January 2000 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Firewall Speed
by Stephan Gerling 10 Jan '00

10 Jan '00

Hi Rupert Koenig, if you have an 1/2 ISDN-Channel (1 B-Channel of 64 kbit/s), it is enough to use an 386DX40 an paketfilter firewall with ipchains. see also at http://www.little-idiot.de/firewall/zusammen-129.html I use a 486DX33 with 16 MB and a teles isdn card (under linux no problem) and the speed is enough the link abouve is an good howto in german to setup a firewall MFG Stephan -----Ursprüngliche Nachricht----- Von: Rupert Koenig [SMTP:lax@gmx.li] Gesendet am: Donnerstag, 6. Januar 2000 21:43 An: Roman Drahtmueller Cc: suse-security(a)suse.com Betreff: Re: [suse-security] Firewall Speed Hi it seems to me that you know very well about the through-put dependend on the used cpu. could you tell me if it makes sense to install an 386DX40 as packetfilter with kernel 2.2 for 1/2 ISDN-channels? my problem is that i'm playing too much quake ;) means, that pings growing only 10ms are not acceptable for me... thx, Rupert --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

SuSEfirewall new beta available
by marc＠suse.de 09 Jan '00

09 Jan '00

Hi, for all betatesters out there who use v1.5 or v1.6 of the SuSEfirewall package, there's v1.7 available which has an important bugfix. v0.4 from SuSEauditdisk should be available on the website as well within a few hours. v0.6 of SuSEcompartment is online already. CHANGES for v1.7 of SuSEfirewall: v1.7 09.01.00 (beta version) * Added -n to the lsof call to save time (thanks for reporting) * When SuSEfirewall could not start (e.g. interfaces not active) it would leave the system in an unusable way to communicate to any network unless successfully started. Affects v1.5 and v1.6 only. * Successful (un-)loading of SuSEfirewall is now logged to syslog. * New option FW_STOP_KEEP_ROUTING_STATE available in /etc/rc.firewall to keep routing enabled when stopping the firewall. This is only for diald or autodialing ISDN stuff and should *not* be used normally! http://www.suse.de/~marc Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

Application Firewall.
by Stephan Gerling 07 Jan '00

07 Jan '00

Hi subscribers I have a few questions. I want to setup an Application Firewall with SuSE 6.3 IPChains is an Paketfilter Firewall Tool and it works great. Now i want to setup an Maschine that improves Security on Application Level. Microsoft Proxy is an Application Level Firewall with Paketfilter, but i dont want to use it. I think it is not so secure as Linux Maschines does. Does Squid improves Security on Application Level ??? Is the SuSE Proxy Suite it too ???? What is about NNTP, SMTP, Netmeeting, Telnet.... Are there Proxy´s too ???? What´s about Virus/Trojan or ActiveX and Script Scanning on an Firewall Gateway under Linux. Are there any tools avaible for free or only commercial Produkts ??? I think thats enough for the first time. Have a nice Weekend. Bye Stephan

1 0

Firewall Speed
by Stephan Gerling 07 Jan '00

07 Jan '00

Hi everyone Happy new Year to all. I have some questions. I want to use an 486 DX 33 with 32 MB Ram as an Paketfilter Firewall with IPChains on a SuSE 6.3 System in an 100 MBit Lan enviroment to connect 2 Networks. Is the Maschine Speed fast enough to do the Job (Down or Upload with the full 100 MBit/s ) ????? Or shall i use an Pentium ???? For an ISDN Router with IPChains is it fast enough to use the full 64 KBit/s. I use it at home. Does anyone known about an free application Firewall for HTTP, FTP, DNS , ....??? Is the Squid an application Firewall ???? I think not !!!!! MFG Stephan Gerling gerling(a)kub.de

5 4

Re: [suse-security] Firewall Speed
by Roman Drahtmueller 06 Jan '00

06 Jan '00

> > What would the performance be on a dual 200 Mhz pentium? You can get those > Pentium 200 for about $30 a peice if I remeber correctly. A dual socket 7 > motherboard would be the hard thing to find, any ideas? > > Jack Hard to say. According to the last mail, I _guess_ that tcp throughput using two nic (one in, one out) ranges between 25-55 MBit/s, depending on how long the firewall ruleset is, provided that all other constraints are minimized/eliminated. I've removed a graphics card to increase network performance quite a while ago. I remember it helped a little... Roman. -- _ _ | Roman Drahtmüller "Freedom means that you can choose | CC University of Freiburg what you want to learn at a given | email: draht(a)uni-freiburg.de time." A. Becker, 1999 | - - People often find it easier to be a result of the past than a cause of the future.

1 0

Re: [suse-security] icmp flood
by Mark Ruth 06 Jan '00

06 Jan '00

On Tue, 04 Jan 2000, you wrote: > Jan 4 11:31:28 hb icmplog: ping from p3E9E066E.dip.t-dialin.net > Jan 4 11:31:59 hb last message repeated 31 times > Jan 4 11:33:00 hb last message repeated 60 times > Jan 4 11:33:49 hb last message repeated 48 times > > how can I block icmp pings of a special host and how can I block any > incoming ping ? > Greetings on Y2k, You need a kernel compiled with firewall options. On 2.2x you use the ipchains command to apply a rule to the kernel. Create a chain called 'icmp' where the icmp-filter options are. ipchains -N icmp /* ipchains -A icmp -s p3E9E066E.dip.t-dialin.net -d 0/0 -p icmp -j DENY */ ipchains -A icmp -s 0/0 -d 0/0 -p icmp -j DENY // blockz all Block all incoming icmp traffic on device ppp0. ipchains -A input -s 0/0 -d 0/0 -p icmp -i ppp0 -j icmp OR YOU SIMPLE, echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all > Thanks in advance, > Nick For a nice gui look at gfcc. http://ww.freashmeat.net; search gfcc. OR http://icarus.autostock.co.kr/ -- Mark Ruth Unix Systems Administrator New York, NY, USA Mark.Ruth(a)gmx.net

1 0

icmp flood
by N. Aust 06 Jan '00

06 Jan '00

Jan 4 11:31:28 hb icmplog: ping from p3E9E066E.dip.t-dialin.net Jan 4 11:31:59 hb last message repeated 31 times Jan 4 11:33:00 hb last message repeated 60 times Jan 4 11:33:49 hb last message repeated 48 times how can I block icmp pings of a special host and how can I block any incoming ping ? Thanks in advance, Nick

4 3

Re: [suse-security] SuSE 6.2 / Error in firewall-script?
by Mark Ruth 06 Jan '00

06 Jan '00

On Sun, 02 Jan 2000, you wrote: > Hi, > > after the chain "user_fw" is set up within the script > /sbin/init.d/firewall there is one line I can't understand: > > $IPCHAINS -A user_fw -s 0/0 -d 0/0 $ACC_FLAG -j ACCEPT > > Doesen't this line mean I accept everything from any source and forward > it to any destination? Greetings, You accept from every source to every destination. The total traffic is accepted. Exept the forward chains is declared like this: $IPCHAINS -A forward -s 0/0 -d 0/0 -j user_fw then it is allowed to forward all traffic. > Does this rule make sense? Why should I accept everything after just > having granted access to only some special hosts/ports? no, it is only script that doesn't allow you to do anything you want. > > Is there a security hole? no > > Thanks for you help > > Fabian -- Mark Ruth Unix Systems Administrator New York, NY, USA Mark.Ruth(a)gmx.net

1 0

[suse-security] [Fwd: [suse-security] majordomo vulnerability]
by Mark Ruth 06 Jan '00

06 Jan '00

On Sun, 02 Jan 2000, you wrote:> Hi Torsten, > > > can you say (or point to an URL), what these vulnerabilities are? > > Getting root-rights as a normal user? > > Or just abusing majordomo, getting around moderation etc.? Bugs in resend aside, this appears to be an incorrect configuration of wrapper. majordomo should have it's own group as well as user, and it should change to that group, not daemon. This is according to Doc/FAQ in the Majordomo 1.94.4 distribution. It would be important to note that on POSIX systems, the wrapper is compiled to setuid() to the majordomo user, so this won't give a root shell... #ifdef POSIX_UID setuid(POSIX_UID); #else setuid(geteuid()); #endif -- Mark Ruth Unix Systems Administrator New York, NY, USA Mark.Ruth(a)gmx.net

1 0

Re: [suse-security] Firewall
by Markus Gaugusch 05 Jan '00

05 Jan '00

maybe you should enable masquerading in rc.config and do ipchains -A forward -s 192.168.0.0/24 -d 0.0.0.0/0 -j MASQ als wrote: > > Hi, > > I have suse 6.3 and i tried to istall firewall without success!! > After start of Linux and firewall ( there is n't an error message) > i use a shell script to conrol the traffc, ( ipcahins, for example > ipchains -A output -j ACCEPT -i eth0 -s $INTRANET). With this > command i mus have a access in internet, but it dos not work. > To better understand my problem i send you "re.firewall". > I don't know can you or will you help me or not, anyway > i thank you for help. > > best regards > > Als -- ________________________________________ Markus Gaugusch markus(a)gaugusch.dhs.org ICQ-ID: 11374583 [www.mirabilis.com]

1 0