icmp -j LOG --log-prefix "DROP-ICMP " iptables -A my_drop -p udp -j LOG --log-prefix "DROP-UDP " iptables -A my_drop -p tcp -j LOG --log-prefix "DROP-TCP " iptables -A my_drop -j DROP .... Rules for SSH, http ... What could be wrong? Regards, Stefan Junge

3 2

SuSE 9.2 + SuSEfirewall2 + pptp vpn
by Frank Krüger 17 Mar '05

17 Mar '05

Hi List, > That's strange. I'd suggest you to start from scratch and then post > your /etc/sysconfig/SuSEfirewall2 file. Just copy > /var/adm/fillup-templates/sysconfig.SuSEfirewall2 to > /etc/sysconfig/SuSEfirewall2 to restore the default configuration > file. > > cu > Ludwig Could it be that there is something wrong with the last build of SFW2? Ich got strage FW probs too, tryin' to get a pptp-vpn working. Mar 15 17:04:59 *** kernel: SFW2-IN-ILL-TARGET IN=ppp1 OUT= MAC= SRC=192.168.21.210 DST=255.255.255.255 LEN=96 TOS=0x00 PREC=0x00 TTL=128 ID=11508 PROTO=UDP SPT=137 DPT=137 LEN=76 Mar 15 17:04:59 *** kernel: SFW2-IN-ILL-TARGET IN=ppp1 OUT= MAC= SRC=192.168.21.210 DST=255.255.255.255 LEN=96 TOS=0x00 PREC=0x00 TTL=128 ID=11512 PROTO=UDP SPT=137 DPT=137 LEN=76 Mar 15 17:05:00 *** pptpd[21201]: Error writing GRE packet: Operation not permitted Mar 15 17:05:00 *** pptpd[21201]: CTRL: GRE read or PTY write failed (gre,pty)=(6,5) ppp1 is set as a INT interface, class-routing is activated. I got no further idea, with SuSE8.0 I had no problems. Best regards, Frank -------------------------------------------- netlogistics Frank Krueger <frank(a)netlogistics.de> you may have a look at http://www.netlogistics.de --------------------------------------------

2 3

security update suse professional
by Cristian Del Carlo 16 Mar '05

16 Mar '05

Hi list, I have same questions about the update policy that novell have for the suse professional distributions. How many years can i found the security patch for? And when is the end of support for suse 9.X professional? Is there a web page where is that explained? Best regards, Cristian Del Carlo

2 1

Suse 9.1 and SuSEfirewall2-custom
by germ germ 15 Mar '05

15 Mar '05

If i want to accept any new connections for port 5432, which function do I include it in within the SuSEfirewall2-custom file? or is there a more appropriate place to put it? __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

2 1

Ownership of Tomcat files
by Bob Vickers 15 Mar '05

15 Mar '05

I have been asked to set up a Tomcat server, and am just grappling with the extensive documentation. It isn't a production site, just a demonstration site for students to play with, but I'm very puzzled by the file ownerships which SuSE set up as they seem to break security principles as well as being inconvenient. When the Tomcat server starts, /etc/init.d/tomcat changes the ownership of all the files in $CATALINA_BASE to be tomcat:tomcat, i.e. the same as the user running the web server. So the web server has write access to its own configuration and to all the pages it serves, which is obviously a potential security hazard. It is also inconvenient, because the local user who owns the pages can no longer change them without asking a superuser. I am using SuSE 9.1 by the way, but it looks very similar on 9.2. Is there a good reason for it being done like this? Forgive me if I have missed something; I know nothing at all about servlets and am just trying to get the server going without expending too much effort. Regards, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London

4 3

SuSE 9.2 + SuSEfirewall2 + nfs problems
by Simon Oliver 15 Mar '05

15 Mar '05

I have a new fileserver running SuSE 9.2. Amongst other services it exports NFS shares. I've used Yast to configure the firewall, checking the NFS option. I have had problems where remote NFS clients either timeout trying to communicate with the server (ping/ssh work fine). After some messing (turn services on and off, flush iptables, etc) it now seems to work. However I notice some dropped packets from one of the NFS clients: Mar 15 09:38:55 zzz kernel: SFW2-INext-DROP-DEFLT-INV IN=eth0 OUT= MAC=00:0d:56: b8:5a:f4:08:00:69:0d:9a:2e:08:00 SRC=130.88.xxx.yyy DST=130.88.xxx.zzz LEN=40 TOS =0x00 PREC=0x00 TTL=60 ID=12095 DF PROTO=TCP SPT=757 DPT=2049 WINDOW=32761 RES=0 x00 ACK RST URGP=0 These are occurring on average about once a minute, but the timings vary - there can be gaps of up to eight minutes and then again they may be as close as a few seconds apart. rpcinfo indicates the following for port 2049: 100003 2 udp 2049 nfs 100003 3 udp 2049 nfs 100227 3 udp 2049 nfs_acl 100003 2 tcp 2049 nfs 100003 3 tcp 2049 nfs 100227 3 tcp 2049 nfs_acl There are no noticeable affects on the remote client! Any ideas what is happening? Regards -- Simon Oliver

3 5

Question About Sys/Sec Logs
by Don Parris 15 Mar '05

15 Mar '05

In my syslog (via Yast) I found the following entries: (020405B401010402) Mar 14 08:04:42 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=41916 DF PROTO=TCP SPT=34654 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB2830000000001030300) Mar 14 08:04:44 luke sshd[26285]: Invalid user test from ::ffff:218.153.147.92 Mar 14 08:04:45 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=27312 DF PROTO=TCP SPT=34740 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB3A50000000001030300) Mar 14 08:04:46 luke sshd[26287]: Invalid user guest from ::ffff:218.153.147.92 Mar 14 08:04:47 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=61758 DF PROTO=TCP SPT=34796 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB47A0000000001030300) Mar 14 08:04:49 luke sshd[26289]: Invalid user admin from ::ffff:218.153.147.92 Mar 14 08:04:49 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=34621 DF PROTO=TCP SPT=34842 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB54B0000000001030300) Mar 14 08:04:51 luke sshd[26291]: Invalid user admin from ::ffff:218.153.147.92 Mar 14 08:04:51 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=17521 DF PROTO=TCP SPT=34909 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB61C0000000001030300) Mar 14 08:04:53 luke sshd[26293]: Invalid user user from ::ffff:218.153.147.92 Mar 14 08:05:01 luke sshd[26301]: Invalid user test from ::ffff:218.153.147.92 Mar 14 08:08:20 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=219.128.154.132 DST=67.35.166.180 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=40245 DF PROTO=TCP SPT=3984 DPT=9898 WINDOW=65044 RES=0x00 SYN URGP=0 OPT (0204058601010402) Mar 14 08:19:59 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=218.83.155.77 DST=67.35.166.180 LEN=364 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=49964 DPT=1026 LEN=344 Mar 14 08:41:56 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=222.88.173.5 DST=67.35.166.180 LEN=681 TOS=0x00 PREC=0x00 TTL=111 ID=62714 PROTO=UDP SPT=17219 DPT=1026 LEN=661 Mar 14 08:51:43 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=12.6.153.198 DST=67.35.166.180 LEN=908 TOS=0x00 PREC=0x00 TTL=116 ID=13705 PROTO=UDP SPT=29582 DPT=1028 LEN=888 It appears that someone was trying to login on my system while it was connected to the 'Net. My real question is whether this indicates my defenses are working, or should I be looking elsewhere for that confirmation. There is no other activity recorded until 12:46 and I have not noticed any problems with my system. However, I also understand that wiley crackers will attempt to make themselves invisible and cover their tracks. I'm not wiley enough yet to get the really wiley ones. ;) I'm not in a state of panic, but do feel I need to spend more time understanding and applying the security monitoring stuff. Is this where Snort would be useful? Thanks for your input. Don -- evangelinux GNU Evangelist http://matheteuo.org/ http://chaddb.sourceforge.net/ "Free software is like God's love - you can share it with anyone anytime anywhere."

4 3

SUSE Security Announcement: openslp (SUSE-SA:2005:015)
by krahmer＠suse.de 14 Mar '05

14 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: openslp Announcement-ID: SUSE-SA:2005:015 Date: Mon, March 14th 14:41:14 CET 2005 Affected products: 9.1, 9.2 SUSE Linux Enterprise Server 9 Novell Linux Desktop 9 Vulnerability Type: remote command execution Severity (1-10): 5 SUSE default package: Yes. Cross References: - Content of this advisory: 1) security vulnerability resolved: Buffer overflows in OpenSLP. problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - squirrelmail - Koffice 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion The SUSE Security Team reviewed critical parts of the OpenSLP package, an open source implementation of the Service Location Protocol (SLP). SLP is used by Desktops to locate certain services such as printers and by servers to announce their services. During the audit, various buffer overflows and out of bounds memory access have been fixed which can be triggered by remote attackers by sending malformed SLP packets. 2) solution/workaround There is no easy workaround except to shut down the slpd and to stop using involved clients. 3) special instructions and notes Please make sure that all running instances of slpd which were started before the update are terminated. After the update, run the following command as root: /usr/sbin/rcslpd try-restart 4) package location and checksums Download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered for installation from the maintenance web. x86 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-1.1.5-80.4.i58… e183a877674fd83b401759c071f8ebfb ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-server-1.1.5-8… b68232aa97424dea8938fb07c67ee968 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-devel-1.1.5-80… d15cb7cd7b224811cca38d4992d6dde9 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-1.1.5-80.4.i58… 24fecfe10275f3995be1248307a29d8c ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-server-1.1.5-8… 0b0d8b6a0bbdc8b4962f12ee0465a083 ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/openslp-devel-1.1.5-80… 593b7c9104f1179761c2cac54431fec7 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/openslp-1.1.5-80.4.src.… a4852023f752182d68cea815d5905d7e SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-1.1.5-73.15.i5… fa20a6d60a64aff0998eed99fab4a9af ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-server-1.1.5-7… 604d8b96c9bfbce6b2fac07e37465636 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-devel-1.1.5-73… cd6851d2adcf9439c9dcc317de052089 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-1.1.5-73.15.i5… 7b4688c03fd664d6742a70245530d4a6 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-server-1.1.5-7… 4b46e36bd47cbb8ce2d08225dcca2c88 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/openslp-devel-1.1.5-73… 002c614947ede188c85bb4fb62dfdbd6 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/openslp-1.1.5-73.15.src… 2b29878d5706dccf0b5b5902c3e9315c x86-64 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-1.1.5-80.4… dba5224660ab6f76846d5be2d2c3531d ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-server-1.1… 6ab38f02002f44e24e9617794c7a50b5 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-devel-1.1.… d3ccb03fe6c509b05a278c60ca7be889 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-1.1.5-80.4… a9c86a43725a13fb14c86af85ace7131 ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-server-1.1… cc83600072f4d3f5ededeb60c16bc25b ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/openslp-devel-1.1.… b91a5bb0ce85bd5f30db9c794618dc00 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/openslp-1.1.5-80.4.sr… a4852023f752182d68cea815d5905d7e SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-1.1.5-73.1… f15832a7d86cad37f73671123c3a1706 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-server-1.1… e418cd6a08fce7a0091fef7b4f801dd2 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-devel-1.1.… 5f409e569a149cf83ddaf7fdb6a41dcb patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-1.1.5-73.1… 737bb45b6d95f0fac5d31f2b95924b1d ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-server-1.1… 8a14bb253b411bf6de617a557b2dcd6f ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/openslp-devel-1.1.… 6936b808204a5a48faccdf8446b72a80 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/openslp-1.1.5-73.15.s… 2e443c1bedac57827cc9d2363e0d25b1 ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - squirrelmail New squirrelmail packages for the S/MIME plugin command injection vulnerability are available on our ftp servers. - Koffice New Koffice packages are available on our ftp servers, fixing buffer overflows in the pdf engine. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We recommend against subscribing to security lists that cause the e-mail message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the file name of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.7 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBiEYEExECAAYFAkGJG+YACgkQGsiRhDTRlzm8CQCg14Wz vg6j45e/r1oyt9EaHhleSacAnA+2dArk1I3xt49Z5rdnhqheF//9mQGiBDnu9IER BACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff4JctBsgs47tj miI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlW t6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcOQliHu8jwRQHx lRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifr ZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBED3+D2t1V/f8l 0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1 krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoEmyW/xC1sBbDk DUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25p bmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkDwmcABAsKAwQD FQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6dNfnwI2PAsgCg jH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzO AKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUD BRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4 fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklL snr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMn snT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/ xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmp U661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0EExECAB0FAjxq qTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1fAJ9dR7saz2KP NwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0EOe70khAIAISR 0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/HZnh3TwhBIw1 FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44ht5h+6HMBzoFC MAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPTtGzcAi2jVl9h l3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM523AMgpPQtsK m9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q2Y+GqZ+yAvNW jRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8QnSs0wwPg3xE ullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWawJxRLKH6Zjo/F aKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ1sj2xYdB1xO0 ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCHORrNjq9pYWlr xsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1wwylxadmmJaJ HzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQYEQIADAUCOe70 kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol0JdGwACeKTtt geVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAKCRCoTtronIAK yofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3coSPihn1+OBNw= =Fv2n - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iQEVAwUBQjWmlXey5gA9JdPZAQF2Lwf/WY1ZT0k33jmy4vYW2/xJWZXliN1wd5jO MJMmT0vwAh5+UsOArK8yT1o125fEosR290es/T9fwZAm0DXi5yhuJBoK7lJMChqP afGkrAUJKRxfzxWyyqOnHO14M5PktafORvRbfBJ31tlz8/mJsmH7N92dLlZT7pgQ MvgwEztVuKS833DfIiZIDET1Rxyh1uqnbR8zx9twcrUNkaMZlAVdYRuhMkgzEt8s FHUbI4ZpR/Ul3oSfyoKS9y8dNDGrfUsSj3i3bOvuxYWbDfQm43UjeRtzMPYTHhGQ pJpXB/IFjI9Lcji5KqjVGnOuRS//ospPQe5mWhNFFC5jMzkw07XDIw== =+2sH -----END PGP SIGNATURE-----

1 0

Re: [suse-security] reject an IP with Apache2 and Suse Firewall.
by Peer Stefan 14 Mar '05

14 Mar '05

Hi, > From: Andrei Bintintan [mailto:klodoma@ar-sd.net] > > Hi, > > I'm getting some strange logs, in the apache access file from > some IP's. > > How can I make a "blacklist" with apache so that I reject > this specific IP from the webserver??? It's more convenient to do this with ip filters. > I'm wondering for the same thing in the Suse Firewall. How > can I make a blacklist for the suse firewall??? Sure - edit /etc/sysconfig/SuSEfirewall2 and enable FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" Edit /etc/sysconfig/scripts/SuSEfirewall2-custom and add the following to the "fw_custom_before_antispoofing()"-section BLACKLIST="A.B.C.D E.F.G.H X.Y.Z.0/24" for net in $BLACKLIST; do iptables -A INPUT -s $net -j DROP done > This blacklist could be a simple IP list or ... maybe > something more advanced can be made??? > > > Andy. Cheers, Stefan

3 2

error within logrotate.d
by Philippe Vogel 14 Mar '05

14 Mar '05

Hi all! There is an error in logrotate on some of my systems with SuSE 9.1 and maybe 9.2 if there is snort installed on the system and /etc/logrotate.d/snort exists it doesn't find any logs of snort logrotate simply stops with no error-report send to root and logs aren't rotated at all. Could you plz. fix this (I think the line "missing ok" is missing)? Reguards Philippe

1 0

Problem with second user with uid 0?
by Frank Steiner 14 Mar '05

14 Mar '05

Hi, are there any security (or other) problems when having a second user with uid 0? We would like to mainain a user "rootid" which has uid 0 and should be used for normal users logging in as root when the admin (me) is e.g. on holidays and sth. fails and needs to be repaired. For this, we have sealed envelopes with the root passwords which some users can open to get the password (the boss wants it like that). To avoid changing "my" root password afterwards, users should get the password for "rootid" and work with that account. After my return, I would just have to change the rootid password and could still work with my normal root password. "sudo" etc. is not a real solution, because users might need to login during boot when fsck fails. And then you need a root password and no sudo etc. Are there any problem with such a setup? Of course the rootid account must be protected the same way the root account is. In a first test, I could do anything with the rootid user, but I'm not sure if there are any security traps that I don't recognize... cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: -4054 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

11 17

reject an IP with Apache2 and Suse Firewall.
by Andrei Bintintan 14 Mar '05

14 Mar '05

Hi, I'm getting some strange logs, in the apache access file from some IP's. How can I make a "blacklist" with apache so that I reject this specific IP from the webserver??? I'm wondering for the same thing in the Suse Firewall. How can I make a blacklist for the suse firewall??? This blacklist could be a simple IP list or ... maybe something more advanced can be made??? Andy.

1 0

odd entries access_log
by Ger Lautenbach 12 Mar '05

12 Mar '05

Hello list, can somebody explain to me what these entries are in my access_log of my apache webserver? (there are a couple lines below i copied for you to look at) thks Ger 65.194.21.143 - - [12/Mar/2005:19:01:36 +0100] "POST /_vti_bin/_vti_aut/fp30reg.dll HTTP/1.1" 404 1055 "-" "-" 65.194.21.143 - - [12/Mar/2005:19:01:37 +0100] "SEARCH /\x90\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04 x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04H\x04 etc etc etc

3 3

missing log-file by fail-login with kdm?
by Thorsten Möhle 12 Mar '05

12 Mar '05

Hello, if there is a fail-login, doing with the kdm on Suse 9.2, I couldn't find an entry in a log-file anywhere. By using the text-console without X, there is an entry in faillog and messages. I found nothing about this, except for an old bug from xdm (#118673 failed logins are not entered in /var/log/faillog). Is this still the problem and no other way to log this? Can anyone tell me, where I can find an entered log-file or what I have to change to get an entry in one of the log-files if there is a fail login by using kdm? Happy about any comments or ideas, Thorsten

1 0

PHP 4.3.4 vulnerable in rkhunter
by ReymanX 12 Mar '05

12 Mar '05

Hi all, I just install rkhunter in my system, and when I ran it, it shows that php-4.3.4 in my system is seems to be vulnerable. But when I do yast online update, there' no available update for php. Here's part of my php*rpm in rpm -qa | grep php. php4-4.3.4-43.22 php4-mysql-4.3.4-43.22 php4-gd-4.3.4-26 php4-mcrypt-4.3.4-26 php4-pear-4.3.4-26 regards, -- Arie Reynaldi Zanahar reymanx at gmail.com http://www.reynaldi.or.id

2 1

RE: [suse-security] Problem with second user with uid 0?
by Ness, Todd 11 Mar '05

11 Mar '05

Why not just give that user sudo? Then you can see how they fix/break it worse, and if they have to become root they can just sudo su -? -----Original Message----- From: Frank Steiner [mailto:fsteiner-mail@bio.ifi.lmu.de] Sent: Friday, March 11, 2005 4:10 PM To: Mike Tierney Cc: 'miguel gmail'; 'SuSE Securitylist' Subject: Re: [suse-security] Problem with second user with uid 0? Mike Tierney wrote > If anyone is *REALLY* determined they can > > 1) Cut the padlock > 2) Pop the case and clear the BIOS password via jumpers Right. So whenever a user has physcial access to the hardware, you can't do much to prevent him from hacking into the system. And a user who should recover a broken system when I'm off, should have access to the server he needs to recover, so... I think the question here is: How easy should it be for someone to get root access? If users know the root password by default, they tend to use it from time to time "to do a little fix or install a little program because the admin has already gone home...", and that's what we don't want. In case sth. breaks while I'm not in the office, a pre-selected user opens a sealed envelope. I see this when I'm back and change the password again to avoid this user doing "a little fix or..." :-) Because this user must have a key to the server room, I must trust him that he does not open the server and resets the bios to break in. And if I trust him this way, I can also trust him that he does not install a backdoor after opening the envelope and working as root to fix the server. That's the deal. Nothing more. And all I want to reach is to give this user a different root password than my usual root password, so that I don't have to change mine after the envelope was opened. > 3) Change the BIOS back to booting from CDROM and pop in a boot disk > 4) Not sure how they'd deal with the encrypted disks! Maybe get a job > as a cleaner and install a keystroke logger on the keyboard a few > weeks beforehand...? > > So all of a sudden leaving the root password in a sealed envelope > that's stored in a locked filing cabinent doesn't sound so bad after all!!!! Especially not for a chair with 10 people where we all know each other very well and everyone knows where to get the key to enter the server room :-) -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: -4054 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] install logwatch on suse 9.0
by Neal Haas 11 Mar '05

11 Mar '05

I never got the RPM of logwatch to work correctly so I just installed it by hand. It was easy, follow the instructions on http://www.susediary.com under the guides section. If you want to watch your ftp stuff, add this to your syslog.conf: ftp.* /var/log/xferlog Neal -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

install logwatch on suse 9.0
by Cristian Del Carlo 11 Mar '05

11 Mar '05

Hi list, i am trying to install logwatch 6.0.1-4 on a suse professional 9.0 but i have the following failed dependencies: perl(Exporter) perl(Getopt::Long) perl(POSIX) perl(File::Temp) perl(strict) I don't kown what rpm i must install to resolve. Yast doesn't resolve the dependencies. Thanks, Cristian Del Carlo

3 6

parsing /var/log/warn
by John 11 Mar '05

11 Mar '05

Hi to all Which is the best program for parsing, analyzing the /var/log/warn file, iptables log report ?

2 2

RE: [suse-security] Problem with second user with uid 0?
by Wilde, Martin 10 Mar '05

10 Mar '05

Hi Frank, if your rootid user is managed on a per host basis I would not expect *technical* security traps. During logon the passwd file is checked, if there is a user named "rootid", then the crypted password is taken from the shadow file and if there is a match then the userid 0 (or any other id from the passwd file) is set. AFAIK: after login all programs just test the userid (0) to find out if you have root permissions. So everything should be fine except all commands that do an id-to-username translation (like id(1) e. g.). other problems: As you are talking about "normal" users: I do not know if they *really* know what to do. So you usually need someone "trusted" that is aware of what is meant by "having root permissions" - e. g. what happens when he types "rm -rf .*" in some user directory. In case you are using NIS: Be aware that those users will have root permissions on *all* systems. Also keep in mind that this user has access to *all* files including documents from your genaral manager or the human ressources people! Be also sure, that the password for the rootid user is as strong as yours should be! Martin -----Original Message----- From: Frank Steiner [mailto:fsteiner-mail@bio.ifi.lmu.de] Sent: Thursday, March 10, 2005 10:53 AM To: SuSE Securitylist Subject: [suse-security] Problem with second user with uid 0? Hi, are there any security (or other) problems when having a second user with uid 0? We would like to mainain a user "rootid" which has uid 0 and should be used for normal users logging in as root when the admin (me) is e.g. on holidays and sth. fails and needs to be repaired. For this, we have sealed envelopes with the root passwords which some users can open to get the password (the boss wants it like that). To avoid changing "my" root password afterwards, users should get the password for "rootid" and work with that account. After my return, I would just have to change the rootid password and could still work with my normal root password. "sudo" etc. is not a real solution, because users might need to login during boot when fsck fails. And then you need a root password and no sudo etc. Are there any problem with such a setup? Of course the rootid account must be protected the same way the root account is. In a first test, I could do anything with the rootid user, but I'm not sure if there are any security traps that I don't recognize... cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: -4054 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. * -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

openvpn & suse firewall
by Antonio Montani Jimenez 09 Mar '05

09 Mar '05

ok, got a little problem. i (openvpn sevrer) directly connected to the internet, but i have a subnet under me. in order to get the tunnels workin, i have to run the script firewall.sh that comes with openvpn, and i have to knowck down the firewall (yast), but i lose connection to internet from my internal machines. if i activate the firewall (yast) then the tunnel doesnt work. anyone knows a sollution to get them both working? �Tienes alguna duda en tu VIDA? www.howstuffworks.comIf You Ask Me A Fu**in' Question You'd Better Be Prepared For The AnswerNoel GallagherOasis Frontman17/10/02 __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

openvpn & suse firewall
by Antonio Montani Jimenez 08 Mar '05

08 Mar '05

ok, got a little problem. i (openvpn sevrer) directly connected to the internet, but i have a subnet under me. in order to get the tunnels workin, i have to run the script firewall.sh that comes with openvpn, and i have to knowck down the firewall (yast), but i lose connection to internet from my internal machines. if i activate the firewall (yast) then the tunnel doesnt work. anyone knows a sollution to get them both working? �Tienes alguna duda en tu VIDA? www.howstuffworks.comIf You Ask Me A Fu**in' Question You'd Better Be Prepared For The AnswerNoel GallagherOasis Frontman17/10/02 __________________________________ Celebrate Yahoo!'s 10th Birthday! Yahoo! Netrospective: 100 Moments of the Web http://birthday.yahoo.com/netrospective/

2 1

RE: [suse-security] Allow MAC addresses through SuSEfirewall2
by Ness, Todd 07 Mar '05

07 Mar '05

I would look at 2 factor authentication as another option. http://www.securecomputing.com/index.cfm?skey=1277 is one example of this. -----Original Message----- From: Carlos E. R. [mailto:robin1.listas@tiscali.es] Sent: Sunday, March 06, 2005 7:21 PM To: SuSE Security List Subject: RE: [suse-security] Allow MAC addresses through SuSEfirewall2 The Sunday 2005-03-06 at 14:18 -0000, Thomas Knight wrote: > > There are settings in Yast (profesional version) to force users to > > have "safer" passwords. I supposse the enterprise version has similar settings. > > > > Also, you could set up ssh to not accept login/password entry, but > > public key instead. > > I'm with you there. > What I mean is if I use username/password they'll just save the > password somewhere. You can also force them to change the passwords every two weeks :-P I remember once, while working for a certain important company (US based multinational), we were issued passwords for accessing certain machines (not exactly computers). A "boss" gave us big envelopes. Inside, there was a sealed envelope (secret and confidential) and a booklet explaining how to safely use passwords, how to choose them, how to keep them... etc. We had to sign and return a form as "read and understood". The sealed envelope contained the passwords, of course. I'm unsure now if the person that gave us the envelopes waited nearby till we returned the forms while keeping an eye on us, but I think he did... Sounds too paranoic? :-) Actually, I saw more "paranoic" measures from them a few years later on. > If they use PPK they'll "forget" to specify a passphrase for their > private key, which is out of my control. Yes, that's a thing I noticed recently. The sshd server can not force the client to use a long passphrase, I understand. > Hey, I'll log all access and they'll have limited privs. We do what we can! Yap :-) > > Ta for the thoughts, Welcome. -- Cheers, Carlos Robinson -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re[2]: [suse-security] program to analyse log files
by John 07 Mar '05

07 Mar '05

From: Rune Lynge <lists-suse-security(a)cease.dk> To: suse-security(a)suse.com Date: Monday, March 7, 2005, 1:40:13 PM Subject: [suse-security] program to analyse log files Monday, March 7, 2005, 1:40:13 PM, you wrote: > At 11:58 +0100 07/03/05, Dominik wrote: >>> <SNIP> I want to have a report with a mail every day. Wich >>> is the better tool that I can use ? >> >>I use "logwatch" (www.logwatch.org). Everyday I get mail report about my server logs. > Or you could use logdigest > <http://www.novell.com/products/linuxpackages/professional/logdigest.html> > - badly documented, but quite well working. > Find it on the 9.2 DVDs (it is also on present in 9.1 AFAIK), > spend 10 minutes setting up the ignore.local and you should be up > and running. > Rune is there any command logwatch or just the logwatch.pl ? Seems that saving the report to a file doesn't work. Does it work for you? i just run the logwatch.pl in the scripts directory and then keep the stdout to a file including the stderr. What is your method so, your configuration ?

1 0

program to analyse log files
by Cristian Del Carlo 07 Mar '05

07 Mar '05

Hi, I use suse linux 9.X professional and i am looking for a tool to analyse the logs in a server to find out informations about server activity, unauthorized access to services, status of services etc... I want to have a report with a mail every day. Wich is the better tool that I can use ? Cristian Del Carlo

3 2

Allow MAC addresses through SuSEfirewall2
by Tom Knight 07 Mar '05

07 Mar '05

Hi everyone! Using SuSE Linux Enterprise Server 8, SuSEfirewall2 A user is requesting that a number of developers have access to my server, but the IP addresses are variable across a large subnet, so allowing access to MAC address has been suggested. I want this not to interfere with the existing rules in the /etc/sysconfig/SuSEfirewall file, and I want a number of MAC addresses allowed in. I'm guessing I need to add something like: iptables -A INPUT -m mac --mac-source 12:23:34:45:56 -m tcp --dport [port] -j ACCEPT for each MAC address. Questions: 1. Is my guess at an iptables line anywhere near useful? 2. Is there anything I have to check in my kernel config? I stay with the default kernel. 3. How/where should I make this ionformation available to SuSEfirewall2? 4. Hang on - given they're on a different subnet, will this work anyway? Many thanks, Tom. -- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk

4 5

webmail to install
by Cristian Del Carlo 06 Mar '05

06 Mar '05

Hi, i must install to a customer on a suse 9.1 professional a simple webmail,. The customer has a web server with apache2 and php. I know that the webmail can have security problems. Can someone suggest me a safe webmail to install ? Best regards, Cristian Del Carlo

3 2

Enable IPv6 support for SuSEfirewall2
by Arjen Runsink 03 Mar '05

03 Mar '05

Hi, As far as I know not mentioned elsewhere yet. I found this using the linux adagium "use the source". The SuSEfirewall2 says that IPv6 is not supported in the script and that is because connection tracking is not yet in the kernel. Well, that is not exactly true. The kernel with 9.2 does support it (marked experimental). And the script does too! How to get it working.. easy: in /etc/sysconfig/SuSEfirewall2 set: FW_IPv6="yes" or to anything else then "no", "drop" or "reject" and FW_IPv6_REJECT_OUTGOING="no" This works if you have native IPv6 _and_ IPv4 on the same device(s) (internal and or from isp) If you have an IPv6 over IPv4 tunnel you need to do the following extra items. This is necessary because the script logic cannot handle device detection/verification for pure IPv6 devices yet. So also change the following: FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" If that file is not there, you can copy it from /usr/share/doc/packages/SuSEfirewall2 And in that file add the following lines in the section fw_custom_before_antispoofing() ip6tables -A INPUT -j input_ext -i <tunnel device name goes here> ip6tables -A FORWARD -j forward_ext -i <tunnel device name goes here> restart the firewall and that did it for me. Your comments, remarks, are appreciated. BB, Arjen

2 2

ClamAV 0.82 -> 0.83 !
by Franz Alt 03 Mar '05

03 Mar '05

Hello, in the latest SUSE Security Summary Report from Feb, 18th there is mentioned that Suse patches to ClamAV 0.82. I would not suggest to install this particular update! We had installed ClamAV 0.82 last week under BSD Plattform and there were "false positives". This means ClamAV declared some E-Mails with Powerpoint attachments as Virus. There is already a newer version 0.83 at http://www.clamav.net/stable.php#pagestart where this malfunction seems to be corrected. Greetings Franz

16 25

Re: [suse-security] freedom of speech (was ClamAV 0.82 -> 0.83) !
by fractal 02 Mar '05

02 Mar '05

On Thu, 03 Mar 2005 12:54:59 +1300, fractal <fractal.design(a)slingshot.co.nz> wrote: > How very aggressive, but funny as hell. And right too I think. > I am glad I dont have to respond to Angry because you all have done such > a nice job of it allready. > > Welldone. > I cant wait to visit Germany in the future. > > > On Wed, 2 Mar 2005 17:51:59 -0500, Allen <gorebofh(a)comcast.net> wrote: > >> Oh finally I find this post I was looking for. And after reading it I >> now >> understand why the South only need half of what the North part of the US >> need to graduate high school. >> >> On Wed, Mar 02, 2005 at 11:57:24AM +0100, Jure Koren wrote: >>> On Wednesday 02 March 2005 07:05, Angry wrote: >>> > I do not understand German, but I do have ksteak on my system. >> >> LOL. >> >> >>> > If I want the support that my US dollars makes me entitled to, I must >>> > use this list. I have no problem with the fact that it is hosted in >>> > a country other than my own. >> >> Wow that's nice of you. Letting the little ones host it for you Eh? >> Standing up for Bush to a Distro based in Germany, where the developers >> are >> almost ALL German, and so am I.... Bush thought Germany was a Third >> World >> Country with no running water when he was elected. >> >> That should have been a sign you idiot republicans. and the Democrats, >> blah, "I give up"..... >> >> >>>> I have absolutely no problem with the >>> > person who ocassionally forgets and uses his native language on this >>> > list. >> >> Well that sure is sweet of you to allow them to speak..... And you talk >> about arrogance? >> >> >>> > However! Using this list to expouse political crap condeming the >>> > leader of a country, any country, is offensive, arrogant, out of >>> > order, uncalled for, and should be cause for being banned from this >>> > list! >> >> >> >> OH MY GOD I hope you're joking because I'm pissing myself with laughter. >> So >> you want to ban him from this list because you don't like his signature? >> Hmmm, wow, reminds me of the Dixie Chicks getting boycotted BECAUSE THEY >> WERE ASHAMED TO BE FROM TEXAS LIKE BUSH IS. >> >> Where is it you find that even REMOTELY contitutional? "I don't like >> what >> you say so you should be taken away"...... >> >> >> America was a proud country long ago, and the saying wasn't whaty it is >> now, it used to be "I may not agree with what you say but I'll defend to >> the death your right to say it". >> >> >> You're proof this country has lost the testicles it once had. >> >> If you don't like what someone says, DON'T LISTEN. >> >> Oh in case you like Dick Cheney, I call his followers DICK HEADS. >> >> Pill poppers are pill heads, Metal Lovers are Metal Heads, Dick Lovers >> are >> Dick Heads. :) Just think, someone in your family has given their life >> for >> my right to say that. >> >> Our forefathers would have set this country on fire if they knew it >> would >> be like this. You don't sit there in your little house telling everyone >> they are wrong or how to act you just accept not everyone is like you. >> It's >> called America and its supposed to be the land of the free. >> >> >>> > I fully expect that you, and all others, will refrain from posting >>> the >>> > likes of this, now, and in the future. >>> > I also expect an apology. To me, and to all the others on this list! >>> >> >> Oh you are a DUMB ass. Hell I'll sign you up for mailing lists that >> Republicans and Democrats hate just to piss you off now. Hell, maybe >> you'll >> get so fed up you'll turn the computer off and READ THE CONTITUTION. >> It's >> obviouse you never have. >> >> I expect an Apology too. You are breathing precious air for no reason >> because it's obviously not getting to your brain. Do us all a favor, >> grow >> gills and breath like a fish. >> >> Then you can get upset on IRC when someone hits you with a trout. >> >> An Apology for speaking his mind.... Heh, you're full of it. >> >> >> Now what are you going to do now? Ban my hit single form the Radio? >> Pfft. >> >> - The Gore Father. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >>> You are right, his signature may be a bit silly (from a given >>> perspective) to use on a security related mailing list. However, the >>> contents of the message, not the signature, were very relevant to this >>> list. I also believe it is up to the sender to decide how and when to >>> express his political opinions and I would definitely stand up for his >>> right to do so through a signature on a public mailing list, regardless >>> of what his opinion of anything might be. In some parts of Europe, such >>> freedom of speech is limited because of some of the not very pleasant >>> stuff that has happened to Europe in the last century. >>> >>> But Mr. Meissner has not been calling for anything but a boycott, which >>> is perfectly OK and although I don't think it might actually make the >>> world a better place, I'm quite fed up (for example) with the US and >>> Japan based corporations trying to impose a harmful patent legislation >>> in the EU by bribing the officials and would, if I was the vocal sort, >>> also describe this opinion in my signatures. Fortunately for all of the >>> politically sensitive types out there, I don't to this. >>> >>> Since the proposed patent legislation can have a very serious impact on >>> IT security, I think this is very on topic. I apologise to everyone who >>> disagrees. >>> >>> > > Keine Macht George W.Bush und seiner Junta zur Ausbeutung, >>> > > Unterdrückung, Wahlbetrug, Christianisierung, Terror, Weltmacht & >>> > > 'BigBrother-watching'. Für Freiheit und Demokratie, kauft keine >>> > > U$-Waren! >>> >>> Really, take it easy, it's just a signature. Besides, almost all US >>> exports are made in China, anyway, so nothing would change. And forced >>> democracy (the most important US export, afaik) is much like forced sex >>> (sorry, couldn't resist, oversimplifying is just so much fun). >>> >>> Oh yes, one more thing: you are free not to read the e-mail signatures. >>> >>> -- Jure Koren, n.i. >> >> >> -- fractal.design

1 0

Kernelupdate on SuSE 9.1 with problems
by Philippe Vogel 02 Mar '05

02 Mar '05

Hello! Since novell is here I get strange errors after each updates and it seems for me there is not enough error-checking of updates since then. The server (web & mailserver behind a firewall) has been rebooted after the kernel update to get changes affected on it. Now I see something is broken within latest kernelupdate. I get errors on FTP, imap, smtp while authentificating (strange, with samba and ssh there is no such error): FTP-Login: Status: Connecting with x.x.x.x... Status: Connecting with x.x.x.x. Waiting for welcome message... Antwort: 220 "Welcome message." Befehl: USER my_user Antwort: 331 Please specify the password. Befehl: PASS ***** Antwort: 500 OOPS: capset Antwort: 230 Login successful. Fehler: Connection cannot be established! E-Mail: I get errors that the server cannot be connected. Once I restart the related service I don't get any errors back. I didn't check if the error occurs a second time. Any suggestions? Architecture (if that helps): P4/3.0 GHz w. HT, Intel 865PE, Softraid (mirroring) Strange as well after update to 9.1 the loggs are too full and logrotate does not rotate them as well (any hints there as well?). Reguards Philippe

3 6

[Fwd: EMAIL INACTIVO]
by Philippe Vogel 02 Mar '05

02 Mar '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Can somebody fix that deactivated account on the list? Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQh6OoENg1DRVIGjBAQLvYwb9FC8uudB98/3xB5heNQFliGTWHujLiOkR RZMNoksytECnVNaRdj6mi31C536AmXr8eTJNETpqc8UTvXfbZaDtTqVarqp+uYTC ZzqsykL4Lk+VqcrHCVZnIInmEX/VvpgxwqWFGfkfU7YNEKuiH5Qwz67lD2iGZZOR /kGqWmSxuydJJhe6fmXcFM67/BCUk1gzO3Fj0DZdqmcXdHnnoR66vMp4QA0QiVEi cGdD9jihmdyEfa/SC7hq5Pxf+qcqa/MYgsKi5uqXQiFtudp97NgkrudHdH1OiUuh 35JMYFHoW34= =k2s3 -----END PGP SIGNATURE-----

5 9

Einbruchsversuch gelungen?
by Reiner Pietrzak 02 Mar '05

02 Mar '05

Hallo Liste, dies >> fand ich heute in meiner Logdatei: Mar 2 04:15:00 pxxxxxxxx /USR/SBIN/CRON[18880]: (root) CMD (/root/confixx/confixx_counterscript.pl) >>Mar 2 04:15:04 pxxxxxxxx su: (to nobody) root on none >>Mar 2 04:15:04 pxxxxxxxx su: pam_unix2: session started for user nobody, service su >>Mar 2 04:15:11 pxxxxxxxx su: pam_unix2: session finished for user nobody, service su Mar 2 04:16:00 pxxxxxxxx /USR/SBIN/CRON[19006]: (root) CMD (/root/confixx/confixx_counterscript.pl) Muss ich das als gelungenen Einbruchsversuch werten? Gruß Reiner Pietrzak

4 3

why does this list...
by Mathias Homann 01 Mar '05

01 Mar '05

... attract all those fools who are to dumb to fucking read four fucking lines of instructions? i mean, i'm on quite a lot of lists, not only suse lists, but others with similarly high traffic... and suse-security is the only list that keeps getting the fools. maybe someone at suse should rewrite the subscribe- and unsubscribe instructions, preferrably in short sentences. sentences of not more than three words, each of which should not have more than one syllable... -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

7 8