September 2000 - openSUSE Security - openSUSE Mailing Lists

RAS
by sobek 01 Oct '00

01 Oct '00

Hi Liste, könnt ihr mir helfen? Ich brauch einen RAS für Linux. D.h. mein Chef will sich direkt ins Modem einwählen um Zugriff aufs LAN zu haben. Gibt es da vieleicht ein fertiges Tool für? Wenn ja: kann man eine Firewall auf auf dem gleichen Rechner laufen lassen ider besser auf einem anderen? mfg Paul

7 7

hosts.deny
by Matthias Krawen 30 Sep '00

30 Sep '00

Hi ! I start my pop-server popper over the inetd with the tcpwrapper and want to deny every connection except the local network. I know about all the other possibilities but now I want to know how exactly the wrapper works. I wanted tested it by denying everything; I tried following in hosts.deny; pop2: ALL pop3: ALL popper: ALL pop2: ALL: DENY pop3: ALL: DENY and so on. but nothing seems to work. I still can connect to popper. I wrap the connection definitly through the tcpd. Syntaxerrors in hosts.deny are mentioned in the syslog if there are some and a pop-connections comes in. I deleted hosts.allow. No file in ~ that could overwrite hosts.deny. Why is the connections accepted ? Thx. Matthias Compositiv EDV- und Kommunikationslösungen, PC-Service Matthias Krawen Peiffersweg 9 22307 Hamburg Tel: 040 / 611 673 - 40 EMail: info(a)compositiv.de Fax: 040 / 611 673 - 41 http://www.compositiv.de

2 1

Re: [suse-security] nmap TCP sequence prediction
by bacano＠esoterica.pt 30 Sep '00

30 Sep '00

For protect your system you just do not need nmap. And yes, it is very good oriented for people who scan other people (for example, a network administrator, a security auditor, etc). People only interested in securing their own system, in the case SuSe, witch is what we talk about here, have lots of things to do with the apps provided on the distribution. If not enouh get a system scanner, not a remote vulnerabilities scanner. [ ]'s bacano > I've read that article. It seems primarily oriented towards people > who spend their time scanning other people to detect and exploit > vulnerabilities, not people who are mainly interested in securing > their own systems, so I didn't find it useful. The manpage is pretty > much laconic on this topic. > > > On Tue, Sep 19, 2000 at 05:54:10PM +0000, bacano(a)esoterica.pt wrote: > > > Subject: Re: [suse-security] nmap TCP sequence prediction > > > > http://www.insecure.org/nmap/nmap-fingerprinting-article.html > > http://www.insecure.org/nmap/nmap_manpage.html > > > > I hope you find your answers in one of those two links. > > Don't worry about my esoteric e-mail address, got nothing to do with > > your words ... anyway, i can only read hands, i have an Egiptian > > Tarot, and with luck, in the "cup game" you can be talking to the > > gost of the last Xmas ... but this is *completly* out of topic here > > =;o) > > > > But a note on the esoteric issue, i really hope that vulnerabilities > > got even more and more esoteric for home users, because it is just > > like on esoterism, better dont 'call' for just 'somebody out there' > > because you just dont know who will knocking at your door ... can be > > very bad karma, or even worse, the cops eheh > > > > [ ]'s bacano > > > > > > --------------------------------------------- > > Esta mensagem foi enviada usando o WebPOP II. > > http://www.via-net-works.pt/email > > > > > > > > ------------------------------------------------------------------ --- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > -- > Corvin Russell <corvinr(a)sympatico.ca> > --------------------------------------------- Esta mensagem foi enviada usando o WebPOP II. http://www.via-net-works.pt/email

4 4

IP Spoof Protection
by Steven Thompson 30 Sep '00

30 Sep '00

Hi how well does "Source Address Verification" work by making the following setting. echo 1 > /proc/sys/net/ipv4/conf/*/rp_filter What does the rp_filter do & how does it work. Can it cause any problems with your IPCHAINS rules? Thanks in advance Steven

4 4

scan to service 161
by Togan Muftuoglu 30 Sep '00

30 Sep '00

Hi everyone, I am getting scans to port 161/tcp from the scanners port 1234 . I checked the etc/services file port 1234 is search agent for Infoseek and 161 is snmp. First of all what is snmp is there antyhing they can do from that port and finally what can I do to improve my pc. curently I have Suse firewall running and portsentry is up with audp and atcp flags Thanks in adnvace Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

4 5

FW: Running Postfix on a firewall
by Steven Thompson 29 Sep '00

29 Sep '00

-----Original Message----- From: Chip Christian [mailto:chip@princetonecom.com] Sent: 29 September 2000 06:18 To: Steven Thompson Cc: PostFix Users Mailing List (E-mail) Subject: Re: Running Postfix on a firewall does it still say that? Wietse pointed out many months ago that he should've said relay_domains = $myhostname, localhost.$mydomain, $mydomain mydestination = steven(a)bidorbuy.co.za said: > If I understand this correctly you should do the following please > correct me if I'm wrong. > /etc/postfix/main.cf: > mydestination = $myhostname, localhost.$mydomain, $mydomain, > relay_domains = > transport_maps = hash:/etc/postfix/transport

1 0

Running Postfix on a firewall
by Steven Thompson 29 Sep '00

29 Sep '00

Hi I'm trying to set-up Postfix on my firewall, as recommended by Postfix. http://www.postfix.org/faq.html#firewall This is my configuration that works. /etc/postfix/main.cf relay_domains = $mydomain mydestination = $myhostname, localhost.$mydomain, transport_maps = hash:/etc/postfix/transport relayhost = [192.168.1.3] This is what they recomend <Quote> Specify a null relay_domains parameter plus a transport table to route mail for my.domain to the inside machine: /etc/postfix/main.cf: mydestination = $myhostname, my.domain, localhost.my.domain relay_domains = transport_maps = hash:/etc/postfix/transport /etc/postfix/transport: my.domain smtp:inside-gateway.my.domain (forwards user@domain) .my.domain smtp:inside-gateway.my.domain (forwards user@firewall) /etc/postfix/master.cf: Comment out the local delivery agent </Quote> If I understand this correctly you should do the following please correct me if I'm wrong. /etc/postfix/main.cf: mydestination = $myhostname, localhost.$mydomain, $mydomain, relay_domains = transport_maps = hash:/etc/postfix/transport /etc/postfix/transport: $mydomain smtp:[192.168.1.3] .$mydomain smtp:[192.168.1.3] /etc/postfix/master.cf: #local But when I set this up it does not seem to work. All tips wellcome. Thanks in Advance Steven

2 1

Re: [suse-security] Masquerade & Firewall Problem
by j b 29 Sep '00

29 Sep '00

Thanks. I am using SuSE 6.3, and masquerading gives the appearance of running. I set the policy to accept all and now I can ping. But now all http requests return with: Netscape connection refused by server. I am using Yast, how do you set up the kernel any differently? --- Peter Wiersig <wiersig(a)glamus.de> wrote: > Hi Anonymous, > > > A ping causes wvdial.dod to call the ISP, packets pass to and from > the > > ISP, but I get 100% packet loss. > > Is your kernel setup complete enough for ICMP Masquerading ? > > Peter > ---------- > CONFIG_IP_MASQUERADE_ICMP: > > The basic masquerade code described for "IP: masquerading" above > only handles TCP or UDP packets (and ICMP errors for existing > connections). This option adds additional support for masquerading > ICMP packets, such as ping or the probes used by the Windows 95 > tracert program. > > If you want this, say Y. > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/

1 0

Unknown pakets
by Bernhard Stegmaier 29 Sep '00

29 Sep '00

Hi! In our lab a firewall (SuSE 6.4) is connected to our subnet to test it. The name or IP-Address of the firewall is not known to any DNS. Nevertheless since about 2 weeks I get the following log of ipchains (a.b.c.d is IP-Adress of our firewall): Sep 27 16:26:39 fw kernel: Packet log: input DENY eth2 PROTO=1 207.88.240.105:3 a.b.c.d:1 L=56 S=0x00 I=0 F=0x0000 T=241 (#22) Sep 27 18:57:57 fw kernel: Packet log: input DENY eth2 PROTO=1 207.88.240.105:3 a.b.c.d:1 L=56 S=0x00 I=0 F=0x0000 T=239 (#22) Sep 28 00:05:10 fw kernel: Packet log: input DENY eth2 PROTO=1 209.249.0.17:11 a.b.c.d:0 L=56 S=0x00 I=0 F=0x0000 T=240 (#22) Sep 28 13:54:07 fw kernel: Packet log: input DENY eth2 PROTO=1 207.88.240.105:3 a.b.c.d:1 L=56 S=0x00 I=0 F=0x0000 T=239 (#22) Those pakets arrive about 2 times a day. Is this anything I have to worry about? Thanks in advance, Bernhard -------------------------------------------------------------------------- Bernhard Stegmaier Lehrstuhl für Dialogorientierte Systeme Tel. +49 851 509-3064/Fax -3062 Universität Passau, FMI Zimmer 208 stegmaie(a)db.fmi.uni-passau.de http://www.db.fmi.uni-passau.de/~stegmaie

2 1

Masquerade & Firewall Problem
by j b 29 Sep '00

29 Sep '00

I am trying to get masquerading to work without success. I have packets going out and returning, but ping gives 100% packet loss. Does anyone know what what could cause this or how to test the various settings? ping to the modem p-t-p side fails. It is a basic firewall to get started. No error messages during startup. __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/

3 2