- Arch-general - lists.archlinux.org

Re: [arch-general] Port 80 is shown open in port scan without any web server running
by Partha Chowdhury 30 Mar '11

30 Mar '11

On 30/03/11 14:16, Thomas Bächler wrote: > Am 30.03.2011 10:36, schrieb Partha Chowdhury: > > >>> sudo /sbin/iptables-save >>> # Generated by iptables-save v1.4.7 on Wed Mar 30 13:59:44 2011 >>> *filter >>> :INPUT DROP [2844:282816] >>> :FORWARD DROP [0:0] >>> :OUTPUT ACCEPT [9999:990098] >>> -A INPUT -i lo -j ACCEPT >>> -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT >>> -A INPUT -p tcp -m tcp --dport 54215 -j ACCEPT >>> -A INPUT -p udp -m udp --dport 54215 -j ACCEPT >>> COMMIT >>> # Completed on Wed Mar 30 13:59:44 2011 > The following is OT, but I have to say it: > > This is an affront to every admin of smaller or bigger networks. It > hurts my eyes. What do you try to achieve by dropping unwanted traffic? > You even drop ICMP entirely - dropping ICMP is the cause of a large > number of problems. > > There is no security advantage, but you deliberately prevent proper > communication between yourself and other computers on the internet. > Well I picked this configuration from Red Hat training books, except for port 54215 which I open for bit torrent. What do you suggest about the ideal iptables configuration for basic desktop user - allowing proper connection as you said and yet stay secure from malicious port scanners ? On 30/03/11 14:20, Jan de Groot wrote: > . Try doing an nmap -sV and > you'll see what software is running on the proxyserver. I did what you said: > nmap -sV 115.187.45.97 > > Starting Nmap 4.20 ( http://insecure.org ) at 2011-03-30 15:06 IST > Interesting ports on 115.187.45.97: > Not shown: 1696 filtered ports > PORT STATE SERVICE VERSION > 80/tcp open http? > 1 service unrecognized despite returning data. If you know the > service/version, please submit the following fingerprint at > http://www.insecure.org/cgi-bin/servicefp-submit.cgi : > SF-Port80-TCP:V=4.20%I=7%D=3/30%Time=4D92F9D0%P=i686-pc-linux-gnu%r(Help,D > SF:DD,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nServer:\x20squid/3\.2\.0\.4-2 > SF:0110203\r\nMime-Version:\x201\.0\r\nDate:\x20Wed,\x2030\x20Mar\x202011\ > SF:x2009:37:20\x20GMT\r\nContent-Type:\x20text/html\r\nContent-Length:\x20 > SF:3234\r\nX-Squid-Error:\x20ERR_INVALID_REQ\x200\r\nContent-Language:\x20 > SF:en\r\nX-Cache:\x20MISS\x20from\x20Streamride\r\nVia:\x201\.1\x20Streamr > SF:ide\x20\(squid/3\.2\.0\.4-20110203\)\r\nConnection:\x20close\r\n\r\n<!D > SF:OCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DTD\x20HTML\x204\.01//EN\"\x20\"h > SF:ttp://www\.w3\.org/TR/html4/strict\.dtd\">\n<html><head>\n<meta\x20http > SF:-equiv=\"Content-Type\"\x20content=\"text/html;\x20charset=utf-8\">\n<t > SF:itle>ERROR:\x20The\x20requested\x20URL\x20could\x20not\x20be\x20retriev > SF:ed</title>\n<style\x20type=\"text/css\"><!--\x20\n\x20/\*\n\x20Styleshe > SF:et\x20for\x20Squid\x20Error\x20pages\n\x20Adapted\x20from\x20design\x20 > SF:by\x20Free\x20CSS\x20Templates\n\x20http://www\.freecsstemplates\.org\n > SF:\x20Released\x20for\x20free\x20under\x20a\x20Creative\x20Commons\x20Att > SF:ribution\x202\.5\x20License\n\*/\n\n/\*\x20Page\x20basics\x20\*/\n\*\x2 > SF:0{\n\tfont-family:\x20verdana,\x20sans-serif;\n}\n\nhtml\x20body\x20{\n > SF:\tmargin:\x200;\n\tpadding:\x200;\n\tbackground:\x20#efefef;\n\tfont-si > SF:ze:\x2012px")%r(SSLSessionReq,DE3,"HTTP/1\.1\x20400\x20Bad\x20Request\r > SF:\nServer:\x20squid/3\.2\.0\.4-20110203\r\nMime-Version:\x201\.0\r\nDate > SF::\x20Wed,\x2030\x20Mar\x202011\x2009:37:20\x20GMT\r\nContent-Type:\x20t > SF:ext/html\r\nContent-Length:\x203240\r\nX-Squid-Error:\x20ERR_INVALID_RE > SF:Q\x200\r\nContent-Language:\x20en\r\nX-Cache:\x20MISS\x20from\x20Stream > SF:ride\r\nVia:\x201\.1\x20Streamride\x20\(squid/3\.2\.0\.4-20110203\)\r\n > SF:Connection:\x20close\r\n\r\n<!DOCTYPE\x20html\x20PUBLIC\x20\"-//W3C//DT > SF:D\x20HTML\x204\.01//EN\"\x20\"http://www\.w3\.org/TR/html4/strict\.dtd\ > SF:">\n<html><head>\n<meta\x20http-equiv=\"Content-Type\"\x20content=\"tex > SF:t/html;\x20charset=utf-8\">\n<title>ERROR:\x20The\x20requested\x20URL\x > SF:20could\x20not\x20be\x20retrieved</title>\n<style\x20type=\"text/css\"> > SF:<!--\x20\n\x20/\*\n\x20Stylesheet\x20for\x20Squid\x20Error\x20pages\n\x > SF:20Adapted\x20from\x20design\x20by\x20Free\x20CSS\x20Templates\n\x20http > SF:://www\.freecsstemplates\.org\n\x20Released\x20for\x20free\x20under\x20 > SF:a\x20Creative\x20Commons\x20Attribution\x202\.5\x20License\n\*/\n\n/\*\ > SF:x20Page\x20basics\x20\*/\n\*\x20{\n\tfont-family:\x20verdana,\x20sans-s > SF:erif;\n}\n\nhtml\x20body\x20{\n\tmargin:\x200;\n\tpadding:\x200;\n\tbac > SF:kground:\x20#efefef;\n\tfont-size:\x2012px"); > > Service detection performed. Please report any incorrect results at > http://insecure.org/nmap/submit/ . > Nmap finished: 1 IP address (1 host up) scanned in 114.226 seconds So it seems my ISP is running squid version 3.2.0.4-20110203 in transparent mode , just like you said. Interestingly when connecting to random ip addresses on port 80, the error page returned is quite different from normal ones. http://www.freeimagehosting.net/image.php?280f0ef980.png Does this transparent proxy pose any threat and what can I do to stop that ?

6 14

[arch-general] Port 80 is shown open in port scan without any web server running
by Partha Chowdhury 30 Mar '11

30 Mar '11

Hallo to everyone on the list. It is my first message in a while. I have recently changed my internet provider as i have moved. My previous provider was a DSL provider and the current one is the local cable operator.Now with current provider port 80 is shown open in every port scan test , all other ports being shown as stealth. But with the previous provider , every port scanned was shown as stealth. I am not running any web service . And the change in software being the one that is used to authenticate. Previously it was rp-pppoe now it is the GNU/Linux client of cyberoam software. Output from lsof: > sudo /bin/lsof -i > COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME > pdnsd 1207 nobody 4u IPv4 2434 TCP localhost:domain > (LISTEN) > pdnsd 1207 nobody 5u IPv4 2435 UDP localhost:domain > pdnsd 1207 nobody 8u IPv4 81232 UDP > 172.16.37.164:40131->AS-20144-has-not-REGISTERED-the-use-of-this-prefix:domain > linc 1214 root 5u IPv4 2448 UDP *:55089 > ntpd 1216 root 16u IPv4 2451 UDP *:ntp > ntpd 1216 root 17u IPv4 2455 UDP localhost:ntp > ntpd 1216 root 18u IPv4 2456 UDP 172.16.37.164:ntp > X 1377 root 1u IPv4 2964 TCP *:x11 (LISTEN) > gweather- 1538 partha 18u IPv4 78973 TCP > 172.16.37.164:53421->a125-56.222-11.deploy.akamaitechnologies.com:http > (CLOSE_WAIT) Iptables configuration: > sudo /sbin/iptables-save > # Generated by iptables-save v1.4.7 on Wed Mar 30 13:59:44 2011 > *filter > :INPUT DROP [2844:282816] > :FORWARD DROP [0:0] > :OUTPUT ACCEPT [9999:990098] > -A INPUT -i lo -j ACCEPT > -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT > -A INPUT -p tcp -m tcp --dport 54215 -j ACCEPT > -A INPUT -p udp -m udp --dport 54215 -j ACCEPT > COMMIT > # Completed on Wed Mar 30 13:59:44 2011 With my new provider, I have to provide a static ip 172.16.37.x to eth0 and then start the linc daemon to authenticate, after that i am allocated a public ip. Now my question is: why is port 80 open and does it indicate any security vulnerability ?

3 3

[arch-general] Wavpack support in Sox
by Kyle 30 Mar '11

30 Mar '11

Having recently migrated from Ubuntu, I notice that while Ubuntu's Sox package didn't support encoding to mp3, it did support Wavpack encoding and decoding, whereas in Arch, it supports mp3 encoding, but Wavpack seems to be unsupported. Am I missing an add-on that will make Sox support Wavpack, or do I need to rebuild the package with Wavpack support? ~Kyle

4 5

Re: [arch-general] Port 80 is shown open in port scan without any web server running
by Simon Perry 30 Mar '11

30 Mar '11

On Wed, 30 Mar 2011 14:06:48 +0530, Partha Chowdhury wrote: > Output from lsof: >> sudo /bin/lsof -i >> COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME >> pdnsd 1207 nobody 4u IPv4 2434 TCP localhost:domain >> (LISTEN) >> pdnsd 1207 nobody 5u IPv4 2435 UDP localhost:domain >> pdnsd 1207 nobody 8u IPv4 81232 UDP >> 172.16.37.164:40131->AS-20144-has-not-REGISTERED-the-use-of-this-prefix:domain >> linc 1214 root 5u IPv4 2448 UDP *:55089 >> ntpd 1216 root 16u IPv4 2451 UDP *:ntp >> ntpd 1216 root 17u IPv4 2455 UDP localhost:ntp >> ntpd 1216 root 18u IPv4 2456 UDP 172.16.37.164:ntp >> X 1377 root 1u IPv4 2964 TCP *:x11 (LISTEN) >> gweather- 1538 partha 18u IPv4 78973 TCP >> 172.16.37.164:53421->a125-56.222-11.deploy.akamaitechnologies.com:http >> (CLOSE_WAIT) I think you're confused. That's essentially a netstat, I can't see where you have 80 open on your IP of 172.16.37.164. It just shows you have a connection *to* port 80 to an Akamai host (a common provider of localised content used by many companies). -- Simon Perry (aka Pezz) [ s a n x i o n . n e t ]

2 3

[arch-general] inefficient handling of bug reports?
by Angus 30 Mar '11

30 Mar '11

When I file a bug report with the Flyspray web interface, why can't I specify the package it concerns? Having that option should make it possible for the package maintainers to be immediately and automatically notified of the report. The way it works now seems to be that I have to wait for some generic bug janitor to manually assign my report to the maintainer of the package (correct me if I'm mistaken). For example, I filed a bug report nearly two days ago, but apparently no janitor (or any other maintainer) has looked at it jet, which means all that time is wasted for hardly any reason (and no, I won't specify which bug. It's irrelevant to the issue I'm addressing here.) I believe the coders among us appreciate efficiency and automation, so maybe we can improve this system?

7 11

Re: [arch-general] Port 80 is shown open in port scan without any web server running
by Simon Perry 30 Mar '11

30 Mar '11

On Wed, 30 Mar 2011 16:18:47 +0530, Partha Chowdhury wrote: > initially I wanted to know why port 80 is shown open on my machine > and i gave the lsof output to show that no service was listening to > port 80 on my machine. The nmap output of the ip - that is my public > ip at the moment ( got that by visiting whatismyip.com) shows port 80 > as open when it should be blocked according to my iptables > configuration. > > Basically i was afraid some rootkit/malware was running web server on > my machine by making it invisible ! So your machine is 172.16.37.164, which you have to configure and tell your ISP because they NAT externally from 115.187.45.97 to many internal 172.16.37.* users? Therefore more than one person could have an external address of 115.187.45.97 mapping back to their 172.16.37.* IP? Even though only one person could have 115.187.45.97:80 mapped back to them? Are you sure about how this works? -- Simon Perry (aka Pezz) [ s a n x i o n . n e t ]

1 0

[arch-general] New Kernel - Virtualbox VM kernel crash on shutdown
by David C. Rankin 30 Mar '11

30 Mar '11

Guys, kernel26-2.6.37.5-1 running in a virtualbox vm is causing a kernel crash on shutdown. The full screen of the crash is here: http://www.3111skyline.com/dl/arch/bugs/kernel/vbox-crash-on-shutdown.jpg The Call Trace: shows the likes of: shrink_dcache_for_unmount_subtree shrink_dcache_for_unmount generic_shutdown_super <snip> I'm not great at reading the screens, so if you are interested in the full error, it is shown in the link about. Has anyone else found a workaround? -- David C. Rankin, J.D.,P.E.

6 8

Re: [arch-general] Removing network utilities from base group?
by Grigorios Bouzakis 29 Mar '11

29 Mar '11

Daniel Isenmann wrote: > Hi, > > I have a feature request (https://bugs.archlinux.org/task/22481) since > January which stated that rp-pppoe should be removed from the base > group. Described in the details he stated that every network package > should be removed from the base group and should only be in core. > > I'm not really have a opinion to that topic, so what do you think about > it? For me we can leave it as it is and do nothing at this topic, then I > will close this feature request as "won't implement". > > -Daniel > My own plan, originally brain0's but i adopted it and probably extended it as well, has been fully implementing https://bugs.archlinux.org/task/12890 Nevermind that its closed now, its only half done as far as i am concerned. Eventually make every package of core, besides the library dependencies, be part of a group, like base, base-networking etc. I dont know how much of a realistic plan it still is today, but i intend to look at it at some point. And that was part of the reason i opened those feature requests (theres similar ones for ppp, wpa_supplicant and dash as well). The core repo keeps growing and growing. Bootloaders, file system support utilities, dependencies like libedit get added. Yet the installer has only 1 package selection dialogue with all the applications. That works fine for packages in base and base-devel which are tagged as such, but not so much for the other packages which dont belong in a group, and especially libraries which are nothing more than dependencies to other packages. The installer has changed lately and from what i've read it includes the description of the packages.I had opened https://bugs.archlinux.org/task/12942 at the time about adding a seperate selection dialogue for each group, but i havent seen the new installer in action so i dont know if any of the above still apply, but that was my initial motivation from what i can remember. ---- Greg

1 0

Re: [arch-general] [arch-releng] Partition tools in AIF (was: Default Bootloader for AIF)
by KESHAV P.R. 29 Mar '11

29 Mar '11

On Tue, Mar 29, 2011 at 15:07, David Campbell <davekong(a)archlinux.us> wrote: > Excerpts from Dieter Plaetinck's message of 2011-03-28 12:06:21 -0400: >> Hmm, and does it have a proper UI in ncurses or something? to replace >> cfdisk in aif? > > It will when cparted is proper. Whether cparted will be ported to > use libparted directly, rather than using Python bindings, is yet > to be seen. I certainly prefer writing/maintaining Python code > over C though, and I don't see any benefit to translating it into > C other than avoiding Python as a dependency. > Instead of duplicating efforts, you can try hacking on http://www.gnu.org/software/fdisk/ which uses libparted as backend (fdisk and cfdisk present but no sfdisk though). That project is inactive but not discontinued. >> I know about the newt-based nparted but I'm told it's badly maintained. > > As far as I could tell, nparted is dead. > -- > David Campbell > Regards. Keshav

1 0

[arch-general] [signoff] kernel26-2.6.38.1-1
by Tobias Powalowski 28 Mar '11

28 Mar '11

Hi guys, please signoff 2.6.38 series for both arches. It's a security update too so it would make sense, to move in .38.1 to [core] soon. Upstream changes: http://kernelnewbies.org/LinuxChanges Features included: - latest stable patches - disabled /dev/kmem - added AMD_IOMMU support - kernel image is now xz compressed - NUMA is enabled on x86_64 - AUTOSCHED (aka the wonder patch) is enabled - aufs2.1 latest snapshot - added additional i915 patch - added radeaon kms fix greetings tpowa -- Tobias Powalowski Archlinux Developer & Package Maintainer (tpowa) http://www.archlinux.org tpowa(a)archlinux.org

4 3