- openSUSE Security

suse-security
by Dan Amthor 06 Aug '99

06 Aug '99

unsubscribe

2 1

Problem with apache ssl (rpm package) and Netscpae 4.5, 4.6
by Joop Boonen 06 Aug '99

06 Aug '99

Dear all, I have the following problem. I'm running apache 1.3.6 ssl version. When i connect via a fortified version of Netscape or connect via opera or Internet Explorer or communicator 4.0x everything works fine even in 40 bits. But if i try to connect via communicator 4.5 or 4.6 than i get an error, corrupt data or something like that. It's probably cause by the extra bits that are sent back in Netscape. I mean for 40 bits they still encrypt in 128 bits but they announce 88 bits. Or is it cause by the 56 bits encryption? Does someone know how i can solve this problem. Regards, Joop Boonen.

1 0

Re: [suse-security] Recovering from a break in
by Chrissy LeMaire 06 Aug '99

06 Aug '99

Hello John, I also had a problem recently with a script kiddie. Oddly enough, a few days earlier, I purchased O'reilly's Practical Guide to Unix and Internet Security. Its really a great book that explains alot of things I needed to know.. but anyways, this is what I did after the breakin. Made a backup of non-binary items on my machine. Wiped the machine clean and installed SuSE 6.1 Used TCP wrappers, hosts.allow, deny, etc Downloaded the SuSE security updates with another machine, connected to that one and updated everything (making sure not to connect to the Internet until Tripwire ran) Once the updates were done, I ran Tripwire and backed up my database to a floppy. Checked all programs that were suid and attempted to save it to a file. I unzipped the kiddie's directory on another machine (i backed up his home dir) and after noticing that the "friend" left his rootkit in his home dir, I took a look at the README and some of the code. I noticed that it used chmod and chown..so I changed the permissions on that file, along with many others. passwd, su, ftp, etc Closed most services in inetd.conf Took out telnet, put in SSH I started using APOP authentication instead of Plain text password for POP3. Not only is APOP encrypted, but the passwords are totally different from users' login password..so if they are found, not much can be done besides checking the person's mail. I run logcheck every 15 minutes. http://www.freshmeat.net/appindex/1998/06/26/898905419.html I'm planning on also storing log files on another computer.. gotta find the time to figure it out. If i remember anything else, I'll let you know ;) Check out that O'reilly book, though..it rocks. I'll also send a rootkit readme next email, so that anyone who hasnt seen one has an idea of what goes on when its installed. About @Home, I attempted to report some kiddie-porn bastards that were on @Home. I sent it to abuse@home and only got a few automated responses. I gave up after a few weeks.. but I guess if worse comes to worse, just call @Home and let them know that you are serious. Perhaps you can even quote a few laws that protect you (the wonderous O'reilly book has more info on that). I also perused freshmeat.net's security section and found some fun things.. Chrissy At 10:05 PM 8/5/1999 -0400, you wrote: >Evening, > >I had a Suse-Box running 5.2. I checked the log files on a regular basis >with the exception of weekends. Anyways, I came in one Monday morning, >checked the log files and noticed 4 attempts. After furthur >investigation, I relized that one had actually compromised the system. > >First of all, it was quite obvious by the times, that one cracker found >the system and then told his buddies. They then set there sights on this >machine and eventual broke in. I also suspect that these were not really >knowledgable crackers, but some 15 old trying to impress his friends with >a standard root kit. > >Now here is the kicker. I went ahead and reinstalled the system. In the >process I upgraded to SusE 6.1. I also disabled all neccessary services. >Lastly, I used TCP wrappers to limited access to only specfic IP >Addresses. > >So here is the problem. These crackers are countinully trying to break >in. They have static ip addresses that belong to the @Home Network. >Cable modem subscribers. They have not suceeded. I have the system >locked down tight, but first of all, I need to keep the machine on the >network, and second I can not monitor the machine 24/7. Given that they >have more time, a weakness may be found. > >What real options do I have? @Home has not responded to my request for >help. > >John > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Linux Root Kit README
by Chrissy LeMaire 06 Aug '99

06 Aug '99

This if FYI.. I would have never been able to find this on my own.. but that kiddie left one of those root kits on my machine.. Its good reading for those who think they might have a root kit on their system: UPDATES 3.0 Everything updated with lastest sources for 2.X kernel. Added shadow support. Added trojan tcp wrappers. Removed sniffit and lled. Improved lots of stuff. This packages includes the following: chfn Trojaned! User->r00t chsh Trojaned! User->r00t inetd Trojaned! Remote access login Trojaned! Remote access ls Trojaned! Hide files du Trojaned! Hide files ifconfig Trojaned! Hide sniffing netstat Trojaned! Hide connections passwd Trojaned! User->r00t ps Trojaned! Hide processes top Trojaned! Hide processes rshd Trojaned! Remote access syslogd Trojaned! Hide logs linsniffer Packet sniffer! fix File fixer! z2 Zap2 utmp/wtmp/lastlog eraser! wted wtmp/utmp editor! lled lastlog editor! bindshell port/shell type daemon! tcpd Trojaned! Hide connections, avoid denies INSTALLATION To install this kit in its standard form execute 'make all install'. To install the shadow kit execute 'make shadow install'. All of the files/password configuration is in rootkit.h so feel free to personalise your own version of lrk3 :-) This kit is for linux 2.X kernels ONLY so don't complain when nothing works on old systems. USAGE OK I will go thru how to use each program one by one. NOTE when I say password I mean the rootkit password not your users password (doh!). By default the rootkit password is lrkr0x. chfn - Local user->root. Run chfn then when it asks you for a new name enter your password. chsh - Local user->root. Run chsh when it asks you for a new shell enter your password. inetd - Don't even *think* about asking ;-) It ain't that hard.. login - Allows login to any account with the rootkit password. If root login is refused on your terminal login as "rewt". Disables history logging when backdoor is used. ls - Trojaned to hide specified files and dirs. The data file is ROOTKIT_FILES_FILE, defaults to /dev/ptyr. All files can be listed with 'ls -/' if SHOWFLAG is enabled. (see rootkit.h) The format of /dev/ptyr is: ptyr hack.dir w4r3z ie. just the filenames. This would hide any files/dirs with the names ptyr, hack.dir and w4r3z. du - Same as ls, 'cept for du instead :) ifconfig - Modified to remove PROMISC flag when sniffing. netstat - Modified to remove tcp/udp/sockets from or to specified addresses, uids and ports. The file is ROOTKIT_ADDRESS_FILE. default data file: /dev/ptyq type 0: hide uid type 1: hide local address type 2: hide remote address type 3: hide local port type 4: hide remote port type 5: hide UNIX socket path example: 0 500 <- Hides all connections by uid 500 1 128.31 <- Hides all local connections from 128.31.X.X 2 128.31.39.20 <- Hides all remote connections to 128.31.39.20 3 8000 <- Hides all local connections from port 8000 4 6667 <- Hides all remote connections to port 6667 5 .term/socket <- Hides all UNIX sockets including the path .term/socket passwd - Local user->root. Enter your rootkit password instead of your old password. ps - Modified to remove specified processes. The file used is ROOTKIT_PROCESS_FILE, default to /dev/ptyp. An example data file is as follows: 0 0 Strips all processes running under root 1 p0 Strips tty p0 2 sniffer Strips all programs with the name sniffer 3 hack Strips all programs with 'hack' in them ie. proghack1, hack.scan, snhack etc. Don't put in the comments, obviously. Note: if this doesn't seem to work make sure there are no spaces after the names, and don't use the full path name. top - Identical to ps, 'cept for top instead. rshd - Execute remote commands as root. Usage: rsh -l rootkitpassword host command ie. rsh -l lrkr0x cert.org /bin/sh -i would start a root shell. syslogd - Modified to remove specified strings from logging. The data file is ROOTKIT_LOG_FILE, this defaults to /dev/ptys. Example data file: evil.com 123.100.101.202 rshd This would remove all logs containing the strings evil.com, 123.100.101.202 and rshd. tcpd - Modified to allow access from your host without any logging. Any type 1 record in the ROOTKIT_ADDRESS_FILE is used for tcpd. See netstat for more infoz on this file. Example data file: 1 123.4.5.6 would set up the tcp wrappers to allow and hide connects from 123.4.5.6. linsniffer - A kewl packet sniffer. U might like to check out another sniffer for linux if this doesn't suit ya needs. (ie. sniffit, pcs, snoofer, whatver). I removed sniffit for space reasons, if you want it the latest version can be found at http://reptile.rug.ac.be/~coder/sniffit/sniffit.html fix - Replaces and fixes timestamp/checksum infomation on files. New lrk3 version :-) z2 - Zapper2! Run this to erase the last utmp/wtmp/lastlog entries for a username. This can be detected since it just nulls the entry out. wted - This does lots of stuff. U can view ALL the entries in a wtmp or utmp type file, erase entries by username or hostname, view zapped users (admins use a util similar to this to find erased entries), erase zapped users etc. .......Other useless info deleted....... Hope this helps, Chrissy

1 0

tiny firewallscript problem
by DreeVee 05 Aug '99

05 Aug '99

hi, I think this is a Q appropriate for the sec-list. It's a problem trying to run a firewall. And Q is: what's wrong with the below script. It' should run on a cablemodem (24 hour connection) It's slightly changed script from friend running debian for many years (and using cable) problem is: if i make alow rules for specific ip's they do not work with this script (there are no external allowrules in below example, but you get the picture) this firewall script seems to work fine, but when it's run it still blocks FTP_ALLOW rules. Is it because the order of flushing/opening firewall rules is wrong (it seems to work by debian friend) is it because SuSE 6.1 is different in this (than debian, some other great help from debianfriend had similair problems) the script is simply started in runlevel2 with a highnumber (99) i first used wu_ftpd, changed it to prof_ftpd and FWIW got rid of sendmail and implemented qmail qmail working fine, both ftpd same mentioned problem The script follows here (i think i do not need to bother to use bogus ip's) #!/bin/bash /usr/bin/clear # cablemodem ip ETH0="194.134.147.93" # local subnet ETH1="192.168.0.151" # subnetmasks SUBNET1="192.168.0.0/24" # goes without saying ALL="0.0.0.0/0" LOCALHOST="127.0.0.1" LOCALHOSTNET="127.0.0.0/8" HIGHPORTS="1024:65535" LOWPORTS="1:1024" # localnet # localboxes (linux/win95) DVXSNET="192.168.0.151" DREEVEE="192.168.0.150" #etcetera for other win boxes # one var for it USERS="192.168.0.151 192.168.0.150" # denies all CCS="62.172.74.0/24" BSA1="209.70.21.0/24" BSA2="194.7.253.0/24" DENY_ALL="62.172.74.0/24 209.70.21.0/24 194.7.253.0/24" # ftp denied # people we do not want on ftp RUUD="194.134.144.26" # rather not euronet EURONET_SERVICE="194.134.32.134" # no proxy access from cablecomp cause off logging PROXY="194.134.132.31" PROXY1="194.134.132.32" PROXY2="194.134.132.33" PROXY3="194.134.132.34" PROXY4="194.134.132.35" PROXY5="194.134.0.98" PROXY6="194.134.0.166" PROXY7="194.134.52.178" # get them in var's FTP_DENIED1="194.134.144.26 194.134.32.134 194.134.132.31 194.134.132.32 194.134.132.33 194.134.132.34 194.134.132.35" FTP_DENIED2="194.134.0.98 194.134.0.166 194.134.52.178" # leechers, bo/netbus en portscanners FTP_DENIED3="194.134.144.33 194.134.144.140 194.134.133.42 194.134.140.35 194.134.146.80 194.134.133.168 194.134.130.14" FTP_DENIED4="194.134.146.107 194.134.144.181 194.134.152.34 194.134.144.9 194.134.144.53 194.134.138.31" # no euro chello scan on ftpservers # 195.75.224.71 Chello's own portscanner CHELLO_DENY="195.75.224.71 " echo "Starting Firewalling." # default firewall rules.....attitude open free /sbin/ipchains -P input ACCEPT /sbin/ipchains -P output ACCEPT /sbin/ipchains -P forward DENY # flush previous rules /sbin/ipchains -F input /sbin/ipchains -F output /sbin/ipchains -F forward # denying some hosts every access /sbin/ipchains -A input -p all -j DENY -s $CCS -i eth0 -d $ETH0 /sbin/ipchains -A input -p all -j DENY -s $BSA1 -i eth0 -d $ETH0 /sbin/ipchains -A input -p all -j DENY -s $BSA2 -i eth0 -d $ETH0 # localhost to localhost traffic /sbin/ipchains -A input -j ACCEPT -s 127.0.0.1 -d 127.0.0.1 echo "Setting up ipspoofing." # no seperate ipspoofing rules, kernel can handle these rules if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo "Setting up spoofprotection!!!!" for f in /proc/sys/net/ipv4/conf/*/rp_filter;do echo 1 > $f done fi # icmp calls..only the important ones are permitted /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 0 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 3 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 8 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 11 -d $ETH0 /sbin/ipchains -A input -j DENY -i eth0 -p icmp -s $ALL 5 -d $ETH0 # No chello scans on ftp and webports allowed. for i in $CHELLO_DENY;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 www done echo "Accepting mail, ssh logins, auth, apache server" # auth needed by many servers # such as smtpservers /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 ssh /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 smtp /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 www /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 auth # only local subnet permitted to do pop3 # from remote they will need SSH /sbin/ipchains -A input -j ACCEPT -i eth1 -p tcp -s $SUBNET1 -d $ETH1 pop3 echo "Setting up ftp server rules." # all rules access deny ftpserver.... for i in $FTP_DENIED1;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED2;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED3;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED4;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done # rule on ssh, seems to use port 1020-1024 /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 1020:1024 ! -y # log telnet and finger /sbin/ipchains -A input -j DENY -i eth0 -p tcp -l -s $ALL -d $ETH0 23 /sbin/ipchains -A input -j DENY -i eth0 -p tcp -l -s $ALL -d $ETH0 79 # deny lowports accept the ones excepted above # nothing open what we do not want /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $ALL -d $ETH0 :1024 /sbin/ipchains -A input -j DENY -i eth0 -p udp -s $ALL -d $ETH0 :1024 echo "Masquerading." for i in $USERS;do /sbin/ipchains -A forward -j MASQ -s $i -d $ALL done # put on forwarding, now everything is operating as we want echo "Enable forwarding ( echo 1 >> /proc/sys/net/ipv4ip_forward ).. " echo "1" > /proc/sys/net/ipv4/ip_forward echo "done." <<end of script, working on this for weeks now and it was a hot days>> dv

1 0

Cracker attack using ftp?
by Jan Theofel 05 Aug '99

05 Aug '99

Hello! Here are two lines of my /var/log/messages: Aug 4 21:16:22 www wu.ftpd[25329]: connect from root(a)212.160.104.141 Aug 5 02:49:53 www wu.ftpd[25641]: connect from root(a)212.160.104.141 They seem a little bit strange to me that a root on some box will trying FTP to our server. I tought it might be perhaps and cracker who got root access to another server. (Altough this IP can't be resolved by nslookup, which should indicate that it isn't a server.) But in my /var/log/xferlog, there's no traffic at these times. What does that mean? Bye, Jan BTW: My server identifies as: 220 www.rst-consulting.de FTP server (Version wu-2.4.2-academ[BETA-12](1) Sun +Jan 19 23:05:28 CST 1997) ready. -- +-------------------+--------------------------------------------------------+ | Jan Theofel | rst Unternehmensberatungs- und Handelsgesellschaft mbH | | Webadministrator | Bahnhofstrasse 35, 71272 Renningen | | | Tel.: 07159/800-450 Fax: 07159/800-451 | +-------------------+--------------------------------------------------------+

3 2

Re: [suse-security] sendmail
by gaby dapremont 05 Aug '99

05 Aug '99

Usually, news groups are not to ask how to do something, unless you discover a problem. This is to bring-up problems and solutions. Please people, stop to send so many bullshit mails. TAKE A BOOK ! --- Silvia Nieto <snieto(a)sc.sas.cica.es> wrote: > Hello, > > I'd like to know how can I desinstall sendmail > 8.8.8 ? and how can I > install sendmail 8.9.3 ? > > Thank you > > > -- > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > > _____________________________________________________________ Do You Yahoo!? Free instant messaging and more at http://messenger.yahoo.com

6 5

RE: [suse-security] New users, how?
by Wayne, Steven L SSI-TSEA-353 05 Aug '99

05 Aug '99

>-----Original Message----- >From: Murdo MacKinnon ( Mac ) [mailto:murdo.mackinnon3@virgin.net] >Sent: 08 August 1999 19:36 >To: cognition(a)bigfoot.com; Wayne, Steven L SSI-TSEA-353 >Cc: suse-security(a)suse.com >Subject: RE: [suse-security] New users, how? > > > >Can soone please unsubscribe me from al of this as I have had enough >I tried to unsubscribe 5 times >Still the problem you will no doubt say is my microsoft > >STOP THE MAIL > See this: To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com It's at the bottom of everyones posts. Did you do it? -- If a man stands in the middle of the forest speaking and there is no woman around to hear him....Is he still wrong?

2 1

CFS
by bedau＠hmi.de 05 Aug '99

05 Aug '99

Does anybody know where I can get the cryptographic file system CFS (or another one for which I don't have to modify the kernel) outside the USA? Thanks Daniel -- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Daniel Bedau Tel.: x49 30 8062-3010 Hahn-Meitner-Institut Berlin Fax.: x49 30 8062-2434 Physikalische Chemie / CS E-Mail : bedau(a)hmi.de Glienicker Strasse 100 PGP-key available D-14109 Berlin +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 2

RE: [suse-security] New users, how?
by Kenneth Peiruza 05 Aug '99

05 Aug '99

> > > > > On Mon, 2 Aug 1999, Jan Theofel wrote: > > > > > useradd Nope! It's more fun by hand! Modify: /etc/group /etc/passwd /etc/shadow Create a home directory and copy everything from skeleton ( /etc/skel ) Once you know how to do it by hand, try the easy way. But if you're using SuSE... why don't use yast? In System Administration you can choose "User Administration" or something similar (I use a non English version...) > > > > Thanks to everyone who pointed out this command. (and I thought _Linux in > a NUTSHELL_ had all the answers!) > > Der wille zur macht! I'm Not German.

3 2