Re: VPN gateway

2003-05-28 Thread Warren Turkal
On Sunday 25 May 2003 09:32 pm, Jeremy T. Bouse wrote: Did you already check out documentation at the following URL? http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/interop.html#micro soft I have a question that i have not been able to find a good conclusion for. Is the

xinetd memory leak

2003-05-28 Thread NANTENAINA TIANARIVO U.
Hi folk, On Apr 18 2003 4:18PM, at the bugtraq list Steve Grubb announced a bug on Xinetd 2.3.10 and as a solution he advised to upgrade to the version 2.3.11. http://www.securityfocus.com/archive/1/319088 As the version in the stable woody is 2.3.4-1.2, I would like to know if this package

Re: VPN gateway

2003-05-28 Thread Daniel Kobras
On Wed, May 28, 2003 at 03:36:07AM -0500, Warren Turkal wrote: I have a question that i have not been able to find a good conclusion for. Is the Freeswan stuff compatible with the cisco vpn that require user/pass logins? It's definitely not compatible on its own. I asked Cisco support, and

Re: xinetd memory leak

2003-05-28 Thread Thomas Seyrat
On May 28, 12:05 (+0300), NANTENAINA TIANARIVO U. wrote: As the version in the stable woody is 2.3.4-1.2, I would like to know if this package is also vulnerable. If so is there any workaround about this on the debian security team? #190217 Versions in potato and woody are not

Bind9 queries from strange UDP port

2003-05-28 Thread Kondrashov Nickolay
Hello to all * I've got a problem with bind9 It is occasionaly sending it's queries using low numbered UDP port despite query-source address * port 53; set in named.conf. Most of the time it's using UDP port 53, as configured, but sometimes, irrelatively of anything (as it

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Marcel Weber
Jayson Vantuyl wrote: This has been a hit on about seven different machines with vastly different configurations (some missing everything but SSH) and all firewalled down to the minimum. I did not reread the whole thread, so sorry if I'm asking silly questions, but perhaps it's not a security

Re: Bind9 queries from strange UDP port

2003-05-28 Thread Kondrashov Nickolay
Kondrashov Nickolay wrote: Hello to all * I've got a problem with bind9 It is occasionaly sending it's queries using low numbered UDP port despite query-source address * port 53; set in named.conf. Most of the time it's using UDP port 53, as configured, but sometimes,

LVS+grsecurity

2003-05-28 Thread Martynas Domarkas
Hi, I have a strange problem setting LVS (Linux Virtual Server) for a WEB server. It works fine until browser tries to POST some information. Most of times browser hangs for a while and exits after timeout, in logs I can find error message about erroneus Content-length. As far as I understand,

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Olaf Dietsche
Jayson Vantuyl [EMAIL PROTECTED] writes: Thankfully, we don't have root passwords. In our space, we find root to more of a concept than a user, so we disable the password and set up a group that can su to root. That way we have a good handle on things. Root never logs in, so we know

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Jayson Vantuyl
On Sun, May 25, 2003 at 02:32:56PM -0400, Noah Meyerhans wrote: If you believe he'll be back, it might be worth it to set up a honeypot and a box running tcpdump and capturing all the traffic to honeypot. Set the honeypot up with the same services you run on your production machines, and make

Re: [despammed] Advice Needed On Recent Rootings

2003-05-28 Thread Jayson Vantuyl
On Sun, May 25, 2003 at 02:35:32PM -0400, Ed McMan wrote: Sunday, May 25, 2003, 2:04:30 PM, Jayson Vantuyl (Jayson) wrote: Jayson We've had a number of hacked boxen recently. It appears a certain Jayson person (Romanian we think) is specifically targeting us and our Jayson customers (looks

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Jayson Vantuyl
On Sun, May 25, 2003 at 08:44:29PM +0100, David Ramsden wrote: I've found that when running a system were the users can put up their web pages.. most insecure. It's virtually impossible to know what each user is running under their web space.. An exploitable version of PHPNuke for example,

unsubscribe

2003-05-28 Thread konio

Re: iptables question

2003-05-28 Thread Jayson Vantuyl
On Tue, May 27, 2003 at 06:23:10PM -0500, Andr?s Rold?n wrote: Hi. I was reading about certain kind of attacks about TCP sequence and I was wondering whether iptables is vulnerable to theses attacks. Especifically, whether iptables is capable to know if a RELATED or ESTABLISHED package is

Re: VPN gateway

2003-05-28 Thread Warren Turkal
On Sunday 25 May 2003 09:32 pm, Jeremy T. Bouse wrote: Did you already check out documentation at the following URL? http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/interop.html#micro soft I have a question that i have not been able to find a good conclusion for. Is the

xinetd memory leak

2003-05-28 Thread NANTENAINA TIANARIVO U.
Hi folk, On Apr 18 2003 4:18PM, at the bugtraq list Steve Grubb announced a bug on Xinetd 2.3.10 and as a solution he advised to upgrade to the version 2.3.11. http://www.securityfocus.com/archive/1/319088 As the version in the stable woody is 2.3.4-1.2, I would like to know if this package

Re: VPN gateway

2003-05-28 Thread Daniel Kobras
On Wed, May 28, 2003 at 03:36:07AM -0500, Warren Turkal wrote: I have a question that i have not been able to find a good conclusion for. Is the Freeswan stuff compatible with the cisco vpn that require user/pass logins? It's definitely not compatible on its own. I asked Cisco support, and

Re: xinetd memory leak

2003-05-28 Thread Thomas Seyrat
On May 28, 12:05 (+0300), NANTENAINA TIANARIVO U. wrote: As the version in the stable woody is 2.3.4-1.2, I would like to know if this package is also vulnerable. If so is there any workaround about this on the debian security team? #190217 Versions in potato and woody are not

Bind9 queries from strange UDP port

2003-05-28 Thread Kondrashov Nickolay
Hello to all * I've got a problem with bind9 It is occasionaly sending it's queries using low numbered UDP port despite query-source address * port 53; set in named.conf. Most of the time it's using UDP port 53, as configured, but sometimes, irrelatively of

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Marcel Weber
Jayson Vantuyl wrote: This has been a hit on about seven different machines with vastly different configurations (some missing everything but SSH) and all firewalled down to the minimum. I did not reread the whole thread, so sorry if I'm asking silly questions, but perhaps it's not a

Re: Bind9 queries from strange UDP port

2003-05-28 Thread Kondrashov Nickolay
Kondrashov Nickolay wrote: Hello to all * I've got a problem with bind9 It is occasionaly sending it's queries using low numbered UDP port despite query-source address * port 53; set in named.conf. Most of the time it's using UDP port 53, as configured, but sometimes,

LVS+grsecurity

2003-05-28 Thread Martynas Domarkas
Hi, I have a strange problem setting LVS (Linux Virtual Server) for a WEB server. It works fine until browser tries to POST some information. Most of times browser hangs for a while and exits after timeout, in logs I can find error message about erroneus Content-length. As far as I understand,

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Olaf Dietsche
Jayson Vantuyl [EMAIL PROTECTED] writes: Thankfully, we don't have root passwords. In our space, we find root to more of a concept than a user, so we disable the password and set up a group that can su to root. That way we have a good handle on things. Root never logs in, so we know

Re: VPN gateway

2003-05-28 Thread Chris Caldwell
Daniel Kobras sent the following message Today: DK It's definitely not compatible on its own. I asked Cisco support, and DK they told me that it _might_ work when running freeswan on top of l2tp. DK Didn't get me much further, though. If someone else manages to figure it DK out, please let

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Jason Lunz
[EMAIL PROTECTED] said: of them. It's not a password problem either. He seems to have hacked multiple of them within an hour of each other (his rootkit files aren't very clever about covering up mtime). I just can't tell how he got in. Maybe he didn't use the same method for all of them.

Jetzt im neuen Outfit...

2003-05-28 Thread info
Sehr geehrte Damen und Herren, klein, quadratisch, praktisch und hoffentlich gut, präsentiert sich jetzt unser Marktplatz für das Bayerische Oberland. Unter http://www.sylvenstein.com finden Sie unsere neu überholte regionale Suchmaschine, das Oberland-Branchenbuch und natürlich unseren

[no subject]

2003-05-28 Thread info
=== Sollten Sie keine Informationen mehr von uns wünchen, können Sie Ihre Email-Adresse über folgende URL sofort aus dem System entfernen: http://www.sylvenstein.com/mailer/mailnews.html ===

Re: Advice Needed On Recent Rootings

2003-05-28 Thread Noah Meyerhans
On Wed, May 28, 2003 at 02:06:21PM +0200, Olaf Dietsche wrote: Just curious, how do you su to root, if root's password is disabled? Do you have a modified su replacement? su uses PAM. So it doesn't need to use root entry in /etc/passwd. It could do something insane like consult a RADIUS

Perfect.BR Team

2003-05-28 Thread Neil McGovern
Taken from news://blueyonder.comp.linux - A friend of mine has his Debian box r00ted. It only seems to have been brought to his attention after seeing a file being wgetted and compiled within his Apache error log. He brought it to my attention as he originally suspected that there may be