[CCP14 Home: (Frames | No Frames)]
CCP14 Mirrors: [UK] | [CA] | [US] | [AU]

(This Webpage Page in No Frames Mode)

Collaborative Computational Project Number 14

for Single Crystal and Powder Diffraction

CCP14

Server Security Information

Software, Information and Pseudo Random Links

The CCP14 Homepage is at http://www.ccp14.ac.uk

[Back to CCP14 Web/Config Main Page]

[Security Links Homepage]

To: Exploit-Dev
 Subject: Re: ssh-1.2.27 remote buffer overflow - exploitable
 Date:  Mon Nov 08 1999 21:24:17
 Author: Daniel Jacobowitz
 Message-ID: [19991109112417.A30046@drow.res.cmu.edu]


On Tue, Nov 09, 1999 at 01:48:53AM -0000, Frank wrote:
> This is submitted to the Freebsd bug tracking system, although there
> are doubtless other vendors who leave this package, despite the
> existence of the ssh-2.X.  While Debian appears to be immune, I was
> able to crash my ssh daemon (much to my dismay), and there appears
> the potential to execute arbitrary code, as long as you encrypt it
> first...
>
> Here is the freebsd report.. it describes the method to crash a
> remote Ssh daemon (lets hope you ran sshd from your xinetd, etc).
>
> http://www.freebsd.org/cgi/query-pr.cgi?pr=14749
>

And here's a patch.  Not tested, as I don't use the rsaref glue on any
machine here.

Dan

/--------------------------------\  /--------------------------------\
|       Daniel Jacobowitz        |__|        SCS Class of 2002       |
|   Debian GNU/Linux Developer    __    Carnegie Mellon University   |
|         dan@debian.org         |  |       dmj+@andrew.cmu.edu      |
\--------------------------------/  \--------------------------------/

--- rsaglue.c.orig      Tue Nov  9 11:12:32 1999
+++ rsaglue.c   Tue Nov  9 11:17:58 1999
@@ -139,6 +139,10 @@

   input_bits = mpz_sizeinbase(input, 2);
   input_len = (input_bits + 7) / 8;
+  if(input_bits > MAX_RSA_MODULUS_BITS)
+    fatal("Attempted to encrypt a block too large (%d bits, %d max) (malicious?).",
+       input_bits, MAX_RSA_MODULUS_BITS);
+
   gmp_to_rsaref(input_data, input_len, input);

   rsaref_public_key(&public_key, key);
@@ -172,6 +176,10 @@

   input_bits = mpz_sizeinbase(input, 2);
   input_len = (input_bits + 7) / 8;
+  if(input_bits > MAX_RSA_MODULUS_BITS)
+    fatal("Received session key too long (%d bits, %d max) (malicious?).",
+       input_bits, MAX_RSA_MODULUS_BITS);
+
   gmp_to_rsaref(input_data, input_len, input);

   rsaref_private_key(&private_key, key);





  • 5.6. Can I use ssh to protect services like FTP or POP?

    5.6. Can I use ssh to protect services like FTP or POP?

    If you want to avoid sending FTP passwords in cleartext over the net, you can use ssh to encrypt your command channel. This will still leave your data channel open to all attacks on TCP, and will not work through a firewall.

    You can either use ftpsshd by Per-Erik Martin at http://www.docs.uu.se/~pem/hacks/ for SSH1, or you can do this by hand.

    SSH1: Suppose you are on a host called myhost and want to initiate a ftp connection to ftphost. On myhost, you do

    myhost$ ssh -L 1234:ftphost.example.com:21 ssh-server
    This logs you on to ftphost and also forwards connections to 1234 on myhost to ftphost.

    Note: You need to use -g if you're forwarding to localhost (SSH1 only).

    Then, in another window, you do

    myhost$ ftp localhost 1234
    220 ftphost FTP server (Foonix 08/15) ready.
    Name: (myhost:yourname):
    331 Password required for yourname
    Password:
    230 User yourname logged in.
    This works if the remote ftp daemon accepts PORT commands which specify a different host from the one the command channel appears to come from, and if the ftp client always uses PORT. This is true for vanilla UNIX ftp client and ftpd servers; it may not work for more advanced ftpds, such as wu-ftpd.

    For servers which do not accept this, you can see wether you ftp client supports passive mode, and wether the ftp server accepts PASV.

    Note, however, that unencrypted ftp data connections are still vulnerable to session hijacking and snooping.

    SSH2: Just use sftp instead. :-)

    For POP, Stephane Bortzmeyer (bortzmeyer@pasteur.fr) has written a script which protects the mail transfer and passwords ussing ssh. It requires no modification to existing POP servers or clients, and is available from ftp://ftp.internatif.org/pub/unix/gwpop/ .

    Or, you can use similar means for secure POP:

    myhost$ ssh -L 1234:popserver.example.com:110 ssh-server

    Other services could be secured by similar means.

    5.7. Can I use ssh across a Socks firewall?

    Socks 4 and 5 support should work in 1.2.16 or later. Socks support in version 2.0.11 and later should work.


  • Newsgroups: comp.security.unix
    Subject: Re: secure pop from sniffing
    From: [bglbv@my-deja.com]
    X-Newsreader: Gnus v5.7/Emacs 20.6
    Date: 06 Jun 2000 20:29:54 +0100
    
    
    "Bernd Dürrer" [duerrer@ika.ruhr-uni-bochum.de] writes:
    
    > "kukulkan" [isman@fsksm.utm.my] schrieb im Newsbeitrag
    > news:393C65B2.5A676C14@fsksm.utm.my...
    > > any software/methods to secure pop(esp. Eudora users) from being sniff?I
    > > have ssh  here to protect remote login and file transfer, but still it
    > > has no meaning If I cannot have the pop to be secure ..
    
    > You want to use the port forwarding capabilities of SSH: Have a look at
    > http://www.employees.org/~satch/ssh/faq/ssh-faq-5.html#ss5.6
    > 
    > If this doesn't help you, please post what SSH implementation on what OS
    > your pop users are using.
    
    I don't think Eudora supports the SSH protocol at all.
    What it might support is:
    
    (a) APOP (Authenticated POP), which involves transmitting a (non-replayable)
    hash of the POP password and of a challenge sent by the POP server.
    The POP password is distinct from the password used for interactive logins.
    
    (b) POP over an SSL tunnel (to port 995 rather than 110).
    
    If I remember correctly, Eudora can do (a) but not (b), while Netscape
    Messenger can do (b) [but not (a)?]. It's probably wise to support both.
    And to make the POP passwords different from the login passwords in
    any case.
    
    Also make sure your POP server has no known security holes. (Some
    versions of Qpopper are to be avoided, for example.)


    From: eitz@weh.rwth-aachen.de (Holger Eitzenberger)
    Newsgroups: comp.security.unix
    Subject: Re: secure pop from sniffing
    Date: 7 Jun 2000 09:22:00 GMT
    Organization: RWTH Aachen
    Lines: 16
    
    On Tue, 06 Jun 2000 10:45:06 +0800, isman@fsksm.utm.my (kukulkan) wrote:
    
    >any software/methods to secure pop(esp. Eudora users) from being sniff?I
    >have ssh  here to protect remote login and file transfer, but still it
    >has no meaning If I cannot have the pop to be secure ..
    
    You may want to use APOP (authenticated POP3), which i use also.  Both
    QPopper (on server side) and fetchmail (on client side) support it.
    APOP uses an encrypted one-time key to get mail.
    
    Holger
    
    
    -- 
    + GnuPG Public Key -> finger eitz@jonathan.weh.rwth-aachen.de +

    Using APOP at NCSA - What is APOP?

    • "APOP is a challenge-response authentication scheme built on top of the standard POP protocol. It's designed in a way that protects your password from ever being sent across the network.

      To keep your password safe, the server actually stores your password in a file on local disk. Whenever your mail client connects to the APOP server a magic string is sent back. That string contains a unique identifier for this session based upon the process id (PID) and current time. Here's a sample string (the special part is enclosed within angle brackets):

      +OK QPOP (version 2.53) at mx1.ncsa.uiuc.edu starting. <14156.916910505@mx1.ncsa.uiuc.edu>

      Your email program uses the text within those angle brackets to perform a mathematical calculation upon your password. The server also performs the same calculation on the password that it has stored locally. When your email program is finished with its calculations it sends a 128-bit "fingerprint" to the APOP server, which then compares that value with the one that was calculated locally. If both fingerprints match, then it knows that the same password was used to perform the calculation in both places.

      Since the string that the server sends is based on the current time and PID it's impossible for anyone to reuse it; each connection to the server results in a new challenge/response and calculation. "

    • At http://www.ncsa.uiuc.edu/General/CC/email/apop.html#whatis





  • Restricting a user to a home directory



  • BT bills go open source

  • Mobiles more dangerous than wild elephants

  • Microwindows and NanoGUI Projects

  • ACM (Association for Computing Machinery) - founded in 1947

  • SIGOPS is the ACM Special Interest Group on Operating Systems

  • Wine Development HQ

  • Plex86

  • The FreeDOS Project (A free version of DOS)

  • Net_Stat for Windows 95 - Graphic Netstat with logging and update - shareware

  • NetScanTools for Windows 95 - Graphic Netstat with logging and update - shareware

  • Syslog Daemon for Windows - freeware

  • syslog-ng for UNIX

  • Any Speed - shareware

  • The Eternity Service - Distributed Storage of Provocative Material

  • C Benson - Welcome to my Internet Security Page

  • SGI/IRIX Security Frequently Asked Questions (FAQ)

  • SGI/IRIX FAQ Frequently Asked Questions (FAQ)

  • Guide for making an IndyCam 'picture' in a WWW page (by Christopher Spry)

  • Guide for configuring an SGI Indy with IRIX 6.5 (by Christopher Spry)

  • A script that sets the shutter speed on an Indycam (by A. Kooijman a.kooijman@io.tudelft.nl)

  • Scanlogd (a port scan detection tool)

  • Sam Spade

  • Win32s, WinG for Windows 3.1

  • Network Calculators

  • L2TP

  • NADS

  • Cheops

  • CheopsNG

  • npadmin

  • Lubbock

  • Tom's Root Boot

  • Linuxcare Bootable Business Card

  • Scanlogd for linux - Port Scan detection and "John the Ripper" password breaker

  • Basic information on passwords and how they are compromised

  • Funny Photos - Anti Microsoft - humour / humor

  • Abacus Sentry for UNIX

  • Know Your Enemy:III, by Lance Spitzner

  • Analysis of the T0rn rootkit

  • chkrootkit - locally checks for signs of a rootkit on a UNIX system

  • Wietse Venema's TCP Wrapper (tcpwrapper) and other tools, COPs, Tiger, etc

  • Wietse Venema's RPC Bind - rpcbind/portmapper

  • Restricting Root Access to a Linux box to console login
  • Restricting Access to rpcbind in IRIX 6.5.x
  • ipfw and ipfilter firewall software as relating to FreeBSD
  • Restricting Access to NFS/Mountd/Portmapper in IRIX 6.5.x

  • IP NETWORK INDEX

  • Getting an SGI O2 running 100 Mb/s full duplex / Setting ethernet speed.
  • Use nvram to see the settings then you can use the nvram command to set a PROM setting via a normal shell option if the name is in non-VOLATILE RAM.
  • In the help page, refers to /var/sysgen/master.d/if_ecf file where int ecf_spdpx= will set the speed
  • SGI O2 can support 10Mbps, full duplex
  • autoconfig to rebuild the kernel
  • init 6 to reboot from a root-shell.
  • To see what speed and mode the SGI O2 Network card is in:
    ifconfig ec0 debug
    Unplug/replug network cable, and check console and SYSLOG. 
    ifconfig ec0 -debug
    
    Alexis Cousein                  al@brussels.sgi.com     
    Systems Engineer                SGI Belgium

  • Adding a domain name on an SGI IRIX machine.

  • Finding out swap settings on an SGI O2, reserved, etc.

  • Finding out what bus and ID a device is on with an SGI

  • Klaxon for UNIX

  • Tcplogd

  • Syslog for Win 95

  • Downloading LPD software for Win 95

  • Mocha W32 LPD version 1.3 for Win 95 adn Win98

  • Remote Print Manager LPD for Win95

  • LPD32 for Win95

  • Networking Servers for Windows 95

  • Rootkit

  • Pedestal Software

  • Detect-Scans

  • Synlog

  • iplog for Linux

  • Logit for UNIX

  • ippl for UNIX

  • Dictionary lists for Password Cracking

  • Guide for setting up Samba v 2.0.* on an Indy running IRIX 6.5.*

  • This document outlines steps to compile a recent version of Sendmail for IRIX 6.2 without resorting to SGI's native cc compiler.

  • SGI IRIX and Internet Applications including Proftpd, Secure Shell and Apache 1.3.x Web Server - getting lots of 255.255.255.255 in the server logs and related program failures due to not logging the correct IP address

  • SRP (The Stanford SRP Authentication Project)

  • Unix tools for NT, this includes a NIS password synchronization tool

  • Moneky - a commercial enhanced OPIE - OneTime Password in Everything

  • OPIE Information - OneTime Password in Everything

  • OPIE Information - OneTime Password in Everything

  • Audio CD Database - creating custom CD-ROMs

  • Articles/resources about Software Patents / Windows NT Patents