August 2001 - openSUSE Security - openSUSE Mailing Lists

Looking for a secure time service
by Ralph Seichter 29 Aug '01

29 Aug '01

Hi all, I'd like to run a time service like 'xntp' on my firewall machine (Kernel 2.4 w/ iptables, no DMZ) which should be able to a) connect to public Internet time servers (obviously), b) do so with a minimum security impact, and c) send NTP broadcasts to my internal network. Looking at b), is NTP a wise protocol to use? Are there more secure protocols? If you have some setup tips or sample 'iptables' scripts to share, that'd be fine. And if there's a FAQ for this which I missed, kindly point me to it. Thank you! Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

4 3

RE: [suse-security] Linux router vs hardware router
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> Not offence taken - I am that necessary little bit better ;-), but we now > run into cost and time issues. The router ought to be dead silent, and > finding a power supply unit and a CPU cooler that deliver that, AFAICS, is > a nightmare. > Agreed. Some older hardware can run without a CPU cooler, of course, but you'll have other difficulties, like getting enough PS/2 RAMs (or even older types) for a modern Linux distro.. > >Then what are the specifics of that VPN? > > This is the email reply I just got: > > <quote> > We're still looking for a suitable device with IPSEC passthru that > actually works. The ones you mentioned [i.e. the Zyxels] have a > relatively serious flaw: one tunnel per bundle, and we run 5 separate > tunnels in 1 bundle, so that feature probably won't work. > > Having the DSL router be a VPN client end-point is not possible, since > I'd have to actually route to you, and we're not going to be able to > support that for various reasons. > </quote> > Adressing that: * FreeS/WAN gives you a practically unlimited number of tunnels. There probably is some internal limit, but five are definitely no problem at all. I agree that a limitation of one tunnel only is quite an impairment, and one that I see no sound technological reason for. * The second sentence is unclear, probably exactly because of that mixed-up mumbo-jumbo terminology I was raving about in my last mail. 'VPN client end-point', to me that implies the final destination of whatever is transported via the VPN transport. The router can't be a VPN client end-point in my opinion, because you're not going to be working on it. You want to connect your box to the rest of the network by using VPN technology. * He probably means that he doesn't want you to have a LAN on your end that he needs to route to through the router on your end, regardless of VPN or not (though you'll be probably using private IP address space and that requires a VPN more often than not). The next bits he says make it sound like that. > He also said > > <quote> > I'd suggest a simple DSL modem, and a w2k box runing microsoft ICS and > the vpn client and zonealarm pro (those last 2 things, we provide. > microsoft ics comes with 98/ME/2kpro and is relatively easy to use. > </quote> > ICS is sort of like a SOCKS proxy, IIRC, maybe with a little NAT (or PAT for Ciscoers) thrown in (but not complete, I think). The gist of it is that the ICS machine is the only one that he sees, the subnet behind it is hidden and he doesn't have to worry about it. Lazy bastard, isn't he? ;-> > Incidentally, this (without VPN) is exactly my current setup, which I > don't want to run for a variety of reasons: > > * my workstation would have to run 24/7, sucking power like nothing > * I don't feel well at all about my work-station being connected > directly to the Internet > * dial-on-demand has a design defect (it won't dial unless someone > has logged into the W2K box) > > IOW, I do need an appliance, a dedicated router. And, if possible, I'd > really love to be able to get onto that VPN. > Well, any box that can do NAT and is IPSec-capable will do. You do need to watch out for that combination normally, as NAT kills IPSec packets (so packets need to pass the NAT gateway before they go through the IPSec stage). But if both functions are performed on one and the same box and aren't mutually exclusive, I would expect them to take place in the correct order. Linux can do all of that for you, probably, depending on their VPN equipment, but your requirements for silence, etc. make an appliance seem much more suitable. Unfortunately, I don't know any. Have you looked at the Watchguard boxes? Cheers Tobias

4 3

WEP and wireless
by Phillip Beal 28 Aug '01

28 Aug '01

Hey, I'm having some trouble getting my Wioreless card to speak to my access point with WEP encryption enabled. I'm running a default 7.1 install with the wireless-tools installed. According to the stations on the access point manager, the card is connected, but I can't get the card to get an ip, or even to talk to other machines on the network. I've tried iwconfig wvlan0 key s:passwd , but this seems not to help much. I can use the card with-out WEP if I turn the encryption off, but that's not what I want to do at the current moment. The Access Point is the Linksys WAP11, and the card is WPC11, and both work fine under Windows with 128 bit WEP, but the card doesn't work with WEP under linux. Anyhelp is greatly appreciated. -Phillip Beal

5 6

Re: [suse-security] SuSEfirewall2 v1.6 question? FAQ?
by maf king 28 Aug '01

28 Aug '01

Hi Tall0n On 2001.08.27 18:41:42 +0100 Tall0n wrote: > > What I actually added was the below line: > > iptables -A input -i eth1 -s 192.168.150.0/24 -d 216.27.164.230 -j ACCEPT > > however, It didn't work. This is what the last line of the input chain > looks > like. > > Chain INPUT (policy DROP) > ********* > ACCEPT all -- 192.168.150.0/24 Tall0n.GregWorld.com > ??? > Tall0n > > My mistake :) Try *inserting* this rule earlier in the chain : iptables -I input 1 -i eth1 -s 192.168.150.0/24 -d 216.27.164.230 -j ACCEPT If you have a rule to drop the packets before the end of the chain, then adding a rule to allow them won't work - the packets are already dropped! By inseting the new rule at position 1, you are sure the packets will see the new rule... HTH, Maf. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services maf(a)standby.co.uk http://www.standby.co.uk/ Tel.: 0118 969 7562 (Reading Office) : 0115 922 1894 (Nottingham Office) : 07860 182793 (Mobile) Fax.: 0118 969 7113 / 0115 922 1894 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

snort and configuration
by Carlos 28 Aug '01

28 Aug '01

hello, this is my fist email to this list. My name Carlos. i have a great problem for configuring snort: my internet ip is XX.XX.XX.XX - mask: 255.255.255.128 my local net is 192.168.1.10 mask: 255.255.255.0 what must i to writte, for configuring snort, in the: var HOME_NET and in: var EXTERNAL_NET ?? thanks for reading this mail Carlos

2 1

Re: [suse-security] SuSEfirewall2: are these IPs private or not?
by Ralph Seichter 27 Aug '01

27 Aug '01

Steffen Dettmer wrote: > * Ralph Seichter wrote on Mon, Aug 27, 2001 at 10:37 +0200: > > > Florian Pressler wrote: > > > > > I decides to assign the following IPs to the hosts in my LAN: > > > 172.20.30.40/29, i.e 172.20.30.41 - 172.20.30.46. > > > > 172.20.x.y is a Class B network with a 255.255.0.0 netmask, so you should > > probably refer to your network as 172.20.0.0/16 in the abbreviated form. > > I'm not a networking guru, however. > > What should this help? Today CIDR is done all the time. Maybe the > script parses the netblock in a wrong way or so. Maybe you should > take a look at the sources. Florian used 172.20.30.40/29. This could of course also be interpreted as a fragment of a Class C network, which I believe is what Florian intended and what you suggest. But as 172.20.x.y is historically in "Class B address space" (lacking a better expression), it might be misinterpreted if you use a different netmask than 255.255.0.0. I have not yet seen CIDR with *private* Class A or Class B networks, so my suggestion is to try 192.168.x.0/29 instead. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

2 1

Re: [suse-security] SuSEfirewall2 v1.6 question? FAQ?
by maf king 27 Aug '01

27 Aug '01

Hi Tall0n On 2001.08.27 15:59:52 +0100 Tall0n wrote: > > > > I ended up adding a rule to the firewall along the lines of : > > > > iptables -A input -i eth1 -p tcp -s 192.168.xxx.0/24 -d $public_ip > --dport > > 80 -j ACCEPT > > > Thanks for the response, I appreciate it, but I was wondering. Is there > something in the firewall2.rc.config script that will achieve the above? > I > have multipe ports that need to be accepted on the external device from > the > internal network. 27015 and dynamic udp ports for counter-strike..hehe. > > Creating multiple chains would work, but there must be a way to do it > with > the existing firewall scripts. ???? > Glad to have been of some help so far - did my suggestion actually work? I can't offer advice on the SuSE scripts because I have always rolled my own firewalls. If it works, though, it isn't that much of a chore to knock up a boot script to add extra rules - a bit of copy and paste and adjust port numbers. If you trust your local users, you could always accept all traffic from localnet to public_ip by not specifing the protocol or the destination port in the rule I gave earlier. HTH Maf. > Thank you so much > > Tall0n > > > -- > GregWorld.com > > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: [suse-security] Linux router vs hardware router
by Reckhard, Tobias 27 Aug '01

27 Aug '01

> >+ According to MTBF calculations, should be more reliable. > > ... it died after nine months of 24/7 service. Until then, it was the > perfect fire-and-forget appliance. It Plainly Worked. > 9 months * 30 days/month * 24 hrs/day = 6480 hrs. I don't know what MTBFs appliance vendors usually claim, but 9 months isn't really a lot in my book. I expect routers, switches, etc. to be up a lot longer without exhibiting a failure. You could probably increase the MTBF of a Linux setup considerably by using a CPU and video card with low power consumption (requires less cooling -- fans like to fail, use good ones) and replacing the hard drive with plenty of RAM. Boot from CD, use a RAM-drive for the RW portions of the file system, store the configuration files, which change rather frequently, on floppy disk. This will be rather difficult to do with a stock SuSE system, though it might well be possible. If what you say about your level of networking expertise transfers to your Linux abilities, I wouldn't recommend it to you. No offence. ;-) > >- Security generally good but updates can rely on luck in discovering a > new > >code release. > > This is something that does worry me to some extent. Looking at how > quickly security updates for Linux defects are published is impressive. A > hardware router implies > > * unknown OS > I suppose most of them have a DOS or free Unix history. I don't know about the lower end, but most of the enterprise-grade appliances use modified versions of Linux or Open/Free/Net-BSD. I think the development of an own OS is way too expensive for the SOHO market. > * unknown quality of filter implementation > (the functionality offered by Zyxel seems to be fine) > I wouldn't expect too much from them. It's closed source, low price. I don't put much faith into that combination, but that's just my personal opinion. > I do not expect to get any seizable attacks (barring yet another CodeRed > storm) as I am on a dynamic IP, but just looking at how some Cisco SOHO > product happened to lock up on the CodeRed attack due to a firmware bug, > thus constituting a somewhat accidental DoS attack, does worry me. > Goes to show that a brand name doesn't do it all. Lots of the industry giants have acquired all sorts of small companies lately and now sell their products, which means that the giants' product lines are very heterogenous and that experiences with some of a vendor's products don't necessarily carry over to others. > >+ Rapid response to new threats. > > Major selling point. I tend to be paranoid in this respect - and since I > am telecommuting, forced downtime due to (exploitable) threats is not > something that I would like to see. > >From my observations (which aren't many), the SOHO router market seems to rely on vulnerabilities not being found, i.e. security by obscurity. Alcatel, e.g., made a fundamental mistake in the default setup of their DSL thingies a while back. These types of errors are especially problematic with appliances meant for more or less clueless folks (no implication!), as those certainly won't be able to find and remove them. > The only thing - which might be quite out of the ordinary - that I really > do want to do is getting onto a (specific) VPN. The old Linux setup > Then what are the specifics of that VPN? > * dynamic IP > * Linux NAT router > * W2K and Linux 2.2 / 2.4 clients > > was something that was not acceptable to the IS department. On the other > hand, > > * static IPs > * Linux NAT router > * W2K or Linux 2.2 / 2.4 clients > > or > > * dynamic IP > * W2K > > would have worked for them. I have no idea what they are running (though I > just asked). > The reasons behind the above would be very interesting. > The above-mentioned ZyWALL 10 will support IPsec endpoint features. > Instead of running a client on PC your router will act as a client and > this will enable AH support as well. It will be a IPsec Client/Server and > it will support both IPsec protocols ESP (IP protocol 50) and AH (IP > protocol 51) for both modes "transport" and "tunnel". Is this something a > Linux solution could do as well, even when set up by an incompetent > network administrator (aka me)? > A Linux gateway with FreeS/WAN will work as an IPSec gateway as well, i.e. you can use tunnel mode and ESP (AH, too, if you want, though it adds nothing substantial in terms of security -- in fact, Bruce Schneier and a less famous co-author recommend that IPSec drop AH for reasons of removing redundancy) to connect the gateway and machines behind it to a similar IPSec gateway. Note that the terms 'client' and 'server' don't apply well to IPSec, as that is always a peer-to-peer thing. What the industry likes to call clients are Road Warriors in FreeS/WAN-speak, while the term 'VPN server' usually means IPSec tunnel mode gateways. FreeS/WAN setup is anywhere between dead simple and impossible, depending entirely on the specific situation. Interoperation with other products can be challenging, but I am sure this is no different with any other product. We've just tried to set up W2K Professional (Road Warrior) to FreeS/WAN (tunnel gateway) connectivity, e.g., and it simply won't work, because W2Kprof doesn't support tunnel mode, *but* allows you to specify a tunnel end point. That effectively silences the NIC (or dial-up adapter) completely... Cool, huh? The point is that IPSec interoperability isn't as good as would be desirable, and FreeS/WAN is no exception. Don't let Zyxel blind you, though, I'd be skeptical of their interoperability. Cheers Tobias

4 3

RE: [suse-security] Linux router vs hardware router
by r.maurizzi＠gvs.it 27 Aug '01

27 Aug '01

Some months ago I found this thing on freshmeat: http://www.astaro.com/products/index.html They have a CD based "advanced" firewall (web administration, IPSec, PPTP...) that is linux based, and they sell it "pre-installed on select hardware", for example "Cobalt Networks Raq3i"... I don't know if the product is any good, since I was able to find an old 486 that's doing the job quite well (crossing fingers... :-) Moreover, SuSE's going to release a similar product, a "firewall on CD" that should be available right now. A nice thing SuSE marketing people could do is to create a partnership with some Linux appliance vendor to develop a "Plug & Play" linux hardware firewall solution :-))) Ciao, Rob!

1 0

RE: [suse-security] Linux router vs hardware router
by Reinhard Ruholl 27 Aug '01

27 Aug '01

Linux router vs. hardware-router performance test with Fli4l Linux-Floppy-Router (with firewall options) test: parrallel throughput from 4 personal Computers through a Linux Router to a Server PC's: 550 MHz, 8 GB IDE disk, 100 MHz Intel Pro netcard, Every PC was connecting to one netcard at the server and had ists own IP - Subdomain BS: NT40, Protocoll: Netbios over TCP/IP Linux Router: 800 MHz, 5 x 100 Mbit AT2450 FTX Netcards, BS: Linux Fli4l from 1 Floppy Server: BS: Linux Suse 6.4 At the same time we were copying 625 MB images from the Linux Server to the 4 PC's in a time of about 5 min. That was a througput of about 70 Mbit/s for the Router. I think, in a Network with over 100 Clients and TCP/IP, you can better use this small budget solution than a big Cisco for thousands of $. This Fli4l Floppy has also Firewall-Options. Look at www.fli4l.de Important: You need switches to connect over 100 clients to the Router. Reinhard

1 0