27 Jan
2004
27 Jan
'04
7:27 p.m.
OK, so I'm paranoid...
I checked my own computer with nmap and got the following result:
Interesting ports on $MYHOST ($MYIPADDRESS):
(The 1641 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
111/tcp open sunrpc
6000/tcp open X11
Nmap run completed -- 1 IP address (1 host up) scanned in 0.612 seconds
Now some more details; I was running nmap in user mode, not as root, I
know the result would be different, for the time being I'll work with
this, I'll check more later.
About the results :
I'm a bit surprised that ssh is opened, I don't remember setting up any
sshd daemon, however, I remember Brent doing something on my machine
during the Linuxdays, so it's not entirely impossible, I will disable it
for the time being.
I'm a bot more worried about the other two. I don't see what I might be
doing with Sun's RPC and wish to disable this (any hint welcome).
The same is true about X11; could anyone tell me why X11 is opening a
port on my machine, I don't intend to have anyone connect via X11 to my
host.
I expect I may have to toy with inetd and other startup scripts in order
to disable the nasty services/daemons. I hope I won't screw up my
system too much or too fast.
About ssh, is there a way how I can set up some identification so that
only specific remote users or users from specific hosts may connect to
my system through ssh? Would "anyone" be able to connect (assuming s/he
knows a username & password on my system)?
thanks
Serge
--
----------------------------------------------------------------------
'Software patents kill technical innovation"
----------------------------------------------------------------------
Serge Marelli,
E-mail : serge.marelli(a)linux.lu
----------------------------------------------------------------------
LiLux : http://www.linux.lu/
Protecting Innovation against Patent Inflation
http://swpat.ffii.org/
over 200,000 votes & 2000 firms against software patents
http://noepatents.org/
27 Jan
27 Jan
7:39 p.m.
Hi Serge,
On Tue, 27 Jan 2004, Serge Marelli wrote:
OK, so I'm paranoid...
Are you paranoid enough?
I checked my own computer with nmap and got the
following result:
Interesting ports on $MYHOST ($MYIPADDRESS):
(The 1641 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
111/tcp open sunrpc
6000/tcp open X11
Nmap run completed -- 1 IP address (1 host up) scanned in 0.612 seconds
Rather classical...
Now some more details; I was running nmap in user
mode, not as root, I
know the result would be different, for the time being I'll work with
this, I'll check more later.
It isn't that different, unless you use special options.
About the results :
I'm a bit surprised that ssh is opened, I don't remember setting up any
sshd daemon, however, I remember Brent doing something on my machine
during the Linuxdays, so it's not entirely impossible, I will disable it
for the time being.
Just drop it from /etc/rc3.d/ or /etc/rc5.d/ (whatever your default
runlevel is -> grep default /etc/inittab)
I'm a bot more worried about the other two. I
don't see what I might be
doing with Sun's RPC and wish to disable this (any hint welcome).
RPC -> portmap
Since my Gentoo runs fine without this service, I guess you won't
need it, unless you need NFS or somesuch.
The same is true about X11; could anyone tell me why
X11 is opening a
port on my machine, I don't intend to have anyone connect via X11 to my
host.
Normally, X shouldn't allow connections from outside, unless you
explicitly authorize this via xhost + remote_host, or via xauth.
I expect I may have to toy with inetd and other
startup scripts in order
to disable the nasty services/daemons. I hope I won't screw up my
system too much or too fast.
There's a runlevel editor in SuSE, IIRC.
About ssh, is there a way how I can set up some
identification so that
only specific remote users or users from specific hosts may connect to
my system through ssh? Would "anyone" be able to connect (assuming s/he
knows a username & password on my system)?
Should be possible. You can certainly disable access through
/etc/host.allow or /etc/host.deny, in the sshd config you can
disable root login... there should also be other possibilities.
Greets & hth, Eric
8:17 p.m.
On Tue, 2004-01-27 at 20:39, Eric Dondelinger wrote:
Hi Serge,
On Tue, 27 Jan 2004, Serge Marelli wrote:
In my view, never as far as computer and networks are concerned.
But some consider me paranoïd...
thanks for the other hints
Marvin
--
----------------------------------------------------------------------
'Software patents kill technical innovation"
----------------------------------------------------------------------
Serge Marelli,
E-mail : serge.marelli(a)linux.lu
----------------------------------------------------------------------
LiLux : http://www.linux.lu/
Protecting Innovation against Patent Inflation
http://swpat.ffii.org/
over 200,000 votes & 2000 firms against software patents
http://noepatents.org/
OK, so I'm paranoid...
Are you paranoid enough?
8:19 p.m.
On Tuesday 27 January 2004 20:39, Eric Dondelinger wrote:
one service that use rpc is fam, to monitor directory. kde can take
advantage of this, but it work fine without it.
just start X with the -nolisten parameter.
you just need to modify the script or the configuration file.
and it depend on the system.
i know that msec ( a mdk utility to enforce security setting ) modify
gdm config ( /etc/X11/gdm/gdm.conf ), startx (/usr/X11R6/bin/startx )
and X server config ( /etc/X11/xdm/Xservers ).
So you may try to look for these file, and modify them.
but this is not a huge security risk, as Eric stated.
--
Mickaël Scherer
Hi Serge,
On Tue, 27 Jan 2004, Serge Marelli wrote:
using -sU for udp could be good too, but, you doesn't need to be root, i
think.
OK, so I'm paranoid...
Are you paranoid enough?
I checked my own computer with nmap and got the
following result:
Interesting ports on $MYHOST ($MYIPADDRESS):
(The 1641 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
111/tcp open sunrpc
6000/tcp open X11
Nmap run completed -- 1 IP address (1 host up) scanned in 0.612
seconds
Rather classical...
Now some more details; I was running nmap in user
mode, not as
root, I know the result would be different, for the time being I'll
work with this, I'll check more later.
It isn't that different, unless you use special options. I'm a bot
more worried about the other two. I don't see what I
might be doing with Sun's RPC and wish to disable this (any hint
welcome).
RPC -> portmap
Since my Gentoo runs fine without this service, I guess you won't
need it, unless you need NFS or somesuch. The same is
true about X11; could anyone tell me why X11 is opening
a port on my machine, I don't intend to have anyone connect via X11
to my host.
Normally, X shouldn't allow connections from outside, unless you
explicitly authorize this via xhost + remote_host, or via xauth. 
8:31 p.m.
On Tue, Jan 27, 2004 at 09:19:31PM +0100, Michael Scherer wrote:
On Tuesday 27 January 2004 20:39, Eric Dondelinger
wrote:
> On Tue, 27 Jan 2004, Serge Marelli wrote:
> Normally, X shouldn't allow connections from
outside, unless you
> explicitly authorize this via xhost + remote_host, or via xauth.
just start X with the -nolisten parameter.
This is "-nolisten tcp". I don't think that just "-nolisten"
will
work.
--
Lionel
8:51 p.m.
On Tue, 2004-01-27 at 21:19, Michael Scherer wrote:
On Tuesday 27 January 2004 20:39, Eric Dondelinger
wrote:
using -sU for udp could be good too, but, you doesn't need to be root, i
think.
-sU requires root (that's whan nmap said on my system).
Funnily, when I ran nmap as root, it reported that my system must be
down because it's not responding ...
I checked the IP thrice.
:-)
Small panic here as I was stopping the "suspected" daemons with the SuSe
runlevel editor (thanks for the reminder Eric), I stopped the Xdm dameon
(stupid me...) of course it was kinda difficult to continue from there
:-))
now the only service left running is the X11, which I'll keep an eye on
:)
Serge (still paranoïd)
--
----------------------------------------------------------------------
'Software patents kill technical innovation"
----------------------------------------------------------------------
Serge Marelli,
E-mail : serge.marelli(a)linux.lu
----------------------------------------------------------------------
LiLux : http://www.linux.lu/
Protecting Innovation against Patent Inflation
http://swpat.ffii.org/
over 200,000 votes & 2000 firms against software patents
http://noepatents.org/
Now some more details; I was running nmap in user
mode, not as
root, I know the result would be different, for the time being I'll
work with this, I'll check more later.
It isn't that different, unless you use special options.
28 Jan
28 Jan
6:53 a.m.
On Tue, Jan 27, 2004 at 09:19:31PM +0100, Michael Scherer wrote:
On Tuesday 27 January 2004 20:39, Eric Dondelinger
wrote:
> On Tue, 27 Jan 2004, Serge Marelli wrote:
>> OK, so I'm paranoid...
>> Interesting ports on $MYHOST ($MYIPADDRESS):
>> Port State Service
>> 111/tcp open sunrpc
>> I don't see what I might be doing with
Sun's RPC and wish to
>> disable this (any hint welcome).
> RPC -> portmap Since my Gentoo runs fine
without this service, I
> guess you won't need it, unless you need NFS or somesuch.
one service that use rpc is fam, to monitor directory.
kde can take
advantage of this, but it work fine without it.
Using FAM is mainly a performance optimisation, AFAIK.
On a related note, Debian is on the verge of changing the default
behaviour of portmap to listening only on localhost, no remote IP. At
last.
http://lists.debian.org/debian-devel-0401/msg01512.html
--
Lionel
27 Jan
27 Jan
8:37 p.m.
On Tue, Jan 27, 2004 at 08:27:17PM +0100, Serge Marelli wrote:
About ssh, is there a way how I can set up some
identification so
that only specific remote users or users from specific hosts may
connect to my system through ssh?
In /etc/ssh/sshd_config
AllowGroups
AllowUsers
DenyGroups
DenyUsers
This is about local users, not remote users, but I guess that this is
what you meant. Restricting by remote user is "obviously impossible"
in the general case.
To do limitation based on host, if ssh uses tcpwrappers you can use
/etc/hosts.{allow,deny} as Eric said, else use iptables (ipchains if
you are using Linux 2.2).
Would "anyone" be able to connect (assuming
s/he
knows a username & password on my system)?
If that username is allowed to connect by SSH, yes.
--
Lionel
28 Jan
28 Jan
12:17 p.m.
Le mar 27/01/2004 à 20:27, Serge Marelli a écrit :
I'm a bit surprised that ssh is opened, I
don't remember setting up any
sshd daemon, however, I remember Brent doing something on my machine
during the Linuxdays, so it's not entirely impossible, I will disable it
for the time being.
!!!*#&*$@## !!!! I did't do anything like that !
SSH is safe when used in SSH v2 only mode. I personally prefer let it
open even if I'm not supposed to use it, because if I've got a problem
with my console (video card locked, keyboard problem or what), I can
this way shutdown gracefully my host through the network...
I'm a bot more worried about the other two. I
don't see what I might be
doing with Sun's RPC and wish to disable this (any hint welcome).
If I'm not wrong, Sun RPC is launched by the portmap deamon.
The same is true about X11; could anyone tell me why
X11 is opening a
port on my machine, I don't intend to have anyone connect via X11 to my
host.
X is a network protocol. The case when you run the X-client on the same
host as the X-server is just a special situation. I wouldn't be
surprised that it's openend by the X server as soon as it starts. You
could protect your host by tcpwrapper, couldn't you ?
--
Brent Frère
5, rue de Mamer
L-8280 Kehlen
Grand-Duché de Luxembourg
Union Européenne
Tél: +352-021/29.05.98
Fax: +352-26.30.05.96
Web: http://BFrere.net
2:16 p.m.
On Wed, Jan 28, 2004 at 01:17:42PM +0100, Brent Frère wrote:
SSH is safe when used in SSH v2 only mode.
Haha. Go read the previous 2 or 3 OpenSSH security advisories and then
tell me if you are still of this opinion.
Let's quote a few things, from their own "security" page:
OpenSSH 2.1.0 and newer do not allow a remote attacker to execute
arbitrary commands with the privileges of sshd if UseLogin is enabled
by the administrator. UseLogin is disabled by default. This problem
has been fixed in OpenSSH 2.1.0.
OpenSSH 2.3.0 and newer are not vulnerable to the "Feb 8, 2001: SSH-1
Daemon CRC32 Compensation Attack Detector Vulnerability", RAZOR
Bindview Advisory CAN-2001-0144. A buffer overflow in the CRC32
compensation attack detector can lead to remote root access. This
problem has been fixed in OpenSSH 2.3.0. However, versions prior to
2.3.0 are vulnerable.
OpenSSH 2.3.0 and newer do not allow malicious servers to access the
client's X11 display or ssh-agent. This problem has been fixed in
OpenSSH 2.3.0.
OpenSSH 2.3.1, a development snapshot which was never released, was
vulnerable to "Feb 8, 2001: Authentication By-Pass Vulnerability in
OpenSSH-2.3.1", OpenBSD Security Advisory. In protocol 2,
authentication could be bypassed if public key authentication was
permitted. This problem does exist only in OpenSSH 2.3.1, a three
week internal development release. OpenSSH 2.3.0 and versions newer
than 2.3.1 are not vulnerable to this problem.
OpenSSH 2.9.9 and newer do not allow users to delete files named
"cookies" if X11 forwarding is enabled. X11 forwarding is disabled by
default.
OpenSSH 2.9.9 and newer are not vulnerable to "Sep 26, 2001: Weakness
in OpenSSH's source IP based access control for SSH protocol v2
public key authentication.", OpenSSH Security Advisory.
Portable OpenSSH 3.7.1p2 and newer are not vulnerable to "September
23, 2003: Portable OpenSSH Multiple PAM vulnerabilities", OpenSSH
Security Advisory
Etc, etc. I took only a few. So, they had many, many, security holes
in the past. Why would it be secure *now*?
> The same is true about X11; could anyone tell me
why X11 is opening
> a port on my machine, I don't intend to have anyone connect via X11
> to my host.
X is a network protocol. The case when you run the
X-client on the
same host as the X-server is just a special situation.
It is a network protocol, but it is (supposed to be)
transport-agnostic. So, you can use it over TCP, you can use it over
DECnet, you can use it over Unix domain sockets. If you are running
the X-client on the same host, then communicating with the server over
Unix domain sockets is faster. And you can disable TCP altogether,
because all local programs will happily use Unix domain sockets.
Note that running an X-client over an ssh session with X11 port
forwarding counts as a local client for this purpose. No need to
enable TCP listening on the X server for this.
--
Lionel
5:13 p.m.
On Wed, 2004-01-28 at 13:17, Brent Frère wrote:
Le mar 27/01/2004 à 20:27, Serge Marelli a écrit :
touchy arent' we?
;-) Relax, I didn't accuse you or say I objected.
I'm a bit surprised that ssh is opened, I
don't remember setting up any
sshd daemon, however, I remember Brent doing something on my machine
during the Linuxdays, so it's not entirely impossible, I will disable it
for the time being.
!!!*#&*$@## !!!! I did't do anything like that ! SSH is safe when used in SSH v2 only mode. I
personally prefer let it
open even if I'm not supposed to use it, because if I've got a problem
with my console (video card locked, keyboard problem or what), I can
this way shutdown gracefully my host through the network...
Yes, I know that, I remember that I had some problems with my setup and
graphic adapter and Nvidia driver just after doing an upgrade from
Suse8.1 to Suse 9.x and you helped me fix it. Since my screen was
pretty much screwed you said having ssh would be nice.
This is why I made the link with you.
Don't panic, I still love you...
Serge
PS: Brent, bonne année
--
----------------------------------------------------------------------
'Software patents kill technical innovation"
----------------------------------------------------------------------
Serge Marelli,
E-mail : serge.marelli(a)linux.lu
----------------------------------------------------------------------
LiLux : http://www.linux.lu/
Protecting Innovation against Patent Inflation
http://swpat.ffii.org/
over 200,000 votes & 2000 firms against software patents
http://noepatents.org/
7416
days inactive
7417
days old
10 comments
5 participants
participants (5)
-
Brent Frère -
Eric Dondelinger -
Lionel Elie Mamane -
Michael Scherer -
Serge Marelli