August 2001 - openSUSE Security - openSUSE Mailing Lists

UDP and "-m state --state xxx"? (Re: [suse-security] Looking for a secure time service)
by Ralph Seichter 30 Aug '01

30 Aug '01

Andreas Baetz wrote: > iptables -t filter -A INPUT -i <your interface> > -m state -p udp [...] --state ESTABLISHED There, you got me confused. I'm a freshman in the firewall arena, and although I can understand that "-m state --state xxx" makes sense with TCP (which opens and closes _directed_ connections actively), I don't know if and how this makes sense with UDP. If I'm not mistaken, UDP is undirected and has no notion of "NEW" or "ESTABLISHED", or has it? Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

2 1

Re: [suse-security] FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 30 Aug '01

30 Aug '01

Hi folks, THX for replying so fast. I will try your announces at the weekand. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

Re: [suse-security] FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 30 Aug '01

30 Aug '01

no firewall is installed. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi Stefan, On 2001.08.29 06:32:40 +0100 Stefan_Walther(a)gehag-dsk.de wrote: > hi folks, > > I have the following problem. I have an established IPSec-tunnel between > 2 > boxes. > > I'm using SuSE7.1 and FreeS/WAN 1.91. The FreeS/WAN tells me that the > tunnel is established (last message in /var/log/messages). > <SNIP> > Before starting IPSec the routes, the the clients can pinging each other > are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. > > After starting you cannot ping anymore from the 1st client to the 2nd > client ans the other way around. Does anybody know a solution for this > problem??? > Not withstanding everything that has already been said about strange routing etc, there was a similar problem to this on the list a couple of weeks ago. The problem was the ipsec0 interface was being blocked by the firewall at one end of the tunnel. If you have a firewall, make sure that packets can actually get to the tunnel. HTH, Maf. > THX > > MfG. > > Stefan Walther > stefan_walther(a)gehag-dsk.de > dienst.: +4930/89786448 > Funk: +49172/3943961 -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

RE: [suse-security] Looking for a secure time service
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> I'd like to run a time service like 'xntp' on my firewall machine (Kernel > 2.4 w/ iptables, no DMZ) which should be able to > > a) connect to public Internet time servers (obviously), > b) do so with a minimum security impact, and > c) send NTP broadcasts to my internal network. > > Looking at b), is NTP a wise protocol to use? Are there more secure > protocols? If you have some setup tips or sample 'iptables' scripts to > share, that'd be fine. And if there's a FAQ for this which I missed, > kindly point me to it. Thank you! > NTP can be configured to be pretty secure. As Kurt already noted, UDP is easy to spoof, but NTP time packets (responses) have to arrive in a pretty small time window not to be discarded by the data grooming algorithm. You should synchronise to several sources to allow the NTP daemon to identify falsetickers. Someone intent on muddling your time would have to impersonate several of the servers you query in order for an attack to succeed. More danger probably lies in a corruption of the daemon itself. It runs as root and a rather nasty buffer overflow (I believe) was discovered rather recently. Looking into the CHANGES files of the 4.0.99m-rc1 release, the authors seem to be making an attempt at cleaning out buffer overflow susceptible code. The other problem is that you can establish control connections to an NTP daemon using the same interface as the programs ntpq and ntpdc from the NTP distro. You should definitely use the access control options of NTP to not allow those from the Internet and from the inside only after successful authentication. More recent versions of the distribution allow you to use public key authentication for NTP time datagrams, but I don't know of any RPM (except my own) that has it compiled in. Tobias

2 1

SuSEfirewall2 v1.7
by marc＠suse.de 29 Aug '01

29 Aug '01

Hi folks, SuSEfirewall2 v1.7 is available now from www.suse.de/~marc/suse v1.7 28.08.01 GAMMA * The INSTALL tool did not install the EXAMPLES file, fixed. (thanks to ingo.kley(a)web.de) * Fixed a bug in FW_FORWARD_MASQ when target ports were ranges. (thanks to Rene(a)Hoppe-Online.de and christos(a)teacat.net) * Fixed some bugs in the documentation. * When stopping SuSEfirewall2, all modules are now removed. also SuSEfirewall was updated to v5.0 with only minor, minor fixes. Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

2 1

in.telnetd for 7.0
by Roman Drahtmueller 29 Aug '01

29 Aug '01

Hi, this is a test mail for our lists server - it looks like there are some problems with approving mails sent to the lists. In order for this mail not to be completely useless, it also carries the information that the in.telnetd update packages for the 7.0 distributions are available on the ftp.suse.com shortly (transferring right now). Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

RE: [suse-security] Looking for a secure time service
by Ralph Seichter 29 Aug '01

29 Aug '01

Tobias Reckhard wrote: > If the K9 client uses the same mode of operation, then it will indeed > query the NTP daemon on the firewall in burst mode when it starts. I don't think it does. If you care to take a look, I'll send you the K9 source code which is available in the distribution archive. Looks like K9 "only" listens for broadcasts and does nothing more. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

sasl + postfix
by Peter Nixon 29 Aug '01

29 Aug '01

Hi guys I am trying to get postfix + sasl working on SuSE 7.2 I have read /usr/share/doc/packages/postfix/SASL_README I have searched google, I have read postfix.org, and http://asg.web.cmu.edu/sasl/ and I STILL cand get sasl working :-( The error I get in /var/log/mail is: postfix/smtpd[20004]: fatal: no SASL authentication mechanisms postfix/master[28824]: warning: process /usr/lib/postfix/smtpd pid 20004 exit status 1 postfix/master[28824]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling As far as I know I have followed the instructions to the letter (not that they are very detailed). Note: I am NOT running postfix in chroot jail, as the docs said it would be very difficult to do this. As soon as I get this working I will be adding the instructions to http://www.susesecurity.com/faq/ -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

RE: [suse-security] Looking for a secure time service
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> I was thinking of using K9 (see http://www.kaska.demon.co.uk/k9.htm) on > the client side. It is available for Windows and Linux, small, easy to > install and listens to NTP broadcasts. Therefore, I see no need to allow > access the firewall's "xntp" even from my trusted network, as the firewall > will provide the NTP broadcasts. Or is there any security issue regarding > NTP broadcasts which I missed? > Well, this is from the 'Association Management' page of ntp.org: http://www.eecis.udel.edu/~ntp/ntp_spool/html/assoc.htm ------------ begin quote ----------------------- Broadcast Mode Broadcast mode is intended for configurations involving one or a few servers and a possibly very large client population. A broadcast server is configured using the broadcast command and a local subnet address. A broadcast client is configured using the broadcastclient command, in which case it responds to broadcast messages received on any interface. Since an intruder can impersonate a broadcast server and inject false time values, this mode should always be cryptographically validated. The original NTPv3 authentication scheme is applicable in this mode, as well as the new NTPv4 Autokey proventication scheme. The server generates broadcast messages continuously at intervals specified by the minpoll keyword and with a time-to-live span specified by the ttl keyword. A NTPv4 broadcast client responds to the first proventicated message received by waiting an interval randomized over the minpoll interval, in order to avoid implosion at the server. Then, the client polls the server in burst mode in order to reliably set the host clock and validate the source. This normally results in a volley of eight client/server cycles over a 30-s interval during which both the synchronization and cryptographic protocols run concurrently. When the next broadcast message is received after the volley, the client computes the offset between the apparent broadcast time and the (unicast) client time. This offset is used to compensate for the propagation time between the broadcast server and client. Once the offset is computed, the server continues as before and the client sends no further messages. ------------ end quote ----------------------- If the K9 client uses the same mode of operation, then it will indeed query the NTP daemon on the firewall in burst mode when it starts. This means you can't disallow incoming packets to port 123 on the internal NIC of the firewall. Tobias

1 0

RE: [suse-security] Looking for a secure time service
by Ralph Seichter 29 Aug '01

29 Aug '01

Tobias Reckhard wrote: > The other problem is that you can establish control connections to an NTP > daemon using the same interface as the programs ntpq and ntpdc from the NTP > distro. You should definitely use the access control options of NTP to not > allow those from the Internet and from the inside only after successful > authentication. I was thinking of using K9 (see http://www.kaska.demon.co.uk/k9.htm) on the client side. It is available for Windows and Linux, small, easy to install and listens to NTP broadcasts. Therefore, I see no need to allow access the firewall's "xntp" even from my trusted network, as the firewall will provide the NTP broadcasts. Or is there any security issue regarding NTP broadcasts which I missed? Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0