[SECURITY] [DSA 198-1] New nullmailer packages fix local denial of service

2002-11-18 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 198-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 18th, 2002

Re: unsubscribe

2002-11-18 Thread Michael Renzmann
Hi. Matt Andreko wrote: When does it end with the unsubscribes? When does it end with people complaining about the unsubscribes that has been sent to the list? Bye, Mike -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: [OT] unsubscribe

2002-11-18 Thread Arne Schwabe
Phillip Hofmeister [EMAIL PROTECTED] writes: Maybe one of us could set up a procmail filter to bounce the request to the -request box? Just an idea... Mailman already has a config option for that, seem not to be switched on by the admins. Arne --

SmartList sucks was Re: [OT] unsubscribe

2002-11-18 Thread Jamie Heilman
Mailman already has a config option for that, seem not to be switched on by the admins. Debian mailing lists are managed using the ironically named SmartList software. Transitioning to better software probably isn't a high priority due the significant number of lists already deployed. --

Re: unsubscribe

2002-11-18 Thread Michelle Konzack
Hello Martin, Am 22:54 2002-11-15 +0100 hat Martin Godisch geschrieben: On Fri, Nov 15, 2002 at 15:42:19 -0600, Leonard Leblanc wrote: :0: * ^Subject: unsubscribe * ^X-Mailing-List: debian-.*@lists\.debian\.org /var/mail/probably-uninteresting Just think, you'd be missing out on this

Re: Bastille...

2002-11-18 Thread Michelle Konzack
Am 01:22 2002-11-16 +0100 hat Tore Nilsson geschrieben: //tore Attachment Converted: \\pc6\clients\tamay\mail\attach\Bastille.htm Can you send this message only once and without HTML-Attachment ??? Michelle -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe.

Re: please do not ...

2002-11-18 Thread Michelle Konzack
Hmmm, Downloading E-Mails woth Mobil-Telephone like me ??? It is better if you send E-maols to this list WITHOUT HTML-ATTACHMENTS !!! Michelle Am 11:55 2002-11-16 +0100 hat poczta geschrieben: people, do not respond to 'unsubscribe' messages, 'cause from on mail it grows to many

NetFilter connection tracking

2002-11-18 Thread Olaf Meeuwissen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear .debs, I've setup iptables on my woody box with a policy to drop. After some tinkering I'd punched holes for the things I wanted to do (note this is a *client* machine). Then I got into the wonders of setting up rules for active and passive

Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
Hello Maik M8acter backward [EMAIL PROTECTED], I am looking for a VPDN solution for Linux and Windows. But openvpn does not seem to have Windows client. I've tried frees/wan on Linux, but it is not that easy to implement frees/wan client on Windows. Well, there is pptp client on Windows and

Re: Re[2]: VPN question

2002-11-18 Thread robjeh
Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this sollution you can use the default windows vpn client. But i think this isn't really safe. Grtnx, Robbert Citeren Patrick Hsieh

Re: VPN question

2002-11-18 Thread sean finney
On Mon, Nov 18, 2002 at 10:39:11PM +0800, Patrick Hsieh wrote: I am looking for a VPDN solution for Linux and Windows. But openvpn does not seem to have Windows client. I've tried frees/wan on Linux, but it is not that easy to implement frees/wan client on Windows. Well, there is pptp client

Re: Re[2]: VPN question

2002-11-18 Thread Phillip Hofmeister
On Mon, 18 Nov 2002 at 04:07:52PM +0100, [EMAIL PROTECTED] wrote: Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this mschapv2 == unsecure. TONS of paprs on the net if you wish to

Re: VPN question

2002-11-18 Thread Andrea Frigido
Alle 13:02, giovedì 14 novembre 2002, Lionel Elie Mamane ha scritto: On Thu, Nov 14, 2002 at 12:43:48PM +0100, Iñaki Martínez wrote: I must create a VPN between an external company and a server behind my firewall. Company---its_routerInternet---my_firewall-server * How to

Re: VPN question

2002-11-18 Thread Lionel Elie Mamane
On Mon, Nov 18, 2002 at 07:17:31PM +0100, Andrea Frigido wrote: Alle 19:07, lunedì 18 novembre 2002, Lionel Elie Mamane ha scritto: On Mon, Nov 18, 2002 at 07:02:59PM +0100, Andrea Frigido wrote: kernel-patch-freeswan-ext UNSTABLE package or kernel-patch-freeswan STABLE package? This package

Re: VPN question

2002-11-18 Thread Andrea Frigido
Alle 19:24, lunedì 18 novembre 2002, Lionel Elie Mamane ha scritto: On Mon, Nov 18, 2002 at 07:17:31PM +0100, Andrea Frigido wrote: Alle 19:07, lunedì 18 novembre 2002, Lionel Elie Mamane ha scritto: On Mon, Nov 18, 2002 at 07:02:59PM +0100, Andrea Frigido wrote: kernel-patch-freeswan-ext

Re: VPN question

2002-11-18 Thread Lionel Elie Mamane
On Mon, Nov 18, 2002 at 07:32:56PM +0100, Andrea Frigido wrote: OK, now I install kernel-patch-freeswan-ext package, thanks :) It is compatible with kernel 2.4.18 or I need to use the kernel 2.4.19? I don't know, but I guess it is. If you find out, let us know. -- Lionel

Re: VPN question

2002-11-18 Thread Noah L. Meyerhans
On Mon, Nov 18, 2002 at 07:17:31PM +0100, Andrea Frigido wrote: I have just installed kernel-patch-freeswan STABLE package, in the make menuconfig menu it's possible to enable Blowfish and other additional chifer kernel modules. Do you think the unstable package is the better choice however?

Unsubscribe Confirmation for AUTHENTICS.COM.AU

2002-11-18 Thread [EMAIL PROTECTED]
Title: Goodbye!

unsubscribe

2002-11-18 Thread Zanth
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: NetFilter connection tracking

2002-11-18 Thread Dale Amon
If it is a client machine and has a default DROP policy on incoming packets, then ALLOW packets associated with open connections. You probably don't need any other special rules. Just set up policies to allow OUTPUT packets on the ports you want. Only associated packets will be accepted IN. --

Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
Hi Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These packets are long (2090 Bytes) and not filled with nulls, but with more or

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread enyc
Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These packets are long (2090 Bytes) and not filled with nulls, but with more or

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread Arne Rusek
On Mon, Nov 18, 2002 at 11:54:01PM +0100, Marcel Weber wrote: Hi Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Thanks very much. The probably hacked windows 2000 servers have nothing to do with debian though. I first thought of a false snort alarm of the debian box I am using as a nids. Goosh... Windoze is evil though... Marcel [EMAIL PROTECTED] wrote:

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi I'm already calmer now. Apparently I am not the only one with this problem. It seems that the hacker is microsoft. http://www.wfu.edu/~steinsj5/work/icmp.html I gonna ask their support, what these packages are good for. If by the way somebody

[PATCH] for 2.2.x i386 Linux kernel DoS - Affects 2.2.x andprobably 2.0.x

2002-11-18 Thread Matthew Grant
Hi HTere! Please find the patch for this attached. It is against linux 2.2.20. I have not tested it, but since the lcall7() code in 2.2.x is the same as for 2.4.x, it should work. It is based on Linus's and Petr's patch for 2.5.x and Alan Cox's 2.4.x Best Regards, Matthew Grant ---

Re: Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
On Monday 18 November 2002 22:56, Phillip Hofmeister wrote: On Mon, 18 Nov 2002 at 04:07:52PM +0100, [EMAIL PROTECTED] wrote: Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this

RE: Odd iptstate entry

2002-11-18 Thread Vince Hillier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 -Original Message- From: Peter Cordes [mailto:[EMAIL PROTECTED]] Sent: Sunday, November 17, 2002 10:52 PM To: Debian Security Subject: Re: Odd iptstate entry On Sun, Nov 17, 2002 at 11:18:25PM -0500, Stephen Gran wrote: Hello all, I am

Re: Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
O Another question is, is there any IPSEC-based VPDN solution? I mean, is there any PKI-based opensource VPDN solution? -- Patrick Hsieh[EMAIL PROTECTED] GnuPG Pubilc Key at http://www.ezplay.tv/~pahud/pahudatezplay.pubkey MD5 checksum: b948362c94655b74b33e859d58b8de91 1024D/F3662014 9ADF

Re: Re[2]: VPN question

2002-11-18 Thread Phillip Hofmeister
On Tue, 19 Nov 2002 at 10:59:02AM +0800, Patrick Hsieh wrote: Greetings from the cold North that is the state of Michigan, Thank you. I think the weakness is due to the password-based authentication. The attacker can use dictionary attack to pass the authentication,right? Incorrect, there are

thanks for errorlists

2002-11-18 Thread Peter Ondraska
Thanks to all the guys who responded to my mail, and gave me the valuable URLs for my work. I got good info there. Thanks. Peter Ondraska -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: Odd iptstate entry

2002-11-18 Thread Peter Cordes
On Sun, Nov 17, 2002 at 11:18:25PM -0500, Stephen Gran wrote: Hello all, I am seeing something a little odd when I view my network connections with iptstate - for those who don't know it, it's kind of like top for network connections. This is the output:

Re: unsubscribe

2002-11-18 Thread Michael Renzmann
Hi. Matt Andreko wrote: When does it end with the unsubscribes? When does it end with people complaining about the unsubscribes that has been sent to the list? Bye, Mike

Re: [OT] unsubscribe

2002-11-18 Thread Arne Schwabe
Phillip Hofmeister [EMAIL PROTECTED] writes: Maybe one of us could set up a procmail filter to bounce the request to the -request box? Just an idea... Mailman already has a config option for that, seem not to be switched on by the admins. Arne --

SmartList sucks was Re: [OT] unsubscribe

2002-11-18 Thread Jamie Heilman
Mailman already has a config option for that, seem not to be switched on by the admins. Debian mailing lists are managed using the ironically named SmartList software. Transitioning to better software probably isn't a high priority due the significant number of lists already deployed. --

Re: unsubscribe

2002-11-18 Thread Michelle Konzack
Hello Martin, Am 22:54 2002-11-15 +0100 hat Martin Godisch geschrieben: On Fri, Nov 15, 2002 at 15:42:19 -0600, Leonard Leblanc wrote: :0: * ^Subject: unsubscribe * ^X-Mailing-List: [EMAIL PROTECTED] /var/mail/probably-uninteresting Just think, you'd be missing out on this *very*

Re: Bastille...

2002-11-18 Thread Michelle Konzack
Am 01:22 2002-11-16 +0100 hat Tore Nilsson geschrieben: //tore Attachment Converted: \\pc6\clients\tamay\mail\attach\Bastille.htm Can you send this message only once and without HTML-Attachment ??? Michelle

Re: please do not ...

2002-11-18 Thread Michelle Konzack
Hmmm, Downloading E-Mails woth Mobil-Telephone like me ??? It is better if you send E-maols to this list WITHOUT HTML-ATTACHMENTS !!! Michelle Am 11:55 2002-11-16 +0100 hat poczta geschrieben: people, do not respond to 'unsubscribe' messages, 'cause from on mail it grows to many

NetFilter connection tracking

2002-11-18 Thread Olaf Meeuwissen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear .debs, I've setup iptables on my woody box with a policy to drop. After some tinkering I'd punched holes for the things I wanted to do (note this is a *client* machine). Then I got into the wonders of setting up rules for active and passive

Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
Hello Maik M8acter backward [EMAIL PROTECTED], I am looking for a VPDN solution for Linux and Windows. But openvpn does not seem to have Windows client. I've tried frees/wan on Linux, but it is not that easy to implement frees/wan client on Windows. Well, there is pptp client on Windows and

Re: Re[2]: VPN question

2002-11-18 Thread robjeh
Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this sollution you can use the default windows vpn client. But i think this isn't really safe. Grtnx, Robbert Citeren Patrick Hsieh

Re: VPN question

2002-11-18 Thread sean finney
On Mon, Nov 18, 2002 at 10:39:11PM +0800, Patrick Hsieh wrote: I am looking for a VPDN solution for Linux and Windows. But openvpn does not seem to have Windows client. I've tried frees/wan on Linux, but it is not that easy to implement frees/wan client on Windows. Well, there is pptp client

Re: Re[2]: VPN question

2002-11-18 Thread Phillip Hofmeister
On Mon, 18 Nov 2002 at 04:07:52PM +0100, [EMAIL PROTECTED] wrote: Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this mschapv2 == unsecure. TONS of paprs on the net if you wish

Re: VPN question

2002-11-18 Thread Andrea Frigido
Alle 13:02, giovedì 14 novembre 2002, Lionel Elie Mamane ha scritto: On Thu, Nov 14, 2002 at 12:43:48PM +0100, Iñaki Martínez wrote: I must create a VPN between an external company and a server behind my firewall. Company---its_routerInternet---my_firewall-server * How to

Re: VPN question

2002-11-18 Thread Lionel Elie Mamane
On Mon, Nov 18, 2002 at 07:02:59PM +0100, Andrea Frigido wrote: Alle 13:02, giovedì 14 novembre 2002, Lionel Elie Mamane ha scritto: On Thu, Nov 14, 2002 at 12:43:48PM +0100, Iñaki Martínez wrote: While using a free OS is always better, you can use any other IPSEC implementation, they should

Re: VPN question

2002-11-18 Thread Andrea Frigido
Alle 19:07, lunedì 18 novembre 2002, Lionel Elie Mamane ha scritto: On Mon, Nov 18, 2002 at 07:02:59PM +0100, Andrea Frigido wrote: Alle 13:02, giovedì 14 novembre 2002, Lionel Elie Mamane ha scritto: On Thu, Nov 14, 2002 at 12:43:48PM +0100, Iñaki Martínez wrote: While using a free OS is

Re: VPN question

2002-11-18 Thread Lionel Elie Mamane
On Mon, Nov 18, 2002 at 07:17:31PM +0100, Andrea Frigido wrote: Alle 19:07, lunedì 18 novembre 2002, Lionel Elie Mamane ha scritto: On Mon, Nov 18, 2002 at 07:02:59PM +0100, Andrea Frigido wrote: kernel-patch-freeswan-ext UNSTABLE package or kernel-patch-freeswan STABLE package? This package

Re: VPN question

2002-11-18 Thread Lionel Elie Mamane
On Mon, Nov 18, 2002 at 07:32:56PM +0100, Andrea Frigido wrote: OK, now I install kernel-patch-freeswan-ext package, thanks :) It is compatible with kernel 2.4.18 or I need to use the kernel 2.4.19? I don't know, but I guess it is. If you find out, let us know. -- Lionel pgp9Z6KhYHk10.pgp

Re: VPN question

2002-11-18 Thread Noah L. Meyerhans
On Mon, Nov 18, 2002 at 07:17:31PM +0100, Andrea Frigido wrote: I have just installed kernel-patch-freeswan STABLE package, in the make menuconfig menu it's possible to enable Blowfish and other additional chifer kernel modules. Do you think the unstable package is the better choice however?

Unsubscribe Confirmation for AUTHENTICS.COM.AU

2002-11-18 Thread [EMAIL PROTECTED]
Title: Goodbye!

unsubscribe

2002-11-18 Thread Zanth

Re: NetFilter connection tracking

2002-11-18 Thread Dale Amon
If it is a client machine and has a default DROP policy on incoming packets, then ALLOW packets associated with open connections. You probably don't need any other special rules. Just set up policies to allow OUTPUT packets on the ports you want. Only associated packets will be accepted IN.

Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
Hi Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These packets are long (2090 Bytes) and not filled with nulls, but with more or

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread enyc
Today I had a whole bunch of large ICMP packages on the company's LAN (about 20). Interesting is, that they came mostly from the Windows 2000 Servers. I discovered the first of these packages 2 or 3 weeks ago. These packets are long (2090 Bytes) and not filled with nulls, but with more or

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi Thanks very much. The probably hacked windows 2000 servers have nothing to do with debian though. I first thought of a false snort alarm of the debian box I am using as a nids. Goosh... Windoze is evil though... Marcel [EMAIL PROTECTED]

Re: Strange Large ICMP packets IDS246

2002-11-18 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi I'm already calmer now. Apparently I am not the only one with this problem. It seems that the hacker is microsoft. http://www.wfu.edu/~steinsj5/work/icmp.html I gonna ask their support, what these packages are good for. If by the way somebody

[PATCH] for 2.2.x i386 Linux kernel DoS - Affects 2.2.x and probably 2.0.x

2002-11-18 Thread Matthew Grant
Hi HTere! Please find the patch for this attached. It is against linux 2.2.20. I have not tested it, but since the lcall7() code in 2.2.x is the same as for 2.4.x, it should work. It is based on Linus's and Petr's patch for 2.5.x and Alan Cox's 2.4.x Best Regards, Matthew Grant ---

Re: Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
On Monday 18 November 2002 22:56, Phillip Hofmeister wrote: On Mon, 18 Nov 2002 at 04:07:52PM +0100, [EMAIL PROTECTED] wrote: Hi Patrick, You can use poptop, its possible to get higher encryption with mschapv2. There is a kernel patch for mschapv2. And you must run pppd 2.4.1. With this

RE: Odd iptstate entry

2002-11-18 Thread Vince Hillier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 -Original Message- From: Peter Cordes [mailto:[EMAIL PROTECTED] Sent: Sunday, November 17, 2002 10:52 PM To: Debian Security Subject: Re: Odd iptstate entry On Sun, Nov 17, 2002 at 11:18:25PM -0500, Stephen Gran wrote: Hello all, I am

Re: Re[2]: VPN question

2002-11-18 Thread Patrick Hsieh
O Another question is, is there any IPSEC-based VPDN solution? I mean, is there any PKI-based opensource VPDN solution? -- Patrick Hsieh[EMAIL PROTECTED] GnuPG Pubilc Key at http://www.ezplay.tv/~pahud/pahudatezplay.pubkey MD5 checksum: b948362c94655b74b33e859d58b8de91 1024D/F3662014 9ADF

Re: Re[2]: VPN question

2002-11-18 Thread Phillip Hofmeister
On Tue, 19 Nov 2002 at 10:59:02AM +0800, Patrick Hsieh wrote: Greetings from the cold North that is the state of Michigan, Thank you. I think the weakness is due to the password-based authentication. The attacker can use dictionary attack to pass the authentication,right? Incorrect, there are