Re: Strange segmentation faults and Zombies

but still worked. beside gzip, it segfaultet. you can also strace ls, normally ls does nothing in /proc, but this ls had done anything in /proc. But where is it from? Have you installed/executed any binarys beside debian-packages? Regards, Ralf Dreibrodt

Re: Strange segmentation faults and Zombies

but still worked. beside gzip, it segfaultet. you can also strace ls, normally ls does nothing in /proc, but this ls had done anything in /proc. But where is it from? Have you installed/executed any binarys beside debian-packages? Regards, Ralf Dreibrodt -- To UNSUBSCRIBE, email to [EMAIL PROTECTE

Re: [Fwd: Re: LWN: Ptrace vulnerability in 2.2 and 2.4 kernels]

't updated it, because of the ptrace bug. this is the reason why: www1:~# grep CAP_SYS_MODULE /etc/lids/lids.cap -16:CAP_SYS_MODULE www1:~# grep CAP_SYS_PTRACE /etc/lids/lids.cap -19:CAP_SYS_PTRACE For fun i tried the exploit, it didn't worked, it needs access to /proc. I gave that user access to /p

Re: [Fwd: Re: LWN: Ptrace vulnerability in 2.2 and 2.4 kernels]

of the ptrace bug. this is the reason why: www1:~# grep CAP_SYS_MODULE /etc/lids/lids.cap -16:CAP_SYS_MODULE www1:~# grep CAP_SYS_PTRACE /etc/lids/lids.cap -19:CAP_SYS_PTRACE For fun i tried the exploit, it didn't worked, it needs access to /proc. I gave that user access to /proc and tried it

Re: howcome there's no DSA for the latest Linux ptrace hole?

to see if you are > vulnerable. > > http://www.securityfocus.com/archive/1/315635 stupid question, but is chmod 700 /proc enough? This exploit doesn't work anymore. Do you have any exploit which works after a chmod 700 /proc? Regards, Ralf Dreibrodt

Re: howcome there's no DSA for the latest Linux ptrace hole?

to see if you are > vulnerable. > > http://www.securityfocus.com/archive/1/315635 stupid question, but is chmod 700 /proc enough? This exploit doesn't work anymore. Do you have any exploit which works after a chmod 700 /proc? Regards, Ralf Dreibrodt -- To UNSUBSCRIBE, email to [EMA

Re: Apache Virtual Hosts Chroot ?

"system" can access files outside this directory - you can also access files in /directory/where/files/are2 or is this bug already solved? There are probably other possibilities to access files outside this directory. open_basedir has nothing to do with chroot, they are two different th

Re: Apache Virtual Hosts Chroot ?

"system" can access files outside this directory - you can also access files in /directory/where/files/are2 or is this bug already solved? There are probably other possibilities to access files outside this directory. open_basedir has nothing to do with chroot, they are two different th

Re: LIDS vers. chroot

_CHROOT from _every_ binary within the chroot, only programs outside the chroot should have them. Well, i think the solution depends on you paranoia level ;) Regards, Ralf Dreibrodt -- MesosTelefon 49 221 4855798-1 Eupener Str. 150 Fax 49 221 4855798-9 50933 Koeln Ma

Re: LIDS vers. chroot

_CHROOT from _every_ binary within the chroot, only programs outside the chroot should have them. Well, i think the solution depends on you paranoia level ;) Regards, Ralf Dreibrodt -- MesosTelefon 49 221 4855798-1 Eupener Str. 150 Fax 49 221 4855798-9 50933 Koeln Ma

Re: question about SSH / IPTABLES

own code. Then he can't ssh anymore. The other way is via network. You can deny network usage for the user, for all ports or only for specific ports. Is there any packet filter, which can block only outgoing ssh-sessions? Regards, Ralf Dreibrodt -- MesosTelefon 49 221 4855798-1 E

Re: question about SSH / IPTABLES

own code. Then he can't ssh anymore. The other way is via network. You can deny network usage for the user, for all ports or only for specific ports. Is there any packet filter, which can block only outgoing ssh-sessions? Regards, Ralf Dreibrodt -- MesosTelefon 49 221 4855798-1 E

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

woody: PAMAuthenticationViaKbdInt no UsePrivilegeSeparation yes But i think i am also not vulnerable because privsep is default since 3.3. Regards, Ralf Dreibrodt

Re: OPENSSH REMOTE ROOT COMPROMISE ALL VERSIONS

woody: PAMAuthenticationViaKbdInt no UsePrivilegeSeparation yes But i think i am also not vulnerable because privsep is default since 3.3. Regards, Ralf Dreibrodt -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: postfix in qmail out proftpd in pureftpd

me bugs. > > no > > qmail... i was talking about pureftpd. qmail itself perhaps had no securityproblems, but other programs, e.g. vpopmail or vchkpw. Regards, Ralf Dreibrodt

Re: postfix in qmail out proftpd in pureftpd

me bugs. > > no > > qmail... i was talking about pureftpd. qmail itself perhaps had no securityproblems, but other programs, e.g. vpopmail or vchkpw. Regards, Ralf Dreibrodt -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: How reliable is "debsums"?

ally sure, i can boot from cd-rom and compare the harddisk with my tripwire-db, which is not on the harddisc. Regards, Ralf Dreibrodt

Re: How reliable is "debsums"?

ally sure, i can boot from cd-rom and compare the harddisk with my tripwire-db, which is not on the harddisc. Regards, Ralf Dreibrodt -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: ot? apache directory listing mysteries

Hi, Javier Fernández-Sanguino Peña wrote: > > On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: > > > > Did you take a look at the Referer of those access? > > It might help you to track it down... > > > > That's just might be how they get them in the first place. If you bu

Re: ot? apache directory listing mysteries

Hi, Javier Fernández-Sanguino Peña wrote: > > On Wed, Sep 18, 2002 at 04:33:25AM +0700, Jean Christophe ANDRÃ? wrote: > > > > Did you take a look at the Referer of those access? > > It might help you to track it down... > > > > That's just might be how they get them in the first place. If you b

Re: slapper countermeasures

Michael Renzmann wrote: > > > i already made some bad hedrivings a few years ago with something like > > this... > > But one thing I would like to know: what do you mean with "hedrivings"? :) experiences. i asked a friend, what i could say for "erfahrungen" in english, he answered hedrivings, so

Re: slapper countermeasures

Hi, > hedrivings sorry, i forgot to change this to experience...hedrivings is only for german people ;)

Re: slapper countermeasures

L, but you should ask a lawyer before doing stuff like this. i already made some bad hedrivings a few years ago with something like this... Regards, Ralf Dreibrodt -- Mesos Telefon 49 221 9639263 Wallstr. 123 Fax 49 221 9646649 51063 Koeln Mail [EMAIL PROTECTED]

Re: slapper countermeasures

Michael Renzmann wrote: > > > i already made some bad hedrivings a few years ago with something like > > this... > > But one thing I would like to know: what do you mean with "hedrivings"? :) experiences. i asked a friend, what i could say for "erfahrungen" in english, he answered hedrivings, s

Re: slapper countermeasures

Hi, > hedrivings sorry, i forgot to change this to experience...hedrivings is only for german people ;) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: slapper countermeasures

L, but you should ask a lawyer before doing stuff like this. i already made some bad hedrivings a few years ago with something like this... Regards, Ralf Dreibrodt -- Mesos Telefon 49 221 9639263 Wallstr. 123 Fax 49 221 9646649 51063 Koeln Mail [EMAIL PROTECTED]

Re: [OT] AW: Printing ?

Hi, > > Sorry i know this is off topic but dose anyone know where theres a good > > HOW-TO on Seting up SAMBA as a print server ?? there is an online book from oreilly: http://www.oreilly.com/catalog/samba/chapter/book/index.html Viele Gruesse Ralf Dreibrodt -- Mesos Te

Re: LIDS and daily cron jobs

ion crontab etc. have to be protected, too. there are much more solutions for this problem... sorry, i don't have any debian specific solution, but i just wanted to tell you, that your solution is wrong and gives a false sense of security. Regards, Ralf Dreibrodt -- Mesos Telefon

Re: Fwd: RAZOR advisory: Linux util-linux chfn local root vulnerability

n (from shadowutils iirc). a little bit offtopic: Redhat uses chfn and chsh from linux-utils, SuSE from shadow-utils... Well, i always suggest to remove the s-flag, if users shouldn't change something in /etc/passwd. So i don't have to touch all Redhat-Boxes, on which i have done this ;) V

Re: Apache + PHP and user permissions

Hi, StarK wrote: > > What kind of security can I use to avoid this ? Can we chroot the PHP > (Yes I know it's a strange sentence :) ? i know two useable solutions: 1. care about every service: use SuEXEC for CGIs, Safe Mode for PHP, a good directory and right structure. 2. chroot everything j

Re: Apache Chunked Encoding attack

Hi, Craig Dickson wrote: > > Florian Weimer wrote: > > > Two possibilities: The documentation refers to a previous version of > > the scanner, or you forgot to restart Apache after installing the > > packages. > > Installing a new .deb for a server package should automatically restart > the ser

Re: DSA-134-1

Hi, Mark Janssen wrote: > > On Tue, 2002-06-25 at 18:11, Phillip Hofmeister wrote: > > *TECHNICALLY* every login is root. Getty runs as root and then gives up > > root > > to the authenticated user once PAM gives the okay...Does this mean the user > > can break back into root? If the exit thei

Re: DSA-134-1

Hi, Christian Jaeger wrote: > > Hmm, I'm wondering if it's any better: if the attacker manages code > to run in the chrooted daemon, I suspect he can also advise the part > running as root to open up a new root connection? Isn't it that the > separation simply protects against direct shell launch

Re: DSA-134-1

Hi, Florian Weimer wrote: > > Is this worth the effort if there's still a remote nobody exploit? > At least that's the way understand the DSA. i unterstand it as remote chrooted nobody exploit, this is much more better than a remote root-exploit. bye, Ralf -- To UNSUBSCRIBE, email to [EMAIL

Re: [SECURITY] [DSA-134-1] OpenSSH remote vulnerability

Hi, Phillip Hofmeister wrote: > > Sowhat does this mean for us running potato on internet servers? > > Does this effect the daemon or the client? this is the information markus friedl send to bugtraq and it is perhaps the same, the debian-team got?!? > Date: Mon, 24 Jun 2002 15:00:10 -0600

Re: default Apache configuration

Hi, Thomas Thurman wrote: > > On Tue, 12 Mar 2002, Ralf Dreibrodt wrote: > > tail -n 1 /var/log/apache/access.log > > 127.0.0.1 - - [12/Mar/2002:13:53:15 +0100] "GET > > /cgi-bin/login.pl?user=admin&password=tztztz HTTP/1.1" 200 148 > > > > to

default Apache configuration

Hi, i just saw an error on a debian box with apache(-common) 1.3.9-13.2: drwxr-xr-x 14 root root 4096 Dec 7 13:52 /var drwxr-xr-x6 root root 4096 Mar 11 06:30 /var/log drwxr-xr-x2 root root 4096 Mar 10 06:25 /var/log/apache -rw-rw-r--1 www-data n

Re: default Apache configuration

Hi, Thomas Thurman wrote: > > On Tue, 12 Mar 2002, Ralf Dreibrodt wrote: > > tail -n 1 /var/log/apache/access.log > > 127.0.0.1 - - [12/Mar/2002:13:53:15 +0100] "GET > > /cgi-bin/login.pl?user=admin&password=tztztz HTTP/1.1" 200 148 > > > > to

default Apache configuration

Hi, i just saw an error on a debian box with apache(-common) 1.3.9-13.2: drwxr-xr-x 14 root root 4096 Dec 7 13:52 /var drwxr-xr-x6 root root 4096 Mar 11 06:30 /var/log drwxr-xr-x2 root root 4096 Mar 10 06:25 /var/log/apache -rw-rw-r--1 www-data

Re: [d-security] Re: SECURITY HOLE in MySQL module in PHP

Hi, Javier Fernández-Sanguino Peña wrote: > > On Wed, Feb 06, 2002 at 05:31:23PM +0100, Christian Hammers wrote: > > On Wed, Feb 06, 2002 at 05:26:27PM +0100, Ralf Dreibrodt wrote: > > > just run apache chrooted and you don?t have problems like this. > > Doesn'

Re: [d-security] Re: SECURITY HOLE in MySQL module in PHP

Hi, Javier Fernández-Sanguino Peña wrote: > > On Wed, Feb 06, 2002 at 05:31:23PM +0100, Christian Hammers wrote: > > On Wed, Feb 06, 2002 at 05:26:27PM +0100, Ralf Dreibrodt wrote: > > > just run apache chrooted and you don?t have problems like this. > > Doesn'

Re: Emulate real ip's to access intranet hosts from outside

Hi, Ramon Acedo wrote: > > I'd like to have a map like this: > > ftp1.mydomain.net ---> 192.168.1.10 > ftp2.mydomain.net ---> 192.168.1.50 > www1.mydomain.net ---> 192.168.1.12 > www2.mydomain.net ---> 192.168.1.33 that´s hard, tricky and not always possible. most protocols (e.g. ftp, telnet,

Re: Emulate real ip's to access intranet hosts from outside

Hi, Ramon Acedo wrote: > > I'd like to have a map like this: > > ftp1.mydomain.net ---> 192.168.1.10 > ftp2.mydomain.net ---> 192.168.1.50 > www1.mydomain.net ---> 192.168.1.12 > www2.mydomain.net ---> 192.168.1.33 that´s hard, tricky and not always possible. most protocols (e.g. ftp, telnet,

Re: SECURITY HOLE in MySQL module in PHP

Hi, brendan hack wrote: > > I received an error saying 'test_database' not found. of course you should change $db to you db-name. > I then > removed all access privileges from the anonymous user to the test > database and received the following: > > FAILED: USE test > REASON: Access denied for

Re: SECURITY HOLE in MySQL module in PHP

Hi, brendan hack wrote: > > I received an error saying 'test_database' not found. of course you should change $db to you db-name. > I then > removed all access privileges from the anonymous user to the test > database and received the following: > > FAILED: USE test > REASON: Access denied fo

Re: SECURITY HOLE in MySQL module in PHP

Hi, "Dmitry N. Hramtsov" schrieb: > > Any comments or counsel? > > Maybe debian developers should make a "quick and dirty" fix for this, > because (as I can understand) php developers already knows about this > hole and do still nothing. just run apache chrooted and you don´t have problems like

Re: SECURITY HOLE in MySQL module in PHP

Hi, "Dmitry N. Hramtsov" schrieb: > > Any comments or counsel? > > Maybe debian developers should make a "quick and dirty" fix for this, > because (as I can understand) php developers already knows about this > hole and do still nothing. just run apache chrooted and you don´t have problems lik

Re: /bin/passwd as shell

Hi, David N Moore wrote: > > i'm a new poster here, but one thing that strikes me is that the > source to passwd should be hanging around somewhere. It wouldn't be > incredibly difficult to make a custom version which does not ask for > the original password, right? Then you could set it to be

Re: /bin/passwd as shell

Hi, David N Moore wrote: > > i'm a new poster here, but one thing that strikes me is that the > source to passwd should be hanging around somewhere. It wouldn't be > incredibly difficult to make a custom version which does not ask for > the original password, right? Then you could set it to be

Re: protection against buffer overflows

hi, > anyone to offer any > explanation will be showered with greatness! here is an example: #include void example() { char a[10]; char b[10]; strcpy(a, "123456789"); printf ("a: %s\n", a); b[20]='X'; b[21]='Y'; b[22]='Z'; printf("a: %s\n", a); return; } main() { example();

Re: protection against buffer overflows

hi, > anyone to offer any > explanation will be showered with greatness! here is an example: #include void example() { char a[10]; char b[10]; strcpy(a, "123456789"); printf ("a: %s\n", a); b[20]='X'; b[21]='Y'; b[22]='Z'; printf("a: %s\n", a); return; } main() { example();

Re: the su - user thread [Potential Debian Security Issue]

Hi, Kevin van Haaren wrote: > > if I: > ssh in as a user account > su root have a look at this: [EMAIL PROTECTED]:~$ su Password: debian:/home/ralf# set | grep LOGNAME LOGNAME=ralf debian:/home/ralf# exit [EMAIL PROTECTED]:~$ su - Password: debian:~# set | grep LOGNAME LOGNAME=root "su" !=

Re: the su - user thread [Potential Debian Security Issue]

Hi, Kevin van Haaren wrote: > > if I: > ssh in as a user account > su root have a look at this: ralf@debian:~$ su Password: debian:/home/ralf# set | grep LOGNAME LOGNAME=ralf debian:/home/ralf# exit ralf@debian:~$ su - Password: debian:~# set | grep LOGNAME LOGNAME=root "su" != "su -" wha

Re: Once again: Spam (from hananet.net, korea)

Hi, Dietmar Braun schrieb: > > Ok, I admit that this isn't practicable (I shouldn't write mails when I am > VERY angry...), > but the point is: > from USA and Germany, we normally get also mails we want and we need. > From Korea/China and other spammers heaven, we get nothing but spam - not we,

Re: Once again: Spam (from hananet.net, korea)

Hi, Dietmar Braun schrieb: > > Ok, I admit that this isn't practicable (I shouldn't write mails when I am > VERY angry...), > but the point is: > from USA and Germany, we normally get also mails we want and we need. > From Korea/China and other spammers heaven, we get nothing but spam - not we

Re: Hacked too?

> Sorry but could someone please summerize what the "Hacked too?" thread is > about? someone used a script, which should detect rootkits and it said it found one, although there is probably none. it seems just to check whether a certain port is open. just ignore the thread ;) bye Ralf

Re: Hacked too?

> Sorry but could someone please summerize what the "Hacked too?" thread is > about? someone used a script, which should detect rootkits and it said it found one, although there is probably none. it seems just to check whether a certain port is open. just ignore the thread ;) bye Ralf -- To

Re: IP accounting per user

Hi, > > There is a tool set, including a Linux kernel patch: UserIPacct > > (http://ramses.smeyers.be/homepage/useripacct/). But I do not know how > > stable it is. Besides, the last patch is for 2.4.6 and I need a more > > up-to-date 2.4 kernel. > > yeah, that looks nice, but who'd run a 2.4.6 t

Re: IP accounting per user

Hi, > > There is a tool set, including a Linux kernel patch: UserIPacct > > (http://ramses.smeyers.be/homepage/useripacct/). But I do not know how > > stable it is. Besides, the last patch is for 2.4.6 and I need a more > > up-to-date 2.4 kernel. > > yeah, that looks nice, but who'd run a 2.4.6

Re: Secure 2.4.x kernel

Hi, Gary MacDougall wrote: > > Actually your point of view basically states that its "ok" for anyone to > tresspass. no, i just said, that laws can´t help against unknown people. until now nobody broke in my house, and i think because of two facts: - i always keep my doors and windows closed (w

Re: Secure 2.4.x kernel

Hi, Gary MacDougall wrote: > > Actually your point of view basically states that its "ok" for anyone to > tresspass. no, i just said, that laws can´t help against unknown people. until now nobody broke in my house, and i think because of two facts: - i always keep my doors and windows closed (

Re: xdm

Hi, > I noticed that xdm behaves different if I enter a non-existing username > of if I enter a wrong password. In the last case, there is a short pause. > > Knowing that it is possible to find valid usernames. I do not think that > this pause is a good idea. Correct me if I'm wrong. i think the

Re: xdm

Hi, > I noticed that xdm behaves different if I enter a non-existing username > of if I enter a wrong password. In the last case, there is a short pause. > > Knowing that it is possible to find valid usernames. I do not think that > this pause is a good idea. Correct me if I'm wrong. i think th

Re: Secure 2.4.x kernel

Hi, Gary MacDougall wrote: > > Hmmm... Mom has a good point. > > I think the bottom line is that we'll never have 100% security until > there are laws that protect the break-in's and hacking that occurs. > Still laws... not crappy little wrist slapping type laws. laws can´t do anything against

Re: Secure 2.4.x kernel

Hi, Gary MacDougall wrote: > > Hmmm... Mom has a good point. > > I think the bottom line is that we'll never have 100% security until > there are laws that protect the break-in's and hacking that occurs. > Still laws... not crappy little wrist slapping type laws. laws can´t do anything against

Re: How do I disable (close) ports?

Hi, "J. Paul Bruns-Bielkowicz" wrote: > > > Commenting out things in /etc/services doesn't > > disable anything. > > It seems to. The above ports were closed just by commenting them out of > /etc/services and then rebooting. well, there are daemons which don't know on which port they should ru

Re: How do I disable (close) ports?

Hi, "J. Paul Bruns-Bielkowicz" wrote: > > > Commenting out things in /etc/services doesn't > > disable anything. > > It seems to. The above ports were closed just by commenting them out of > /etc/services and then rebooting. well, there are daemons which don't know on which port they should r

Re: Squid security

Hi, > Trouble is, the IP addresses that access squid don't have host > names (ie. they don't exist) and they keep changing. Is there any way > to block access to this and is there a good FAQ, etc. there is a good FAQ at /usr/doc/squid/FAQ.html (belongs to web/squid). But you should not block the

Re: Squid security

Hi, > Trouble is, the IP addresses that access squid don't have host > names (ie. they don't exist) and they keep changing. Is there any way > to block access to this and is there a good FAQ, etc. there is a good FAQ at /usr/doc/squid/FAQ.html (belongs to web/squid). But you should not block th

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > On Fre, Nov 16, 2001 at 08:23:27AM -0800, Micah Anderson wrote: > > > No, you can't. No matter how you cut it, root can install a new > > kernel, sans LIDS and write to his/her home dir. > > how? replace /boot? this is DENY in my setup. access lilo.conf oder lilo >

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > On Fre, Nov 16, 2001 at 08:23:27AM -0800, Micah Anderson wrote: > > > No, you can't. No matter how you cut it, root can install a new > > kernel, sans LIDS and write to his/her home dir. > > how? replace /boot? this is DENY in my setup. access lilo.conf oder lilo >

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > > i wanted to post something about lids, but then i thought, it doesn't > > make sense in this case. > > i think it does make sense. as far as i have read the problem is, that the (wo)man, who has a root-account is able to read mails. what is the advantage of instal

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > On Fre, Nov 16, 2001 at 04:13:16AM -0900, Ethan Benson wrote: > > > > > Root is God. Anything you do on the system is potentially visible to > > > > root. > > this is, with the right patches applied, not true. well, i thought this is the definition of root. > > >

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > > i wanted to post something about lids, but then i thought, it doesn't > > make sense in this case. > > i think it does make sense. as far as i have read the problem is, that the (wo)man, who has a root-account is able to read mails. what is the advantage of insta

Re: Root is God? (was: Mutt & tmp files)

Hi, Mathias Gygax wrote: > > On Fre, Nov 16, 2001 at 04:13:16AM -0900, Ethan Benson wrote: > > > > > Root is God. Anything you do on the system is potentially visible to > > > > root. > > this is, with the right patches applied, not true. well, i thought this is the definition of root. > > >