September 2003 - WLUG - wlug.mailman3.com

Re: [Wlug] OpenSSH Remote Root

by Charles R. Anderson

On Tue, Sep 16, 2003 at 09:04:59PM -0400, Mike Frysinger wrote: vapier> for those of you who havent upgraded yet, 3.7.1p1 has been released to 'fix vapier> similar issues' :) #@#%&(#!! I just upgraded! Those bastards! -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Sept. 17, 2003

Re: [Wlug] OpenSSH Remote Root

by Mike Frysinger

for those of you who havent upgraded yet, 3.7.1p1 has been released to 'fix similar issues' :) ftp://ftp.ca.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog - (djm) OpenBSD Sync - markus(a)cvs.openbsd.org 2003/09/16 21:02:40 [buffer.c channels.c version.h] more malloc/fatal fixes; ok millert/deraadt; ghudson at MIT.EDU http://wh0rd.de/gentoo/distfiles/openssh-3.7.1p1.tar.gz -mike

Sept. 17, 2003

Re: [Wlug] OpenSSH Remote Root

by Josh Huber

"Brian J. Conway" <bconway(a)alum.WPI.EDU> writes: > Also, I would be wary and watch for updates in the immediate future. > While the buffer.c fix is _an_ update, many are saying it's not > remotely exploitable, which begs the question what is exploiting all > the reportedly rooted machines that people are claiming to have the > latest version of OpenSSH (with PrivSep) running on. Of course, > it's the Internet, so any number of people can and are talking out > of their a**es, so I'd wait for the dust to settle and keep an eye > on this one (but update now, of course). Exactly my thoughts. This is why my ssh port is still IP restricted for the moment :) -- Josh Huber

Sept. 16, 2003

Re: [Wlug] OpenSSH Remote Root

by Brian J. Conway

Also, I would be wary and watch for updates in the immediate future. While the buffer.c fix is _an_ update, many are saying it's not remotely exploitable, which begs the question what is exploiting all the reportedly rooted machines that people are claiming to have the latest version of OpenSSH (with PrivSep) running on. Of course, it's the Internet, so any number of people can and are talking out of their a**es, so I'd wait for the dust to settle and keep an eye on this one (but update now, of course). -b > On Tuesday 16 September 2003 15:46, Matt Higgins wrote: > > There is a remote root exploit for OpenSSH <3.7 (note 3.7 was released > > today) Check your vendor or get the latest sources or apply the patch from > > the link below. > > the openssh ftp server has been swamped this morning (well since the /. > bastards got to it ;D) > i mirrored the file before it was /. so if you cant find it, it's at WPI here: > http://wh0rd.de/gentoo/distfiles/openssh-3.7p1.tar.gz > for you Gentoo users, the update has been on rsync mirrors for a few hours now > so just `emerge sync ; emerge -u openssh ; /etc/init.d/sshd restart` ;) > -mike >

Sept. 16, 2003

Re: [Wlug] OpenSSH Remote Root

by Mike Frysinger

On Tuesday 16 September 2003 15:46, Matt Higgins wrote: > There is a remote root exploit for OpenSSH <3.7 (note 3.7 was released > today) Check your vendor or get the latest sources or apply the patch from > the link below. the openssh ftp server has been swamped this morning (well since the /. bastards got to it ;D) i mirrored the file before it was /. so if you cant find it, it's at WPI here: http://wh0rd.de/gentoo/distfiles/openssh-3.7p1.tar.gz for you Gentoo users, the update has been on rsync mirrors for a few hours now so just `emerge sync ; emerge -u openssh ; /etc/init.d/sshd restart` ;) -mike

Sept. 16, 2003

OpenSSH Remote Root

by Matt Higgins

There is a remote root exploit for OpenSSH <3.7 (note 3.7 was released today) Check your vendor or get the latest sources or apply the patch from the link below. http://www.openssh.com/txt/buffer.adv Matt

Sept. 16, 2003

Sendmail SMTP-AUTH

by Aramico

Friends, Can you please guide me to implement Sendmail SMTP-AUTH sistematically. I have Sendmail running in Redhat Advance Server. Here I would like to implement Sendmail SMTP-AUTH to run in this machine, got not work :( Can somebody help me sistematically ? Thanks.

Sept. 16, 2003

Re: [Wlug] samba issue

by Matt Higgins

Using smbpasswd is the way to go but if you want your linux box to act more like a windows box you can do the following. keep the security = share param. Add a guest account param in the global section of your smb.conf and make sure the guest user has atleast read permission on the dir you intend to share. guest account = some_username under the share definition add the guest ok param guest ok = yes with those params you should be able to connect to the box w/o a password like Windows. Further insecurity. If the guest account has read write access to the dir you want to share and you add the following to the smb.conf under the share def users can read and write. writeable = yes Matt Quoting Chuck Noyes <cc.noyes(a)verizon.net>: > Hi all... > > I created a directory, on my RH 9.0 (2.4.20) Linux server, that I would > like to share with other computers on our LAN. > I have smb and nmb running and I can see the share from a MS windows 2000 > box. When I try to map the drive and click on > the remote folder name (\\linux-hostname\share-name), it asks me to log on > to the Linux server (I'm using security = share > in /etc/samba/smb.conf). When I enter my username/password pair, it tells > me that they're invalid. I have identical > usernames & passwords on both boxes and I'm not encrypting the usernames > and passwords...yet. I'm using version > samba-2.2.7a-8.9.0 for samba-common, samba-client and samba itself. > > What am I missing? > > Thanks, > Chuck > > -- > Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/ > > > _______________________________________________ > Wlug mailing list > Wlug(a)mail.wlug.org > http://mail.wlug.org/mailman/listinfo/wlug > >

Sept. 16, 2003

Re: [Wlug] samba issue

by Chuck Homic

On Mon, Sep 15, 2003 at 07:36:20PM -0400, Charles R. Anderson wrote: > Recent versions of Windows refuse to authenticate using plain-text > passwords. Try using password encryption. You should use security = > user, and set up accounts on the Linux box with smbadduser (smbpasswd > to set the passwords). E.g.: > > #smbadduser noyes:noyes > Adding: noyes to /etc/samba/smbpasswd > Added user noyes. In order to simulate share level access, I usually create a fake user (smbuser) and use "force user = smbuser" on the share so that all you need to enter is the password. Then the password is set by doing "smbpasswd smbuser" or whatever.

Sept. 16, 2003

Re: [Wlug] samba issue

by Charles R. Anderson

On Mon, Sep 15, 2003 at 02:44:12PM -0400, Chuck Noyes wrote: cc.noyes> me that they're invalid. I have identical cc.noyes> usernames & passwords on both boxes and I'm not encrypting the usernames cc.noyes> and passwords...yet. I'm using version cc.noyes> samba-2.2.7a-8.9.0 for samba-common, samba-client and samba itself. cc.noyes> cc.noyes> What am I missing? Recent versions of Windows refuse to authenticate using plain-text passwords. Try using password encryption. You should use security = user, and set up accounts on the Linux box with smbadduser (smbpasswd to set the passwords). E.g.: #smbadduser noyes:noyes Adding: noyes to /etc/samba/smbpasswd Added user noyes. ---------------------------------------------------------- ENTER password for noyes New SMB password: Retype new SMB password: Password changed for user noyes. -- Charles R. Anderson <cra(a)wpi.edu> / http://angus.ind.wpi.edu/~cra/ PGP Key ID: 49BB5886 Fingerprint: EBA3 A106 7C93 FA07 8E15 3AC2 C367 A0F9 49BB 5886

Sept. 15, 2003