May 2005 - openSUSE Security - openSUSE Mailing Lists

Strange events being triggered in Snort
by Neil Anderson 20 May '05

20 May '05

Hi, I'm hoping that someone will be able to shed some light on a bit of a strange problem I'm having with snort, snortcentre 2.x and BASE. This is a home set up so the sensor is also used for more mundane tasks like mySQL, Apache, web browsing, playing games etc. It seems that whenever the sensor makes a DNS query, it triggers an event in BASE with an SID of 9. Now, as far as I can see, event SID 9 doesn't exist. The set up is as follows: - Sensor runs SuSE 9.3 Pro with mySQL, Apache and snort - Snort is handled via SnortCentre 2.x which is configured to save alerts to an SQL database that BASE reads. - I have set $HOME_NET to be the private subnet of my LAN - I have set $EXTERNAL_NET = !$HOME_NET - Searching for SID 9 in snortcentre and on the snort webpage yields no results I have also had a look at the underlying databases. BASE's database has an entry for SID 9, but SnortCentre's doesn't. Any help or ideas would be gratefully receieved - I'm stumped. Thanks, Neil

1 0

RE: [suse-security] *****SPAM***** Tuerkei in die EU
by Carlos E. R. 20 May '05

20 May '05

Please, answer on list. If you reject dynamic adresses, I will not be able to email you direct. El 2005-05-19 a las 19:58 -0400, Dana Hudes escribió: > If the ISP didn't listen and users found they could not get to yahoo and > playboy and hotmail and 500 other of the top 1000 sites on the web because > their ISP was harboring hackers and spammers -- they would go elsewhere > and the ISP would go out of business. You are wrong. You live in a part of the world where that's may be true, but in mine I don't have so much choice, I can't go elsewhere. Many of the alternatives in fact hire resources from the main one. -- Saludos Carlos Robinson

1 0

Mozilla 1.0.4
by Anthony Edwards 19 May '05

19 May '05

RPMs for Mozilla 1.0.4 are now available at: http://ftp.suse.com/pub/projects/mozilla/firefox/1.0.4/ Are Mozilla 1.0.4 RPMs due to be made available via YOU shortly? -- Anthony Edwards anthony.edwards(a)uk.easynet.net

7 8

Re: [suse-security] *****SPAM***** Tuerkei in die EU
by Arjen Runsink 19 May '05

19 May '05

Hi ppl, > GEWALTEXZESS: > http://www.spiegel.de/politik/ausland/0,1518,345203,00.html To block this spam coming from Sober.P/Q infested windows systems there is a dnsblacklist and an ip list you can mirror if you whish. To make one thing clear. I am NOT the maintainer of these. sober-p.dnsbl.hostingxs.nl source: http://bas.dds.nl/rechtse-spam/rbl.sender-ips.txt BB, Arjen ----- Einde doorgestuurd bericht -----

2 3

best way to secure /dev/shm?
by Olivier Mueller 18 May '05

18 May '05

Hello, The last suse systems attacks I had to 'clean-up' were all based on php scripts copying and starting some stuff in /dev/shm. To improve the security a little bit, I'd like to have this pseudo filesystem 'noexec,nosuid' (like /tmp), but under suse linux it's not in the /etc/fstab (cf. http://www.eth0.us/?q=tmp for some other ideas). Is the only way to achieve that editing directely /etc/init.d/boot.shm ? It seem to be the case: in /etc/sysconfig/kernel you can only set the size, but not the other options... (suse 9.2 in this case) Or how would you do it? Btw, is that /dev/shm *really* necessary? :) regards, Olivier

2 1

RE: [suse-security] Re: cracked system?
by Barry Gill 18 May '05

18 May '05

Sorry Arjen, that was supposed to go to the list, not to you directly :( -----Original Message----- From: Arjen de Korte [mailto:suse+security@de-korte.org] Sent: 18 May 2005 10:14 AM To: Barry Gill Subject: RE: [suse-security] Re: cracked system? > The problem is you are trying to find a workaround to a system that is > oput in place by people who are trying to protect the legitimacy of > their own domains. I was not the one asking this question. In fact, I enabled SPF checking on my inbound MTA's over a year ago, at the same time when I created SPF records for all the domains I control. > If you were on my company domain where I have SPF set up and tried to > send from a home dsl smtp service, not only would I publically flog > you for breaching the policies I put in place to protect my network, I > would remove all mail rights from you for a period until you are made > fully aware of the implications of what you are doing. All my users use SASL authentication and submit their e-mail trough the submission port (I'm well aware of the implications), so you are preaching to the choir. :-) > SPF does not make your life difficult, but it helps people around the > world track down spammers and ultimately prosecute them. Unfortunately we're not even near this and there are still many technical issues surrounding SPF (forwarding is only one of them). Large scale adoption of very restrictive SPF records is too soon IMHO and looking at the GMX site (which is the large German ISP where the OP had problems with) they could (should) have done a much better job in explaining the implications of their very restrictive policy (they publish -all at the end of their record). Best regards, Arjen

1 0

fix for new elf loader bug?
by Frank Steiner 18 May '05

18 May '05

Hi, is it safe to assume that Gregs patches.fixes/elf-coredump-fix one can find in the sles9-SP2 branch of the kotd is valid for the other SuSE kernels, too? It can be applied and according to Paul Starzetz description should suffice to fix the bug. cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

5 11

problem with ACLs and scp file creation
by Ashley Gould 17 May '05

17 May '05

Hi list, I've been tinkering with filesystem ACLs. I get mysterious behavior (read: I think it's a bug) when I create files over scp/sftp in a directory with default acl. The newly created file loses the mask acl. This is on SLES9, kernel 2.6.5-7.151-default, OpenSSH_3.8p1 filesystem is reiserfs 3.6.13 the target directory has acl rwx and default acl rw for isclib: isclib@venus:/ftphome/ftpusr3/get/caf> ls -ld . dr-xrws---+ 2 ftpusr3 cafftp 48 2005-05-16 16:05 . isclib@venus:/ftphome/ftpusr3/get/caf> getfacl . # file: . # owner: ftpusr3 # group: cafftp user::r-x user:isclib:rwx group::rwx mask::rwx other::--- default:user::r-- default:user:isclib:rw- default:group::rw- default:mask::rw- default:other::--- If i create a file locally the permissions and ACLs come out correct: isclib@venus:/ftphome/ftpusr3/get/caf> touch test.local isclib@venus:/ftphome/ftpusr3/get/caf> la test.local -r--rw----+ 1 isclib cafftp 0 2005-05-16 16:15 test.local isclib@venus:/ftphome/ftpusr3/get/caf> getfacl test.local # file: test.local # owner: isclib # group: cafftp user::r-- user:isclib:rw- group::rw- mask::rw- other::--- but when I create the file via scp, the resulting acl for mask is empty, and my effective acl is no access: agould@isis:~/tmp> scp testfile isclib@venus:/ftphome/ftpusr3/get/caf/test.scp testfile 100% 0 0.0KB/s 00:00 isclib@venus:/ftphome/ftpusr3/get/caf> la test.* -r--rw----+ 1 isclib cafftp 0 2005-05-16 16:15 test.local -r--------+ 1 isclib cafftp 0 2005-05-16 16:29 test.scp isclib@venus:/ftphome/ftpusr3/get/caf> getfacl test.scp # file: test.scp # owner: isclib # group: cafftp user::r-- user:isclib:rw- #effective:--- group::rw- #effective:--- mask::--- How can I get around this problem? -- -ashley Did you try poking at it with a stick?

2 2

Re: [suse-security] cracked system?
by Carlos E. R. 17 May '05

17 May '05

El 2005-05-17 a las 19:50 +0200, Dr. Axel Krebs escribió: > > Use anti spam filters, like spamassassin. > Checked their webpage. Looks not "newbie-like" True. But it comes with the distro, it is easy to setup. At least, doable :-) > > I don't think you machine has been compromised. > Can I proove this? > > > Those email accounts do > > not even reside on your machine, if I understood correctly your setup. > How can i make sure on this? Ok. I understand you don't run you own mail service. You get your mail accounts from several providers, businesses, professional groups, clubs, whatever (t-online, tiscali, etc). Same as I do. When some body emails us, the emails are sent to the machines that those providers set up for that purpose, not to our computer, that might be even powered off at the time. When you want to read your email, you connect and then fetch the emails from the different servers (pop3, imap), then read, answer, whatever. So it is not your machine that is "compromised" or hacked. There is no need to do so to spam us, therefore, that alone is not proof of being hacked. > > > Thereby, I mean: how can I reject unwanted mail? > > > > Don't ever "reject", then you are busted. Simply throw them to the > > garbage. > Understood. If you check the rest of the answers in the thread, you will see there is a difference between "reject" and "bounce". It is the "bounce" that is most dangerous, and the only one we, final users, can do. The mail servers can do a "reject". Too technical, forget it. :-) > > > A simple "How-To", Tutorial or so preferable. > > > > > > 3.) For future, I like to prevent from re-establishing those trash-mails > > > again: how can I prevent unknown people from using "my adresse"? > > > > Impossible :-/ > Blockheads! We can make it more difficult. Using spamassassin is usually good enough: with the Bayesian filters it can catch over 95% of the spam. There are other measures. Bear in mind, anyway, that the strictest your setup, you not only make spammers life more difficult, but also that of innocent bystanders. That's for a long conversation, but you can glean some for the conversations in this and other lists. > > > > > > > > 3.a) My fear is, that my emails addresses "travel" uncontrolled. Is > > > there a way to control? (I know, this seems to be naiv) > > > > Impossible. > Freedom- the other side? Once your email is known "to the dark side", they don't forget. Now and the, they make a mistake; I got mailed a list of addresses containing perhaps thousands of email addresses. They sell it, I think, but they sent it to me who knows why. Therefore, once your email starts circulating, you can't stop it. > Thanks a lot for your detailed remarks, Carlos! > At this point I have to find out how to proceed stepwise. Install spamassassin, it is included in the distro. There are readmes. The exact procedure depends on your setup. Ask in the suse-linux-e list or suse-linux, for example, for advice. I'm also in search of a good document for SA, but at least, there is a FAQ. -- Saludos Carlos Robinson

1 0

cracked system?
by Dr. Axel Krebs 16 May '05

16 May '05

Hi! I am "Newbie", using SuSE 9.1. DSL from T-Online. Xmain Evolution 1.4.6. Last weeks, I am experiencing mails from unknown people to my email-adresses. Sometimes two or three mails within a few seconds. These are accounts with T-Online, Ginko, Web.de. I looks as "they" knew all may emailadresses. I'm asking myself, if there is a general(?) procedure how to get rid off these potential parasites? These scheme should follow these steps: - analyse - evaluation - proof of solution QUESTIONS: 1.) Is there a (simple?) way to deciffer... 1.a) who is doing what on my system, 1.b) how do they come there 2.) Does anybody know, how I can "clean" my system, in ideal case without changing Email-Adresses (printed an business cards). Thereby, I mean: how can I reject unwanted mail? A simple "How-To", Tutorial or so preferable. 3.) For future, I like to prevent from re-establishing those trash-mails again: how can I prevent unknown people from using "my adresse"? 3.a) My fear is, that my emails addresses "travel" uncontrolled. Is there a way to control? (I know, this seems to be naiv) 3.b) How can I reject unwanted mail? 3.c) Do I need to create positive liste following the thought: who may send me an email (filtering)? A simple "How-To", Tutorial or so preferable for the above mentioned questions. Thank you for all useful hints! (P.S.: as I said: I am newbie) -- Dr. Axel Krebs <Axel.Krebs(a)T-Online.de>

10 11