September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] battlecom with linuxserver
by James Bliss 27 Sep '01

27 Sep '01

Do you have any entries in your firewall log which would possibly help in diagnosing this problem? Also, could you possibly post your ipchains rules (over write any personal IP info with something like <my box> or <my internal network>). This would really help everyone on the list help you. 09/27/01 04:49:25 PM, Johannes Schäffner <34773(a)gmx.de> wrote: >i have counterstrike and battlecom installed on my win98 client.at the >linux-server i have ipchains installed, so at the client counterstrike (and also >icq,mirc etc.) works without any problems. but i can´t join or host any >battlecom sessions. >what do i have to change that battlecom works ( every port is open at >ipchains) >please help me!!! > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] iptables update ?
by James Bliss 27 Sep '01

27 Sep '01

Thank you Roman, I believe that you make several good points in your email. I have only been on SuSE for 6 months now. Started with 7.0, went to 7.1 and then 7.2. Bought the CDs everytime because the cost was much less than the time it would take me to download the software. I think that SuSE is a much better distro than Redhat, and have recommended it to several of my friends. Keep up the good work. If someone thinks that a newer software release is valuable to be installed on their box before it is available through SuSE they should download it from the origination site and therefore be responsible for any quirks which may be caused by doing this. Keep up the good work SuSE. And thank you very much for these mailing lists, some of the best support available for free or money. Jim 09/27/01 04:38:27 PM, Roman Drahtmueller <draht(a)suse.de> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >> Hi, >> >> Finally I decided to start learning iptables hence installed the 2.4.7 >> kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes >> the kernel is also 2.4.4) should not be there an offical update to >> iptables out of curiosity ? > > >(This mail has become somewhat lengthy, but I wanted to write down some >thoughts on closely related topics that arise when I give the answer for >this question. Everything that has nothing to do with the actual question >above on this thread is written below the line "########", and it does not >contribute to the half-technical question. I do not wish that there will >be a discussion about the issues below on this list because it would >generate an off-topic lengthy thread. It's just that some of the things >below need to be said every once in a while in order to prevent >misunderstandings from distorting the aspects and benefits of open source >software.) > >The answer: >Not quite: The iptables utility is only the setup tool, it can't easily >be a security problem without messing up the rules during setup (You'd >easily notice! :-). The actual work of the packet filter engine happens >in the kernel, not in the ipchains utility. If your machine acts as a >packet filter only, you can easily kill all running processes and run >"rm -rf /" over it - it will continue to work until you try to reboot it. > >By consequence, the newer version fixes bugs that may be nasty in some >way, but there are none that were security-related. The version of >iptables that is on the CDs is installed on a few dozen thousand >installations, and in use one some thousands, I guess. A new version is >always different from the one before (this is why there is a new version >in the first place): different functionality and different bugs as well. >We cannot guarantee that the newer version works exatly like the one >before, which is why we don't provide a newer version of the package (with >iptables being just a simple example). > >Please look at the changelogs of single packages in the distribution, >especially the core packages and libraries, and look at the patches that >we include to fix bugs that we found during testing. In order to be taken >seriously in the operating systems market, you have to be able to maintain >a certain level of quality in your software. You make a tradeoff between >the up-to-dateness (and security) and the reliability (and security) of >your software. This implies that the functionality of a single package >must be guaranteed over the updates. By consequence, the version stays the >same: only those bugs are fixed that break the functionality of the >package or impose a security risk. If your favourite email program crashes >if you hit five keys together, then do not hit these five keys together. >If it crashes when a strange email arrives, it may be security related: >Write to security(a)suse.de, and use the pgp key to encrypt your text. New >versions in update packages can only happen if the new version number is >beneficial from the security standpoint, and if no other package >relies/depends on the package to be updated. >(Example: openssh. A user should be able to tell by the version number >that the recently discovered security bugs are fixed.) > > >################## > >There is a specific set of reasons why we make a new distribution every >once in a while (with a decreasing frequency): The opensource community >needs to have a new base to build on (a distribution sets standards that >are most important for the thing as a whole), and new features are desired >on behalf of the usership. Free software is for free: You can download it >from servers worldwide. But I wouldn't want someone else to do the job >that we've accomplished with each distribution (7.3 is out in a few days): >many thousands of hours of CPU-time have been used for compilation of code >and for stresstests, many hundreds of CDs have been burned, network >equipment and computer hardware has been bought just to test the software, >and many millions of keys have been hit, not to mention the thousands of >hours in long nights that developers at SuSE and the rest of the world >have sat down to track down crashes, add improvements to performance, >stability and security, provide a nicer, ergonomic interface and make it >what it is: A secure, powerful, flexible and stable operating system, >ready to use. It is what people expect from it (while everybody expects >something different). > > If you want to give yourself a nice lesson: Play distributor! Install a >SuSE-6.1, just a minimal package selection, then put away the CDs. Then, >get KDE-2.2.1 running on it, with a few dozen applications that do all >kinds of things from showing the time down to burning CDs and sending >mails. Compile from the source tarball, not SuSE source rpms. Modularize >the software that you have installed and keep an overview over it. Add >icons, G/X, eye candy, sounds so that you like it more. Check it for bugs, >identify crashes and find security problems. Deal with buggy hardware and >BIOSes. Ensure consistency of the ready-to-install packages that you >built. Make it possible to exchange parts of the system at full >consistency. Communicate the bugs that you've found to the maintainers and >authors of the software that you use (quite some people, many emails!). > After you have found out that you need to exchange basically everything >in your minimal system in order to be able to even compile the new stuff >(not to mention running or testing!), you can abbreviate to a minimal >SuSE-7.2 installation and restart from the beginning. After a few weeks >without much fun you will find out that kdm behaves strangely under some >obscure, but usual circumstances; watch out for race conditions and buffer >overflows while you nail down the reason why all of your processes get >nuked by SIGTERM sometimes. > If you're there, invest some time to sit down with others and argue the >technical reasons why you (lazily) added your docs to /opt/kde/docs >instead of /usr/share/doc. Be sure to have a comprehensive result >afterwards, so that your distribution follows the defined standards (SuSE >is leading in terms of that). Then you change what doesn't match the >standards, and recompile everything. Don't forget to write down how to use >it for your grandma and your kids. > >SuSE employs the best people that the world has for many of the subsystems >that a SuSE Linux distribution is built on. They are paid for doing their >job and for refining the software they wrote to a thing that you can use. >The software is still for free, the patches are for free (the distributors >even share their additions), but the fact that you can easily install and >use it is not! > Provided you earn only Euro 2.50 an hour, you couldn't make it in time to >be faster than 100 times the price of a Linux distribution (a SuSE in >particular). If you buy all the software that is on the (filled up to the >last byte) SuSE CDs from a commercial vendor, expect a bill of a few >hundred thousand Euro. I've never ever paid a single buck for software, >but if I didn't (proudly) work for SuSE, I'd pay significantly more. I >would want new versions of single software packages every few months, but >as you might know we're not forced to buy it either. It's just easier and >less expensive. > >The price of a Linux distribution does not compare to the price of >commercial software, but to the price your own time and your freedom. > >Thanks, >Roman. >- -- > - - >| Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | > SuSE GmbH - Security Phone: // you need vision!" >| Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | > - - >Feel free to pass on this text, provided that it is complete and unchanged! >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: http://www.suse.de/ > >iEYEARECAAYFAjuznF0ACgkQnkDjEAAKq6ThdQCgylOJsQtBgVLgHNSzayO2YIn3 >oIcAn2CM6fOoDfL2z3MmKYcU9Vxdbmci >=phZY >-----END PGP SIGNATURE----- > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

iptables update ?
by Togan Muftuoglu 27 Sep '01

27 Sep '01

Hi, Finally I decided to start learning iptables hence installed the 2.4.7 kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes the kernel is also 2.4.4) should not be there an offical update to iptables out of curiosity ? -- Togan Muftuoglu

4 3

Re: [suse-security] Bastille and other Linux distros
by Christopher Mahmood 27 Sep '01

27 Sep '01

* Niki Rahimi (narahimi(a)us.ibm.com) [010927 10:23]: > I work with a security group in IBM's Linux Technology Center and have > recently been working on a project to get the Bastille security hardening > script to run on SuSE. I would like to get feedback from the discussion > list on this project. Would this be something the SuSE community would be > receptive to? I haven't looked at Bastille in a while, but I don't remember it doing much more than what the tools our security team has developed. Specifically, the harden-suse script, the SuSEfirewall, and seccheck. I'm not flaming, I'm genuinely curious. -- -ckm

1 0

Re: Bastille and other Linux distros
by Richard Ibbotson 27 Sep '01

27 Sep '01

Niki > I work with a security group in IBM's Linux Technology Center > and have recently been working on a project to get the Bastille > security hardening script to run on SuSE. I would like to get > feedback from the discussion list on this project. Would this be > something the SuSE community would be receptive to? There's already a harden_suse.rpm that does something similar. If you want to know more write to the SuSE Security team. How about on Debian ? Thanks Richard www.sheflug.co.uk

1 0

Bastille and other Linux distros
by Niki Rahimi 27 Sep '01

27 Sep '01

Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com

1 0

my configuration - ftp is not working
by Roger Rossell 27 Sep '01

27 Sep '01

Here is my configuration script. Ftp clients from my lan (specified in table "ids") can not retreive file lists from ftp servers can you help me please??? # FIREWALL DE IDS # echo "***** Ejecutando Firewall... ********************" # CARGA DE MODULOS modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptable_nat # variables LAN_IDS="172.16.0.0/255.255.0.0" LAN_DMZ="192.168.0.0/255.255.255.0" ANYIP="0/0" IP_LAN="172.16.100.100" IP_PUB="217.149.0.xx0" IP_DMZ="192.168.0.1" INT_LAN="eth0" INT_PUB="eth1" INT_DMZ="eth2" UNPRIVPORTS="1024:65535" #ortografia: DMZWEB_num-servidor_num-ip-virtual DMZWEB_0_0="192.168.0.100" DMZWEB_0_1="192.168.0.101" DMZWEB_1_0="192.168.0.200" PUBLIC_DMZWEB_0_0="217.149.0.xx1" PUBLIC_DMZWEB_0_1="217.149.0.xx2" PUBLIC_DMZWEB_1_0="217.149.0.xx5" DNS1="217.149.0.10" DNS2="217.149.0.11" # Añadir ip's publicas virtuales ip address add $PUBLIC_DMZWEB_0_0 dev $INT_PUB ip address add $PUBLIC_DMZWEB_0_1 dev $INT_PUB ip address add $PUBLIC_DMZWEB_1_0 dev $INT_PUB # CLEAR IPTABLES iptables -F iptables -X iptables -Z iptables -t nat -F # aciva el proxy arp para la dmz y para la lan #echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp #echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp # activa el forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # proteccion anti spoofing for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done #*/# #proteccion TCP SYN Cookie echo 1 > /proc/sys/net/ipv4/tcp_syncookies #activa el always defrag #echo 1 > /proc/sys/net/ipv4/ip_always_defrag #proteccion echo broadcast #echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_bogus_error_broadcasts #desactiva aceptacion de redireccon icmp for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done #*/# #deshabilita los paquetes SRP (Source Route) for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done #*/# #registra los spoofed packets, source routed packets, redirect packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done #*/# # Politica por defecto echo "Configurando políticas por defecto" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Crear nuevas tablas echo "Creando nuevas tablas" iptables -N dmz iptables -N ids iptables -N loopback #iptables -N lan_dmz echo "Relacionando nuevas tablas" iptables -A FORWARD -s $ANYIP -d $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_IDS -d $ANYIP -j ids iptables -A FORWARD -s $ANYIP -d $LAN_IDS -j ids iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback #iptables -A lan_dmz -j ACCEPT #iptables -A lan_dmz -j LOG --log-prefix "#lan-dmz##" # Logs generales echo "Activando logs" #iptables -A INPUT -j LOG --log-prefix "##IN## " #iptables -A OUTPUT -j LOG --log-prefix "##OUT## " #iptables -A FORWARD -j LOG --log-prefix "##FWD## " # NAT echo "Configurando NAT..." iptables -t nat -A POSTROUTING -o $INT_PUB -j MASQUERADE #iptables -t nat -A POSTROUTING -j LOG --log-prefix "##NATpost##" #PORT FORWARDING - NAT IN echo "Configurando PNAT ..." #transparent proxy # # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.10:80 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_0 -j DNAT --to-destination $DMZWEB_0_0 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_1 -j DNAT --to-destination $DMZWEB_0_1 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_1_0 -j DNAT --to-destination $DMZWEB_1_0 #iptables -t nat -A PREROUTING -j LOG --log-prefix "##NATpre##" #SERVICIOS PERMITIDOS LAN - FUERA echo "Permisos de salida desde ids_lan..." #tcp iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 23 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 25 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 80 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 110 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 137 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 443 -j ACCEPT iptables -A ids -p tcp -s $ANYIP --dport $UNPRIVPORTS -j ACCEPT #icmp iptables -A ids -p icmp -j ACCEPT #udp iptables -A ids -p udp -s $LAN_IDS -d $DNS1 --dport 53 -j ACCEPT iptables -A ids -p udp -s $LAN_IDS -d $DNS2 --dport 53 -j ACCEPT iptables -A ids -p udp -s $DNS1 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT iptables -A ids -p udp -s $DNS2 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A ids -j LOG --log-prefix "##DENY ids##" iptables -A ids -j DROP # LOOPBACK iptables -A loopback -j ACCEPT iptables -A loopback -j LOG --log-prefix "##loopback##" echo "Habilitando acceso a servidores Web DMZ..." iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_1_0 -j ACCEPT #tienda virtual (tpv) iptables -A dmz -p tcp -s $LAN_DMZ -d 193.24.33.9 --dport 56005 -j ACCEPT #permitit consultas a los dns autorizados "ojo falta el syn!!! y el source port" iptables -A dmz -p udp -s $LAN_DMZ -d $DNS1 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $LAN_DMZ -d $DNS2 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $DNS1 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT iptables -A dmz -p udp -s $DNS2 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A dmz -j LOG --log-prefix "##DENY dmz##" iptables -A dmz -j DROP echo "***** Fin de firewall script ********************" Thanks

1 0

test
by Radu Anghel 27 Sep '01

27 Sep '01

test

1 0

[suse-security] still bugging with snort...
by Markus Kohli 27 Sep '01

27 Sep '01

Hi again! Still got a problem with snort, or my setup or whatever... Following: [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:57:21.842870 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:21.841503 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:26.134428 And this repeats over and over again... I set alert-mode to full, is that the problem? My alert-file has risen to 1.5MB in only 3 days... HELP ME, PLEASE! TIA markus

2 1

Re: [suse-security] filtering ports
by r.maurizzi＠gvs.it 27 Sep '01

27 Sep '01

Boris Lorenz <bolo(a)lupa.de> wrote: > Hope that sheds more light on the issue. Let's see if I've understood correctly: If I return-rst all incoming connection on my 22 except ones from a "trusted" net, but I don't also drop/deny the unwanted IPs, an attacker can simply ignore the reset packets and happily connect to the port... right? Ciao, Rob!

3 2