Re: Encrypting/emailing logs and configs
On Wednesday, 2002-10-30 at 13:07:31 -0500, Sean McAvoy wrote: I was looking at configuring a few of my VPN/Firewall systems to send me daily backups of vital config files, and selected log files. I was wondering what would be the easiest method of accomplishing this? I was thinking something along the lines of just tar/bzip and then gpg to encrypt. What other possibilities are there? And has anyone else setup something similar? I'm doing something similar on a firewall I set up. It uses find/cpio to make an incremental dump (--newer SOME-MARK-FILE) and encrypts it. The dump is put in a directory that is part of a chroot jail. It gets encrypted with a public key in gpg. I pick it up from an internal machine with scp with a key without passphrase. The account used on the firewall has scponlyc as shell. (If you don't know scponly, it permits only certain ssh operations, and the scponlyc variant puts itself in a chroot jail. Which in my case contains only the scp executables. http://sublimation.org/scponly/ The dump can only be decrypted with a special secret key, and access to it's passphrase is controlled. This is the dump script (BTW, this is a FreeBSD machine, you have to adjust the pathes): #!/bin/sh LD_LIBRARY_PATH=/usr/local/bin export LD_LIBRARY_PATH /bin/rm -f /jail/backup/level1.cpio.gpg \ /usr/bin/find / /var -xdev -newer /jail/backup/Level0.mark -print0 | \ /usr/bin/cpio --create --format=newc --null --io-size=32768 --quiet | \ /usr/local/bin/gpg --encrypt --output /jail/backup/level1.cpio.gpg --recipient [EMAIL PROTECTED] And this is the fetch script (SuSE box): #!/bin/sh LOCALFILE=/data/backup/cabernet/level1.cpio-`date +%Y%m%d-%a`.gpg REMOTEFILE=backup/level1.cpio.gpg KEYFILE=/root/.ssh/cabernet-backup-id /usr/bin/scp -B -q -i $KEYFILE backup@cabernet:$REMOTEFILE $LOCALFILE HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith great unthinkable conthept ... | -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
RE: tiger reporting thousands of files with undefined groups ownership
Thanks for your replies. On Sat, 2 Nov 2002 15:30:43 +1300 Corrin Lakeland wrote: When was the last time you fscked the partition? Your reply had me go fsck both my partitions, / and /home. The / partition had no errors, but the /home partition had a few, which could account for about 1% of the 12187 files reported by tiger. The other 99% are still unaccounted for, though. On Fri, 1 Nov 2002 22:19:05 -0600 (CST) Mike Barushok wrote: It might be that something corrupted the /etc/passwd file in such a way that one or more entries were either not 'readable' or had a duplicate entry. You might want to try running pwck. # pwck -r user news: directory /var/spool/news does not exist user uucp: directory /var/spool/uucp does not exist user majordom: directory /usr/lib/majordomo does not exist user postgres: directory /var/lib/postgres does not exist user msql: directory /var/lib/msql does not exist user list: directory /var/list does not exist user gnats: directory /var/lib/gnats/gnats-db does not exist user telnetd: directory /usr/lib/telnetd does not exist user mysql: directory /var/lib/mysql does not exist pwck: no changes Although I'd rather not get any messages from any checking program, these seem to be harmless and unrelated to the issue. Visual inspection of passwd and shadow doesn't help, both look OK. Any more thoughts? -- Carlos Sousa http://vbc.dyndns.org/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
unsubscribe
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: DHCP - rootkit
On Fri, 01 Nov 2002 at 06:41:43PM -0400, Peter Cordes wrote:
MD5 is still believed to be secure. i.e. Nobody can modify a binary so
that it has different contents but the same MD5 hash, unless they are _very_
_very_ lucky. The task becomes even more difficult if you check the length
of the file as well as the hash.
if (filename == MYHACKEDFILE) {
cout WHATEVERIEXPECTTHEMD5SUMTOBE
}
AFA file legnth go...the kernel source is available and I am sure you
could re-write that also...
--
Phil
PGP/GPG Key:
http://www.zionlth.org/~plhofmei/
wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import
--
Excuse #239: IRQ-problems with the Un-Interruptable-Power-Supply
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Fwd: iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse
I am sure you have all seen this...but just in case. Phil - Forwarded message from David Endler [EMAIL PROTECTED] - From: David Endler [EMAIL PROTECTED] Subject: iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse To: [EMAIL PROTECTED] Date: Fri, 1 Nov 2002 14:36:52 -0500 X-Spam-Status: No, bogofilter Delivery-date: Fri, 01 Nov 2002 16:37:04 -0500 X-Razor-Warning: NONE. -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 iDEFENSE Security Advisory 11.01.02: http://www.idefense.com/advisory/11.01.02.txt Buffer Overflow Vulnerability in Abuse October 31, 2002 I. BACKGROUND Abuse is a popular side-scrolling video game. More information can be found at http://jonathanclark.com/ and http://www.crack.com/. II. DESCRIPTION Exploitation of a locally exploitable parsing error in Abuse's -net command line option could allow attackers to gain root privileges on a targeted system. By supplying an overly long argument, the instruction pointer is overwritten, thereby allowing an attacker to seize control of the executable. In a default abuse installation in Debian Linux, both abuse.console and abuse.x11R6 can be used in exploitation; both files are set group id games, and abuse.console is set user id root. III. ANALYSIS Exploitation allows a local attacker to gain super-user status and full control over the targeted system. Affected users should implement either of the two workarounds listed below. IV. DETECTION Abuse 2.00, which is packaged and distributed with the x86 architecture of Debian Linux 3.0r0, is vulnerable. Other platforms and architectures may be vulnerable as well. To determine if a specific Abuse implementation is vulnerable, launch it with the following command line: $ /usr/lib/games/abuse/abuse.console -net 'perl -e 'print Ax500'' If the application crashes with a Segmentation fault, it is vulnerable. V. WORKAROUND Customers should consider implementing one of the two following workarounds: 1. Remove Abuse by issuing the following command: # apt-get remove abuse 2. Remove the setuid bit from the XaoS binary by executing the following command: # chmod -s /usr/lib/games/abuse/abuse.* VI. VENDOR RESPONSE Abuse has a number of other vulnerabilities and should never be installed on a multi-user system where security is a concern, said Jonathan Clark. Abuse allows alternate Lisp script files to be executed at startup via command line parameters. Some script functions can execute abritrary commands or cause external files to modified. VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1250 to this issue. VIII. DISCLOSURE TIMELINE 10/15/2002 Issue disclosed to iDEFENSE 10/31/2002 Author notified 10/31/2002 iDEFENSE clients notified 11/01/2002 Response received from Jonathan Clark ([EMAIL PROTECTED]) 11/01/2002 Public disclosure IX. CREDIT Texonet (http://www.texonet.com) discovered this vulnerability. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to [EMAIL PROTECTED], subject line: subscribe About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGP 7.1.2 Comment: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x4B0ACC2A iQA/AwUBPcLJckrdNYRLCswqEQKiIwCfYNMqgc3cz0u47KI072fQTtGqTN4An064 DlkW88VtmsQ+ZCyPWhAWnRms =tjox -END PGP SIGNATURE- - End forwarded message - -- Phil PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import -- Excuse #238: Routing problems on the neural net msg07608/pgp0.pgp Description: PGP signature
Re: Encrypting/emailing logs and configs
On Wednesday, 2002-10-30 at 13:07:31 -0500, Sean McAvoy wrote: I was looking at configuring a few of my VPN/Firewall systems to send me daily backups of vital config files, and selected log files. I was wondering what would be the easiest method of accomplishing this? I was thinking something along the lines of just tar/bzip and then gpg to encrypt. What other possibilities are there? And has anyone else setup something similar? I'm doing something similar on a firewall I set up. It uses find/cpio to make an incremental dump (--newer SOME-MARK-FILE) and encrypts it. The dump is put in a directory that is part of a chroot jail. It gets encrypted with a public key in gpg. I pick it up from an internal machine with scp with a key without passphrase. The account used on the firewall has scponlyc as shell. (If you don't know scponly, it permits only certain ssh operations, and the scponlyc variant puts itself in a chroot jail. Which in my case contains only the scp executables. http://sublimation.org/scponly/ The dump can only be decrypted with a special secret key, and access to it's passphrase is controlled. This is the dump script (BTW, this is a FreeBSD machine, you have to adjust the pathes): #!/bin/sh LD_LIBRARY_PATH=/usr/local/bin export LD_LIBRARY_PATH /bin/rm -f /jail/backup/level1.cpio.gpg \ /usr/bin/find / /var -xdev -newer /jail/backup/Level0.mark -print0 | \ /usr/bin/cpio --create --format=newc --null --io-size=32768 --quiet | \ /usr/local/bin/gpg --encrypt --output /jail/backup/level1.cpio.gpg --recipient [EMAIL PROTECTED] And this is the fetch script (SuSE box): #!/bin/sh LOCALFILE=/data/backup/cabernet/level1.cpio-`date +%Y%m%d-%a`.gpg REMOTEFILE=backup/level1.cpio.gpg KEYFILE=/root/.ssh/cabernet-backup-id /usr/bin/scp -B -q -i $KEYFILE [EMAIL PROTECTED]:$REMOTEFILE $LOCALFILE HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith great unthinkable conthept ... |
RE: tiger reporting thousands of files with undefined groups ownership
Thanks for your replies. On Sat, 2 Nov 2002 15:30:43 +1300 Corrin Lakeland wrote: When was the last time you fscked the partition? Your reply had me go fsck both my partitions, / and /home. The / partition had no errors, but the /home partition had a few, which could account for about 1% of the 12187 files reported by tiger. The other 99% are still unaccounted for, though. On Fri, 1 Nov 2002 22:19:05 -0600 (CST) Mike Barushok wrote: It might be that something corrupted the /etc/passwd file in such a way that one or more entries were either not 'readable' or had a duplicate entry. You might want to try running pwck. # pwck -r user news: directory /var/spool/news does not exist user uucp: directory /var/spool/uucp does not exist user majordom: directory /usr/lib/majordomo does not exist user postgres: directory /var/lib/postgres does not exist user msql: directory /var/lib/msql does not exist user list: directory /var/list does not exist user gnats: directory /var/lib/gnats/gnats-db does not exist user telnetd: directory /usr/lib/telnetd does not exist user mysql: directory /var/lib/mysql does not exist pwck: no changes Although I'd rather not get any messages from any checking program, these seem to be harmless and unrelated to the issue. Visual inspection of passwd and shadow doesn't help, both look OK. Any more thoughts? -- Carlos Sousa http://vbc.dyndns.org/
unsubscribe
Re: DHCP - rootkit
On Fri, 01 Nov 2002 at 06:41:43PM -0400, Peter Cordes wrote:
MD5 is still believed to be secure. i.e. Nobody can modify a binary so
that it has different contents but the same MD5 hash, unless they are _very_
_very_ lucky. The task becomes even more difficult if you check the length
of the file as well as the hash.
if (filename == MYHACKEDFILE) {
cout WHATEVERIEXPECTTHEMD5SUMTOBE
}
AFA file legnth go...the kernel source is available and I am sure you
could re-write that also...
--
Phil
PGP/GPG Key:
http://www.zionlth.org/~plhofmei/
wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import
--
Excuse #239: IRQ-problems with the Un-Interruptable-Power-Supply
Fwd: iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse
I am sure you have all seen this...but just in case. Phil - Forwarded message from David Endler [EMAIL PROTECTED] - From: David Endler [EMAIL PROTECTED] Subject: iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse To: bugtraq@securityfocus.com Date: Fri, 1 Nov 2002 14:36:52 -0500 X-Spam-Status: No, bogofilter Delivery-date: Fri, 01 Nov 2002 16:37:04 -0500 X-Razor-Warning: NONE. -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 iDEFENSE Security Advisory 11.01.02: http://www.idefense.com/advisory/11.01.02.txt Buffer Overflow Vulnerability in Abuse October 31, 2002 I. BACKGROUND Abuse is a popular side-scrolling video game. More information can be found at http://jonathanclark.com/ and http://www.crack.com/. II. DESCRIPTION Exploitation of a locally exploitable parsing error in Abuse's -net command line option could allow attackers to gain root privileges on a targeted system. By supplying an overly long argument, the instruction pointer is overwritten, thereby allowing an attacker to seize control of the executable. In a default abuse installation in Debian Linux, both abuse.console and abuse.x11R6 can be used in exploitation; both files are set group id games, and abuse.console is set user id root. III. ANALYSIS Exploitation allows a local attacker to gain super-user status and full control over the targeted system. Affected users should implement either of the two workarounds listed below. IV. DETECTION Abuse 2.00, which is packaged and distributed with the x86 architecture of Debian Linux 3.0r0, is vulnerable. Other platforms and architectures may be vulnerable as well. To determine if a specific Abuse implementation is vulnerable, launch it with the following command line: $ /usr/lib/games/abuse/abuse.console -net 'perl -e 'print Ax500'' If the application crashes with a Segmentation fault, it is vulnerable. V. WORKAROUND Customers should consider implementing one of the two following workarounds: 1. Remove Abuse by issuing the following command: # apt-get remove abuse 2. Remove the setuid bit from the XaoS binary by executing the following command: # chmod -s /usr/lib/games/abuse/abuse.* VI. VENDOR RESPONSE Abuse has a number of other vulnerabilities and should never be installed on a multi-user system where security is a concern, said Jonathan Clark. Abuse allows alternate Lisp script files to be executed at startup via command line parameters. Some script functions can execute abritrary commands or cause external files to modified. VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project assigned the identification number CAN-2002-1250 to this issue. VIII. DISCLOSURE TIMELINE 10/15/2002 Issue disclosed to iDEFENSE 10/31/2002 Author notified 10/31/2002 iDEFENSE clients notified 11/01/2002 Response received from Jonathan Clark ([EMAIL PROTECTED]) 11/01/2002 Public disclosure IX. CREDIT Texonet (http://www.texonet.com) discovered this vulnerability. Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to [EMAIL PROTECTED], subject line: subscribe About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world ? from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGP 7.1.2 Comment: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x4B0ACC2A iQA/AwUBPcLJckrdNYRLCswqEQKiIwCfYNMqgc3cz0u47KI072fQTtGqTN4An064 DlkW88VtmsQ+ZCyPWhAWnRms =tjox -END PGP SIGNATURE- - End forwarded message - -- Phil PGP/GPG Key: http://www.zionlth.org/~plhofmei/ wget -O - http://www.zionlth.org/~plhofmei/key.txt | gpg --import -- Excuse #238: Routing problems on the neural net pgptXRmLwjS4Z.pgp Description: PGP signature
