Heads up: [lcamtuf@ghettot.org: [Full-Disclosure] Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning]

- Forwarded message from Michal Zalewski [EMAIL PROTECTED] - From: Michal Zalewski [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] Date: Sun, 3 Aug 2003 21:12:34 +0200 (CEST) Subject: [Full-Disclosure] Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce

Heads up: [lcamtuf@ghettot.org: [Full-Disclosure] Postfix 1.1.12 remote DoS / Postfix 1.1.11 bounce scanning]

- Forwarded message from Michal Zalewski [EMAIL PROTECTED] - From: Michal Zalewski [EMAIL PROTECTED] To: [EMAIL PROTECTED], bugtraq@securityfocus.com, [EMAIL PROTECTED] Date: Sun, 3 Aug 2003 21:12:34 +0200 (CEST) Subject: [Full-Disclosure] Postfix 1.1.12 remote DoS / Postfix

Re: odd process running /usr/sbin/sendmail -i -CronDaemon -odi -oem root

this then: lsof | grep 2637562 And I find I started a sleep command that (never) feeds the sendmail process: sleep 27412 lupe1w FIFO0,5 2637562 pipe HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Violence is the resort

Re: odd process running /usr/sbin/sendmail -i -CronDaemon -odi -oem root

this then: lsof | grep 2637562 And I find I started a sleep command that (never) feeds the sendmail process: sleep 27412 lupe1w FIFO0,5 2637562 pipe HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Violence is the resort

Re: Apt-get only security patches

features. HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Violence is the resort of the violent Lu Tze | | Thief of Time, Terry Pratchett |

Re: Apt-get only security patches

] Please read DSA-292-3 and DSA-296-1. I suppose kdewallpapers is just updated to keep the version number in sync with the rest of kdebase. Had you updated the other KDE packages before? HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Violence

Re: secure topologies - smtp/dns/whois/....

for the firewall, use port redirection to the DMZ for incoming connections. HTH, Lupe Christoph PS: If you have never used iptables, and you sound like it, give fwbuilder a try. Even if you have, it might be useful because it makes management of the rules easier. -- | [EMAIL PROTECTED

Re: secure topologies - smtp/dns/whois/....

for the firewall, use port redirection to the DMZ for incoming connections. HTH, Lupe Christoph PS: If you have never used iptables, and you sound like it, give fwbuilder a try. Even if you have, it might be useful because it makes management of the rules easier. -- | [EMAIL PROTECTED

Unusable Update for Stable

/updates/main Packages 100 /var/lib/dpkg/status Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith

Unusable Update for Stable

/updates/main Packages 100 /var/lib/dpkg/status Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith

Re: Apologies re: VPN + Roadwarrior

/ Host does not resolve http://www.vpnc.org/conformance.html404 Access denied, or file does not exist Can you please correct again? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic

Re: Apologies re: VPN + Roadwarrior

/ Host does not resolve http://www.vpnc.org/conformance.html404 Access denied, or file does not exist Can you please correct again? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic

Latest libpcap tcpdump sources from tcpdump.org contain a trojan

Hi! Please read http://www.hlug.org/modules.php?op=modloadname=Newsfile=articlesid=6mode=threadorder=0thold=0 Is Debian affected? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Latest libpcap tcpdump sources from tcpdump.org contain a trojan

Hi! Please read http://www.hlug.org/modules.php?op=modloadname=Newsfile=articlesid=6mode=threadorder=0thold=0 Is Debian affected? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Re: Multiple SSL Virtualhosts on Apache 1.3

you use address-based virtual hosts, the certificates are associated with individual addresses, and are available at the right time. Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Re: Multiple SSL Virtualhosts on Apache 1.3

you use address-based virtual hosts, the certificates are associated with individual addresses, and are available at the right time. Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Re: Encrypting/emailing logs and configs

$KEYFILE backup@cabernet:$REMOTEFILE $LOCALFILE HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith great

Re: Encrypting/emailing logs and configs

$KEYFILE [EMAIL PROTECTED]:$REMOTEFILE $LOCALFILE HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable. The designer had a speech impediment. He said: I have | | thith

Re: questions about chrooting bind 8.3.3

control, or how could it use a library function otherwise? You may need the libraries in the jail if named runs external programs. AFAIR, named versions 4 and 8 do that, version 9 doesn't. HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big

Re: Probem with openssh and pam modules

Correct me if I'm wrong, but don't we expect people who run unstable to diagnoseproblems themselves? If they can't they should be running stable or at least testing? Unstable is not just a name... Lupe Christoph On Wednesday, 2002-10-02 at 09:44:38 -0700, Anne Carasik wrote: This one time

Re: Probem with openssh and pam modules

Correct me if I'm wrong, but don't we expect people who run unstable to diagnoseproblems themselves? If they can't they should be running stable or at least testing? Unstable is not just a name... Lupe Christoph On Wednesday, 2002-10-02 at 09:44:38 -0700, Anne Carasik wrote: This one time

Why does rpc.statd need a privileged port?

would break locking between a Solaris and a Linux box, I doubt this would be a good idea. Opinions? Comments? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable

Re: Why does rpc.statd need a privileged port?

On Saturday, 2002-09-28 at 18:33:43 +0200, Wichert Akkerman wrote: Previously Lupe Christoph wrote: Opinions? Comments? Does it really matter? Well it may collide with a service started after it that wants this particular privileged port. I also believe that services that do not require

Why does rpc.statd need a privileged port?

would break locking between a Solaris and a Linux box, I doubt this would be a good idea. Opinions? Comments? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be| | unsinkable

Re: Why does rpc.statd need a privileged port?

On Saturday, 2002-09-28 at 18:33:43 +0200, Wichert Akkerman wrote: Previously Lupe Christoph wrote: Opinions? Comments? Does it really matter? Well it may collide with a service started after it that wants this particular privileged port. I also believe that services that do not require

Re: SSL problems in woody (slapper)

-ssl's Description in sarge says: Description: Pseudopackage for migration from Debian 2.2 (potato). I checked woody, same situation. So unless you are running potato, you can remove both packages. HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big

Re: SSL problems in woody (slapper)

-ssl's Description in sarge says: Description: Pseudopackage for migration from Debian 2.2 (potato). I checked woody, same situation. So unless you are running potato, you can remove both packages. HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big

Re: SSL update.. still giving me a Vulnerable status

libssl0.9.6 Sarge: ii libssl0.9.6 0.9.6e-1 SSL shared libraries Woody: ii libssl0.9.6 0.9.6c-2.woody.1 SSL shared libraries HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398

Re: SSL update.. still giving me a Vulnerable status

library. On my Woody machine, after I restarted httpd, I get 1.2.3.4 443 PATCHED: detects small overflow, but crashes (0.9.6e) HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Re: SSL update.. still giving me a Vulnerable status

libssl0.9.6 Sarge: ii libssl0.9.6 0.9.6e-1 SSL shared libraries Woody: ii libssl0.9.6 0.9.6c-2.woody.1 SSL shared libraries HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398

Re: SSL update.. still giving me a Vulnerable status

library. On my Woody machine, after I restarted httpd, I get 1.2.3.4 443 PATCHED: detects small overflow, but crashes (0.9.6e) HTH, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed

Re: Good Day - spamassin

On Thursday, 2002-09-12 at 10:20:39 +0200, Marcel Hicking wrote: --On Mittwoch, 3. Juli 2002 14:04 +0300 Samuli Suonpaa [EMAIL PROTECTED] wrote: i would rather see that the spam senders see a bounce email that fills up their boxes with returned undeliverables.. So if some spammes forged

Re: LDAP Help requested...please :)

'ldapsearch -x' I get the database dif as I should. Wee, do you want SASL, or not? Your '-x' makes the ldap utilities use basic authentication, i.e. they authenticate against the LDAP database. If you leave '-x' out, SASL is used, so you must set it up. (sasldb) HTH, Lupe Christoph -- | [EMAIL

Re: debian-security-announce-$lang@lists?

the people who volunteer to do it in such a short timeframe.) Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | || | After a while you give up trying to escape who you

Re: Question on the safety sharing NFS with untrusted machines.

the two machines. HTH, Lupe CHristoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys/joke

Re: Good Day

. I know. I received about 20,000 bounces for invalid addresses. apt-get install spamassassin It trapped that one for me as well as 99% of the spam I receive. I still find a Spam in my norfmal inbox now and then. Not enough to warrant tweaking Spamassasin's rules. Lupe Christoph -- | [EMAIL

Re: [Fwd: ISS Advisory: OpenSSH Remote Challenge Vulnerability]

charge for falling for Theo. Seems I took a firm stand and bent over for him. Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern

Re: NIS et propagation de groupes

| --- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] --- Also sprach Sebastien Picard --- And a shorter signature would also be appreciated. Thank you, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de

Re: Why is there a prompt for a root shell when the default linux kernel boots?

and could change DELAY. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys

Re: Why is there a prompt for a root shell when the default linux kernel boots?

and could change DELAY. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys

Re: world readable log files and /etc/ files

about the permissions, so I have to go check them. Be paranoid within reason. If you tighten security so much that you can only work as root, you're easier to screw by trojans. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO

Re: world readable log files and /etc/ files

about the permissions, so I have to go check them. Be paranoid within reason. If you tighten security so much that you can only work as root, you're easier to screw by trojans. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO

Re: fswcert

On Tuesday, 2002-04-09 at 08:50:18 -0400, Andrew Pimlott wrote: On Tue, Apr 09, 2002 at 08:01:14AM +0200, Lupe Christoph wrote: Here is an example: conn %default authby=rsasig leftrsasigkey=%cert rightrsasigkey=%cert left=%defaultroute

Re: fswcert

: openssl x509 -in certificate.pem -noout -text | sed -n -e 's/.*Subject: //p' Mail me directly if you need help setting this up. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team

Re: fswcert

On Tuesday, 2002-04-09 at 08:50:18 -0400, Andrew Pimlott wrote: On Tue, Apr 09, 2002 at 08:01:14AM +0200, Lupe Christoph wrote: Here is an example: conn %default authby=rsasig leftrsasigkey=%cert rightrsasigkey=%cert left=%defaultroute

Re: fswcert

-in certificate.pem -noout -text | sed -n -e 's/.*Subject: //p' Mail me directly if you need help setting this up. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest

Re: iptables not logging or dhcp-client lying?

. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys/joke/klingon.htm

Re: iptables not logging or dhcp-client lying?

. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys/joke/klingon.htm

Re: Debian mail server.

. Not much better, though. Maybe worse... Putting the IMAP server in a chroot jail would also give you an increase in security. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team

Re: Debian mail server.

. Not much better, though. Maybe worse... Putting the IMAP server in a chroot jail would also give you an increase in security. HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team

Re: CERT Advisory CA-2002-05 Multiple Vulnerabilities in PHP fileupload

. Or wait if somebody provides an updated php4 package (4.0.5-3?). HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again

Re: CERT Advisory CA-2002-05 Multiple Vulnerabilities in PHP fileupload

if somebody provides an updated php4 package (4.0.5-3?). HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again

Re: dpkg-buildpackage (-rfakeroot) leaves setuid binaries

to catch somebody unawares from a Makefile.PL. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http

Re: dpkg-buildpackage (-rfakeroot) leaves setuid binaries

to catch somebody unawares from a Makefile.PL. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http

Re: Debian security being trashed in Linux Today comments

On Tuesday, 2002-01-15 at 13:07:12 +0100, Javier Fernández-Sanguino Peña wrote: On Tue, Jan 15, 2002 at 09:23:20AM +0100, Lupe Christoph wrote: I still think a table and graph would be a god addition to the security FAQ, as an answer to the question How long does Debian take to fix known

Re: Debian security being trashed in Linux Today comments

, and Windowses. My gut feeling is that Debian would shine in such a comparison. Initially, I came to Debian because I had the feeling that it was the Linux dustribution with the fastest reaction to the discovery of vulnerabilities. Judging from BUGTRAQ. Lupe Christoph -- | [EMAIL PROTECTED

Re: Debian security being trashed in Linux Today comments

On Tuesday, 2002-01-15 at 13:07:12 +0100, Javier Fernández-Sanguino Peña wrote: On Tue, Jan 15, 2002 at 09:23:20AM +0100, Lupe Christoph wrote: I still think a table and graph would be a god addition to the security FAQ, as an answer to the question How long does Debian take to fix known

Re: Debian security being trashed in Linux Today comments

, and Windowses. My gut feeling is that Debian would shine in such a comparison. Initially, I came to Debian because I had the feeling that it was the Linux dustribution with the fastest reaction to the discovery of vulnerabilities. Judging from BUGTRAQ. Lupe Christoph -- | [EMAIL PROTECTED

Re: Asking for documentation help (Re: IPSec questions...)

sincerely hope this can happen soon. Until then, SuSE is ways easier to set up for PPTP. (Dunno what they deliver in the US, but here in Germany, they have those patches integrated.) Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged

Re: Debian security being trashed in Linux Today comments

? I don't keep debian-security mails around, so I can't see what MIME-type the attachments had. The binary crap must be the spreadsheet which has been inlined. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality

Re: Asking for documentation help (Re: IPSec questions...)

sincerely hope this can happen soon. Until then, SuSE is ways easier to set up for PPTP. (Dunno what they deliver in the US, but here in Germany, they have those patches integrated.) Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged

Re: Debian security being trashed in Linux Today comments

? I don't keep debian-security mails around, so I can't see what MIME-type the attachments had. The binary crap must be the spreadsheet which has been inlined. Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality

Re: Is ident secure?

On Saturday, 2001-09-01 at 11:02:41 +0200, Martin F Krafft wrote: also sprach Layne (on Fri, 31 Aug 2001 11:04:30PM -0400): MARTIN FONDLES YOUNG BOYS. which one? Which Martin or which boy? *-O Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have

Re: Is ident secure?

On Saturday, 2001-09-01 at 11:02:41 +0200, Martin F Krafft wrote: also sprach Layne (on Fri, 31 Aug 2001 11:04:30PM -0400): MARTIN FONDLES YOUNG BOYS. which one? Which Martin or which boy? *-O Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have

Re: Linux LDAP problem

by other applications, so it's not clear. But there's a way: RTFS! :-) HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us

Re: Logging practices (and why does it suck in Debian?)

of libc? Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys/joke

Re: Logging practices (and why does it suck in Debian?)

of libc? Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | I have challenged the entire ISO-9000 quality assurance team to a | | Bat-Leth contest on the holodeck. They will not concern us again. | | http://public.logica.com/~stepneys/joke/klingon.htm|

Re: More detailed auditing design proposal

probably require massive CPU power, alas.) HTH, Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | The equal opportunity democracy - every vote has an equal chance | | of being counted. Though a bad one if you live in Florida. | | Those

Re: Debian audititing tool?

y is at http://www.freeveracity.org/ Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | The equal opportunity democracy - every vote has an equal chance | | of being counted. Though a bad one if you live in Florida. | | Those peopl

Re: Debian audititing tool?

://www.freeveracity.org/ Lupe Christoph -- | [EMAIL PROTECTED] |http://free.prohosting.com/~lupe | | The equal opportunity democracy - every vote has an equal chance | | of being counted. Though a bad one if you live in Florida. | | Those people told us how to run a democracy ?!?|

<    1   2