July 2001 - openSUSE Security - openSUSE Mailing Lists

firewall on CD
by kaldewey frank 30 Jul '01

30 Jul '01

Hallo :) I read about the new produkt suse firewall on CD. Has somebody informations about it . Anyway to try it before buying it . Thank you Frank

3 2

Re: [suse-security] ip_conntrack_ftp
by Stefan_Walther＠gehag-dsk.de 30 Jul '01

30 Jul '01

Hi, maybe you should not use the SuSE-kernel. Download one of the 2.4.x from www.kernel.org. These kernel works better in some cases and you can apply patches to the kernel. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hai @ all, what's about the ip_conntrack_ftp BUG in iptables?? The Patch at netfilter.samba.org dosn't work witch 2.4.4 SuSE Kernel (SuSE 7.2)! How can i secure my Linux - Box against this attack?? friendly regards from germany Andreas Wahlert

1 0

RE: [suse-security] best method to block ip block
by Reckhard, Tobias 30 Jul '01

30 Jul '01

> The ip > block I want to filter is as follows > > xxx.156.130.1 to xxx.156.191.255 > You know, this is typical TCP/IP networking course homework stuff you should be doing yourself, but let's see what we can do. x.156.130.1 ... x.156.191.255 1st netblock: x.156.130.0/23 = x.156.130.0...x.156.131.255 2nd netblock: x.156.132.0/22 = x.156.132.0...x.156.135.255 3rd netblock: x.156.136.0/21 = x.156.136.0...x.156.143.255 4th netblock: x.156.144.0/20 = x.156.144.0...x.156.159.255 5th netblock: x.156.160.0/19 = x.156.160.0...x.156.191.255 This is the shortest way to describe the IP range you mean. Note that the IP address x.156.130.0 is in the first netblock, though you said to start at .1. I assumed that was a slipup on your behalf. If not, you'll need another eight definitions. Or, which is probably more practical, use a permit rule for that single IP address to precede all deny/reject rules for the subnets above. Tobias

1 0

RE: [suse-security] Forwarding NFS connection
by Reckhard, Tobias 30 Jul '01

30 Jul '01

> I want to access a nfs-filer (SuSE 7.2, kernel nfs) with an internal IP > (172.x.x.x) through a firewall using ipchains and having a connection to > the > internet. > Just for the sake of completeness, large portions of the IP space beginning with 172 aren't part of the private address space. Only 172.16/12 is private. > Is it possible to forward/masq the nfs connection with ipchains and what > are > the necessary rules? > Well, NFS is an RPC service, so you need to allow connections to the portmapper (UDP 111, IIRC) as well as to the port used by NFS. Normally and AFAIK, RPCs can't be port forwarded to practically, as they use dynamic ports. NFS is something of an exception, since most NFS server implementations attempt to use UDP port 2049. A better way to provide RPCs is to proxy them on a gateway machine. For NFS, you can have the gateway be NFS server to the client on the outside and be a client to the actual NFS server on the inside. No IP translation necessary.. You should also note that NFS and any other RPC-based services should just about never be served to the Internet! They rank right next to the family of Berkeley r protocols on the top of the list of protocols *not* to be passed by an Internet firewall.. You have been warned. Tobias

1 0

Re: [suse-security] best method to block ip block
by Togan Muftuoglu 29 Jul '01

29 Jul '01

* Martin Leweling; <lewelin(a)uni-muenster.de> on 29 Jul, 2001 wrote: > Hi Togan, > > > block I want to filter is as follows > > > > xxx.156.130.1 to xxx.156.191.255 > > I'm not quite sure if I really understand your problem, since your > firewall is already blocking this kind of access. But to explicitly The firewall is DENY'ing these request's which AFAIU is also generating traffic. Hence I thought maybe a better way exists > > Then apply these three rules: > /sbin/ipchains -A input -s xxx.156.128.0/18 -d 0.0.0.0./0 -i eth0 -j ipblock > ... proceed with normal input chain ... ? if the starting IP adress is xxx.156.130.1 why I define it as xxx.156.128.0/18 > > /sbin/ipchains -A ipblock -s xxx.156.128.0/23 -d 0.0.0.0./0 -i eth0 -j RETURN ^^^^^^^ why /23 > /sbin/ipchains -A ipblock -s xxx.156.128.0/18 -d 0.0.0.0./0 -i eth0 -l -j DENY > What I had in mind (which I was not sure) having a rejecting route for the IP block -- Togan Muftuoglu

1 0

Local login broken, help!
by Dave Emory 29 Jul '01

29 Jul '01

I need some guidance to fix a self inflicted problem here. I'm using SuSE 6.1 on a machine that is my firewall between the adsl modem and LAN. It has the 2.2.14 kernel update, but no lx_suse for that kernel. While trying to update or install enough packages to be able to compile a new kernel, I somehow broke login from the local console (tty). I can, however log in using ssh from other machines on the LAN. When I try to login on the local console, I get the message "Login incorrect". Any insites? Regards, Dave Emory

2 1

Re: [suse-security] from where can I get info. about SuSE personal firewall ? and from where get the latest version ?
by michael.ryan＠storm.ie 28 Jul '01

28 Jul '01

You'll find most of what you need at http://www.suse.de/~marc/SuSE.html Michael "Eduardo J.Vega To: suse-security(a)suse.com Arguedas" cc: <evega@amnet. Subject: [suse-security] from where can I get info. about SuSE co.cr> personal firewall ? and from where get the latest version ? 07/28/2001 05:36 PM Hi guys... spoking of Firewalls & Suse from which was the URL to download the Latest version of SuSE Firewall ? and also from where can I as much as documentation as possible about of how to install, configure and manage it ? thanks bye --ed -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Re: Firewall confusion
by John Bland 28 Jul '01

28 Jul '01

On Sat, 28 Jul 2001 listuser(a)vomit.seifried.org wrote: > > > Isn't there *any* HOWTO on doing this? Invisible firewalling like this > > > seems, on the face of it, a neat and simple drop in to an existing > > > network, but the routing is a nightmare. > > Bridging is one way, but requires a third adaptor to do remote management. Lennert's bridging code allows for the bridge itself to be assigned an ip. So a two NIC bridge can bridge, firewall and be remote managed. It does the job for us and is reasonably simple to understand and use. JB -- John Bland M.Phys (Hons) AMInstP / \ PhD Student & Sys Admin Email: j.bland at cmp.liv.ac.uk / \ Condensed Matter Group http://ringtail.cmp.liv.ac.uk/ / \ Liverpool University "Everybody relax, I'm here." -- Jack Burton

2 1

Repeated input into port 25?
by Stefan Hoffmeister 28 Jul '01

28 Jul '01

Hi, why would anyone want to continue to talk to a non-existing SMTP server on a dynamic IP (/var/log/firewall log excerpt below)? I figure that the other side had some kind of ... hiccup? Similarly, why would someone want to literally keep spamming port 6346 (GNUtella?) for almost two hours considering that there is exactly nothing that will reply? TIA, Stefan ********************************** Jul 27 15:18:12 yyyyyyy kernel: Packet log: input DENY ppp0 PROTO=6 131.177.130.21:44026 xxxxxxxxxxxxx:25 L=44 S=0x00 I=20565 F=0x4000 T=238 SYN (#102) [heaps and loads of the same killed - every 20 to 60 seconds] Jul 27 19:03:03 yyyyyyy kernel: Packet log: input DENY ppp0 PROTO=6 131.177.130.21:49032 xxxxxxxxxxxxx:25 L=44 S=0x00 I=12709 F=0x4000 T=238 SYN (#102) ********************************** Jul 27 02:37:25 yyyyyyy kernel: Packet log: input DENY ppp0 PROTO=6 24.0.37.182:3687 xxxxxxxxxxxxx:6346 L=48 S=0x00 I=46490 F=0x4000 T=104 SYN (#102) [heaps and loads of the same killed] Jul 27 04:10:26 yyyyyyy kernel: Packet log: input DENY ppp0 PROTO=6 24.0.37.182:4501 xxxxxxxxxxxxx:6346 L=48 S=0x00 I=23957 F=0x4000 T=104 SYN (#102)

2 2

SuSEfirewall and IGMP filtering
by Eric Swenson 28 Jul '01

28 Jul '01

I'm running SuSE 7.2 on a machine with a single ethernet interface to my LAN where I have a DSL Router (Cayman 3220-H) providing access to the internet. I wish to protect this machine from internet-based attacks while allowing inbound http and smtp access. I believe I have things configured properly enough, but I've been unable to filter all the IGMP traffic and wonder what it means, whether I should care, and if I shouldn't, how to get rid of the log messages. They are of the form: input DENY eth0 PROTO=2 aaa.bbb.ccc.ddd:65535 239.255.255.250:65535 input DENY eth0 PROTO=2 aaa.bbb.ccc.eee:65535 224.0.0.1:65535 The traffic in the first case comes from one of the Windows machines on my LAN. The traffic in the second case comes from the DSL Router. What do these mean? Is this traffic harmless, and if so, how do I prevent logging of this traffic? Thanks much. -- Eric

2 1