March 2005 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:45 PM > > http_port 443 > # Port of Squid proxy > httpd_accel_host 192.168.55.20 > # IP address of web server > httpd_accel_port 443 > # Port of web server > httpd_accel_single_host on > # Forward uncached requests to single host > httpd_accel_with_proxy on > httpd_accel_uses_host_header off > > Try this... https_port is configured to 443, httpd_port is only a dummy done the rest, same error like befor

1 0

RE: [suse-security] OWA with squid 2.5 stable6, problem with connect
by Dörfler Andreas 23 Mar '05

23 Mar '05

> -----Original Message----- > From: Barry Gill [mailto:barrulus@outies.co.za] > Sent: Wednesday, March 23, 2005 12:31 PM > > > > httpd_accel_host srv066 > > > While trying to retrieve the URL: http://srv066 > > Can you ping srv066 from your squid box? > > If not, you need to make httpd_accel_host a resolveable name. > Just a thought. > ping is blocked but connect on 80 and 443 are possible from this host name to ip works fine srv066 - 192.168.55.20 found in cache.log: 005/03/23 12:33:26| Failed to select source for 'http://192.168.55.20/' 2005/03/23 12:33:26| always_direct = 0 2005/03/23 12:33:26| never_direct = 1 2005/03/23 12:33:26| timedout = 0

1 0

Re: [suse-security] Linux and forkbomb - with link
by Bernhard Held 22 Mar '05

22 Mar '05

> Because we have unlimited ulimits by default. > > To fix that: > Install the "ulimit" package. > Adapt /etc/sysconfig/ulimit to your needs. Installing ulimit.rpm broke capi4hylafax, which appends the line fr:35:respawn:/usr/bin/c2faxrecv -q "/var/spool/fax" in /etc/inittab. This runs fine without ulimit.rpm, but together with initscript c2faxrecv chokes on the double quotes. I couldn't find out who's responsible for removing the quotes, therefore I simply removed them in inittab. It seems to be a long standing bug, maybe someone at suse could have a look. Bernhard

2 1

pam_ldap patch not applied correctly in 9.1 and 9.2
by Prakash Velayutham 21 Mar '05

21 Mar '05

Hi All, I have several SuSE Pro 9.0, 9.1 and 9.2 systems. One of these systems is running openldap2 server and the other systems are clients of this LDAP server and authenticate against it. I use pam_ldap and nss_ldap on the clients. Recently I realized that my users are able to change their LDAP passwords using "passwd" utility only from the 9.0 clients and not from the 9.1 and 9.2 clients. The error is something like: user@hostname:~> passwd Changing password for user. Enter login(LDAP) password: New password: Re-enter new password: LDAP password information update failed: Can't contact LDAP server use bind to verify old password Password changed. In the clients warn logs I see something like "pam_ldap: ldap_extended_operation_s Server is unwilling to perform". After googling and searcing around for almost 2 days, I discovered that SuSE did not apply a patch to pam_ldap.c file from the pam_ldap distribution on the recent systems (at least on the 9.1 source RPM I did not see the change suggested by PADL). Here it is if anyone wants it. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_ID, session->info->userdn); - ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password); +/* ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_OLD, old_password);*/ ber_printf (ber, "ts", LDAP_TAG_EXOP_X_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); In 9.1 sources, I saw this instead. ber_printf (ber, "{"); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_ID, session->info->userdn); /* this doesn't appear to be necessary anymore */ ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_OLD, old_password); ber_printf (ber, "ts", LDAP_TAG_EXOP_MODIFY_PASSWD_NEW, new_password); ber_printf (ber, "N}"); Once I commented out the necessary line, and rebuilt the RPM I could use "passwd" to change the user password in LDAP. Regards, Prakash

1 0

Linux and forkbomb - with link
by Jim Flanagan 21 Mar '05

21 Mar '05

Sorry, my earlier post did not include the link to the story at securityfocus.com Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. http://www.securityfocus.com/columnists/308?ref=rssdebia -- Jim Flanagan linuxjim(a)jjfiii.com

9 11

AW: [suse-security] Default policy setting with iptables
by Stefan.Junge＠ssi-schaefer.de 21 Mar '05

21 Mar '05

Hi together, I think I have solved the problem. The solution is to set the flush rules for each chain iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -t nat -F iptables -X But now all dropped packets will be logged on console. Does somebody have an idea ? Thanks for help Stefan

1 0

What's the story on apache2
by BoneMachine 19 Mar '05

19 Mar '05

Hi, I received a security summery from suse (2005:008). It states that there is a vulnerability in apache2. After following the lead from the changelog of the updated suse-apache rpm i reached a bugreport at Apache. http://issues.apache.org/bugzilla/show_bug.cgi?id=27945 The thing I don't get is if the apache child process crashes or if the entire server crashes. Could this issue be exploited to bring the entire apache down? Can someone who has had trouble with this issue explain symtoms like log-messages ? TIA Bone Machine --- "Hip hip hip" - The Pixies

3 2

Re: [suse-security] Problem with SuSEfirewall and Postfix SMTP?
by Jürgen Mell 19 Mar '05

19 Mar '05

Hi, On Friday 18 March 2005 02:40, M. Edwin wrote: > Jürgen Mell wrote: > > Hi List, > > Hello > > > today we had an outage of our internet provider. The connection was > > broken for several hours during which the mail server of the internet > > provider stored our e-mails. Now after the connection is established > > again these mails are sent to our own mail server from the provider's > > server at a pretty high rate. > > > > Our system is SuSE 9.2 with Postfix 2.1.5 as the SMTP server and the > > SUSEfirewall which comes with 9.2. All current patches are applied. > > What is the setting of firewall in connection with SMTP? FW_SERVICES_EXT_TCP="http https smtp ssh ftp" Adding FW_TRUSTED_NETS="<Provider's mailserver IP>,tcp,25" did not change anything. > > > The problem now is that after a small number of mails from our > > provider the SMTP server does not accept any more connections. Instead > > it complains about timeouts, lost connections or SMTP EOFs. When > > telnetting to the server in this state a connection is made but there > > is no prompt "220 <servername> ESMT Postfix". The only way to fix this > > I found up to now is restarting Postfix (the cron job does it now > > every 3 minutes...) but that is only a very crude fix. Even setting > > the max_use parameter in main.cf to 1 to get a new smtpd for each > > connection does not help. Has anybody an idea what is causing this > > behaviour? Is it the firewall or is it Postfix or anything else who is > > limiting the connections? There are some firewall errors in the logs, > > but not nearly as many as the lost connections of the SMTP server: > > > > Mar 17 21:52:18 pluto kernel: SFW2-OUT-ERROR IN= OUT=dsl0 SRC=<our IP> > > DST=<Provider's mail server IP> LEN=52 TOS=0x00 PREC=0x00 TTL=64 > > ID=3530 DF PROTO=TCP SPT=25 DPT=58506 WINDOW=1404 RES=0x00 ACK RST > > URGP=0 OPT (0101080A015E41E40C059CEB) > > > > Any help would be greatly appriciated! > > How if someone send you email directly, or are there any email you > receive after the connection establish again. Postfix restarts the smtp daemons after some time. Then we can receive mail again for some minutes but after that the system is blocked again. > How is the record of your DNS (MX record)? nslookup with querytype=MX tells <our domain> mail exchanger = 20 <Provider's mail server>. <out domain> mail exchanger = 10 mail.<our domain>. Ciao Jürgen

5 9

Linux and forkbomb
by Jim Flanagan 18 Mar '05

18 Mar '05

Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. -- Jim Flanagan linuxjim(a)jjfiii.com

1 0

Linux and forkbomb
by Jim Flanagan 18 Mar '05

18 Mar '05

Are any of the currently supported Suse versions suseptable to this forkbomb attack? I'm not very sure what it is, but I'm sure many of you are. I'm running suse 8.2 pro and 9.1 pro. -- Jim Flanagan linuxjim(a)jjfiii.com

1 0