January 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [SLE] Kernel RPMs in the ftp sites.
by Nadeem Hasan 23 Jan '02

23 Jan '02

Anders Johansson wrote: > > On Saturday 19 January 2002 18.19, Nadeem Hasan wrote: > > You are assuming that > > everyone uses and needs initrd. That is not true. > > and you are assuming everyone uses and needs lilo. That is not true. > > look at grub, for instance My bad in assuming that :) You are right, it would be a *really* bad idea if lilo was executed automatically. But I am still unable to buy the initrd idea from ckm. He keeps talking about people needing initrd, while I was only talking about people who don't. Those are the people who don't use reiserfs for root fs, scsi disks or RAID and hence don't need to build initrd. I was one of those till lately, before I moved to ext3 on LVM :) Cheers, -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

3 2

Apache 1.3.22
by Peter Nixon 23 Jan '02

23 Jan '02

Hi Guys Just wondering if there is going to be an Apache update released by SuSE in the near future? I have compiled my own 1.3.22 rpms (minus SuSE patches) and they work fine on my notebook, but I would prefer to use the SuSE ones on my servers if there are going to be some.. http://www.apache.org/dist/httpd/Announcement.html "This version of Apache is principally a security fix release which closes some problems where a directory listing could be obtained instead of the default index page." Just wondering.. -- Viel Spaß Peter Nixon - nix(a)susesecurity.com SuSE Security FAQ Maintainer http://www.susesecurity.com/faq/ "If you think cryptography will solve the problem, then you don't understand cryptography and you don't understand your problem."

1 0

DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, TXL for your help. I got my problem fixt. It was an networkproblem. Crasy :-( Now it works fine. best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com

1 0

Restricting rsync to ssh only
by Togan Muftuoglu 23 Jan '02

23 Jan '02

Hi, Sorry if the question has been asked before and already replied then just point me rather sending flames as it has already been an extremely bad day. This is what I want to do I am placing a webserver on DMZ (192.168.2.2) apache is running chrooted via compartment the webpages are located at $CHROOT/webhome the directory and files are owned by wwwrun.nogroup I want to be able to run rsync to update the web pages however I only want to open the minimum number of ports in the firewall. The question is how can I force rsync to except communication from ssh only rather than from rsync port. Thanks -- Togan Muftuoglu

3 4

Antwort: Re: Antwort: Re: [suse-security] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, well that´s problably the fault. I use to try it with a FORWARD rule, but it don´t work. May I do a syntactic fault, but I think it has to be like : $IPTABLES -A FORWARD -i $IF_INT -o $IF_EXT -p tcp -s potsdamerplatz -d IPINTERN --dport FF -j ACCEPT I also try to switch from <<-j MASQUERADE rule>> to <<-j SNAT --to-source MYIP>> I have read: MASQUERADING ins pretty good 4 dynamic IP, I still use static. But it is the same one. :-( Any idea ?? TIA best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com Martin.Peikert(a)discon.de 23.01.2002 13:13 Bitte antworten an Martin.Peikert An: T-Systems Ertl/Extern/040/DCAG/DCX@wk-EMEA2 Kopie: suse-security(a)suse.com Thema: Re: Antwort: Re: [suse-security] DNAT problems T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Helo Martin, helo folks, > > thanks for your responce. > > I can show U the rule: > > $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination > IPINTERN Ok, that's prerouting. Is there a forwarding rule that accepts that traffic? Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany

3 3

Antwort: Re: [suse-security] ] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Michael, helo folks, Sorry Michael, but I thought the other folks, looks Martin know what I meen. I'am sure that U understand, that I don´t post thinks like our IP or dport plaintext. best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com appeldorn(a)codixx.de 23.01.2002 14:57 Bitte antworten an Appeldorn An: Martin.Peikert(a)discon.de Kopie: suse-security(a)suse.com Thema: Re: [suse-security] ] DNAT problems >T-Systems.Ertl(a)daimlerchrysler.com schrieb: > >> May I do a syntactic fault, but I think it has to be like : >> >> $IPTABLES -A FORWARD -i $IF_INT -o $IF_EXT -p tcp -s potsdamerplatz >> -d IPINTERN --dport FF -j ACCEPT > >Isn't $IF_INT the interface for incoming and $IF_EXT the interface for >outgoing traffic? If it is, you might try >$IPTABLES -A FORWARD -i $IF_EXT -o $IF_INT -p tcp -s potsdamerplatz \ > -d IPINTERN --dport FF -j ACCEPT I think U did -> -d $IPINTERN instead of -d IPINTERN and what you will do with --dport FF is FF a variable too ?? (user $FF) Michael Appeldorn -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] probs with ftp-masquerading
by OKDesign oHG Security Administrator 23 Jan '02

23 Jan '02

Okay, I've now learned a lot of security-wisdom and that the SuSE-firewall 2 is a damned good tool (something I already knew). But my problem is still unsolved. For any reasons ftp-masquerading doesn't work. I tried what Ralf recommended, but the two iptables-commands didn't have any result (okay, maybe they had, but they didn't enable ftp-masquerading). I also looked for the modules ip_conntrack_ftp and ip_nat_ftp as GertJan told me. I had no luck to find the first one anywhere on my system although the FW-Packe is installed. The second one is there and I did an insmod, but this also didn't solve the problem. Ah yes, Lars pointed me to an error I made. Of course I didn't install my system from the crab, but from the scratch. Funny to image a crab with SuSE-Linux tied on the back :-) To Roman: Of course you are right, but as I already mentioned, I have to live with DAUs in my LAN, and it's hard enough to have my phone actually ringing like hell because this damn ftp doesn't work. By now I only answer "I'm working on it and I'll send a message to all users when it's working again..."; but to imagine to have to explain all users what FTP-passive-mode is and how and why it must be used, is as hard as to imagine that my mother-in-law is going to stay for more than one week (one week is bad enough, but more will ruin my nerves *sigh*). I really don't know which one I would prefer if I had only these two choices... Anyway, could someone help me in solving my problem ? I'm sure out there on this list are lots of iptables-freaks knowing nearly all tricks one can do with it and it should be no big problem for them to find out how to enable this ftp-masquerading. Thanks in advance Stephan

3 3

Re: Antwort: Re: [suse-security] DNAT problems
by Martin Peikert 23 Jan '02

23 Jan '02

T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Helo Martin, helo folks, > > thanks for your responce. > > I can show U the rule: > > $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination > IPINTERN Ok, that's prerouting. Is there a forwarding rule that accepts that traffic? Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany

1 0

Antwort: Re: [suse-security] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, thanks for your responce. I can show U the rule: $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination IPINTERN and a pullout of /var/log/kernel.log: Jan 21 17:41:06 FW15 kernel: DROP-TCP IN=tr0 OUT=eth0 SRC=IPEXTERN DST=IPINTERN LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=6234 DF PROTO=TCP SPT=1079 DPT=FF WINDOW=8760 RES=0x00 SYN URGP=0 but, sorry no iptales -L. On this print U can see, that the DNAT is working pretty ( see on DST = is the DNAT IP ) , but packets are dropt. WHY ?? :-( TIA best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com Martin.Peikert(a)discon.de 23.01.2002 11:17 Bitte antworten an Martin.Peikert An: suse-security(a)suse.com Kopie: Thema: Re: [suse-security] DNAT problems T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Hi Folks, > > we are pretty much done with our firewall now, but unfortunately we have a tiny > problem. Basically we want to use dNAT. We see that the translation of the IP > works out pretty good already. > Actually he does everything right, but he still drops the packages. > > Do we need an additional rule ? Could you be a little bit more detailed? What rules do you already have? It would help to send a 'iptables -n -L'... Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 DMZ question.
by Marcin Gryszczuk 23 Jan '02

23 Jan '02

Hi All. I thing it is more to SuSEfirewall2 developers. I was just looking at the settings made by SuSEfirewall2 scripts based on my settings in rc.config and I could realize that there are quite big section for dmz, when I have no DMZ set in SuSEfirewall2 rc.config at all. Also looking in iptables LIST it is mentioned, that there is no references to forward_dmz and input_dmz chain at all. So the question is what are that chains for. I thing it is quite easy to check if there is any DMZ set up or not and do not set all that not needed chains by SuSEfirewall2 in "no" case. Just a small tip... Best regards Marcin Gryszczuk

1 0

Compartment and --cap
by Togan Muftuoglu 23 Jan '02

23 Jan '02

Hi, I am trying to chroot services via Marc's compartment. For instance for chrooting apache I think I understood the need for -cap CAP_NET_BIND_SERVICE since the port binding is below 1024. Hovever I do not want to have root running the services. From reading the README file I should be chowning the directories to something other then root. The README file refers to capability.h file for further reference yet it sounds Greek to me. Again from the README I understand that I can not use --user --group with 2.2.x kernels . I have found a document at ftp://ftp.guardian.no/pub/free/linux/capabilities/capfaq.txt describing the capabilities. Yet is there a plain english bersion that I could not locate or what are the best uses of these for apache and proftp Thanks -- Togan Muftuoglu

2 2

iptables, masquerading & forwarding
by Jens Georg 23 Jan '02

23 Jan '02

hi, i am going to set up my own firewallscript on my suse 7.3 box using iptables in order to get familiar with iptables. i have two nic's setup: eth0 192.168.0.0/24, connected to my private lan with 192.168.0.250 assigned to eth0 eth1 192.168.1.0/24, connected to my dsl-modem with 192.168.1.250 assigned to eth1 at the beginning i would like to achieve the following: 1. blocking all incoming requests to ports 0-1023 with 2. masquerading, so all clients on my network can talk to the net via eth1 first point can be done with iptables -A INPUT -p tcp --dport 1:1023 -j DROP, second with iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -j MASQUERADE, right ? what i don't understand is how to "route" packets between eth0 & eth1, so packets from/to the internet are routed via eth1 *WITHOUT* bypassing my firewall. is "echo 1 > /proc/sys/net/ipv4/ip_forward" the right choice ? regards, jens

2 1

SuSEfirewall2 (?) and advanced routing problem.
by Marcin Gryszczuk 23 Jan '02

23 Jan '02

Hi All... 1 - problem 1-st: I have following problem that can not solve under SuSE 7.3 with SuSEfirewall2 - kernel 2.4.16, iptables 1.2.2. Problem is that I have 2 public interfaces (eth1 - default and eth2) with 2 public IP addresses and 1 internal interface (eth0) with 192.168.0.x private class. On that last interface I have small private network which is MASUQREDED on my Linux box. Problem is that I would like to forward part of the traffic (let say all squid proxy requests to my external server) via my 2-nd public interface (eth2). At the moment all traffic goes via default gateway (eth1). I have tried the example I could find in Adv-routing HOWTO - routing all SQUID packets to be forwarded via eth2 : iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 3128 -j MARK --set-mark 1 My rule table looks like: #ip rule ls 0: from all lookup local 32765: from all fwmark 1 lookup ic.out 32766: from all lookup main 32767: from all lookup 253 #ip route ls table ic.out default via y.y.y.97 dev eth2 - but it does not work. What is strange I have had SuSe 6.3 before and under ipchains it worked perfectly! What I have realized is that during testing this connection packets try to goes via eth2 - I could see it on tcpdump - but only packets with S (SYN ?) flag set appears there... And nothing else. What I have also realized is that I could see some (strange for me) lines in firewall log file like: Jan 21 11:24:01 linux kernel: martian source 192.168.0.22 from z.z.z.z, on dev eth2 Jan 21 11:24:01 linux kernel: ll header: 00:00:c0:6a:65:d3:00:c0:df:b0:c2:a8:08:00 192.168.0.22 - is my comp in my private net., z.z.z.z is my proxy server IP address (what in fact I've just realized after the whole day yesterday looking at it). Is there anybody who can help me with that? What should I turn on or off in firewall setting (or maybe somewhere else) to make it run (at the bottom there is more details about my system). As I mentioned before I have had it working perfectly on 6.3 box with ipchains. Anyway - this does not looks like firewall problem as I could not force it to run also with SuSEfirewall2 stopped. 2. problem 2-nd. I thing it is more to SuSEfirewall2 developers. I was just looking at the settings made by SuSEfirewall2 scripts based on my settings and I could realize that there are quite big section for dmz, when I have no DMZ set in SuSEfirewall2 rc.config at all. And also it is mentioned in iptabels -L that there is no references to forward_dmz and input_dmz section at all. So the question is what is it for. I thing it is quite easy to check if there is any DMZ set up or not and do not set all this not needed chains in iptables in "no" case. Just a small tip... Thanx in advance for any help.. Best regards Marcin Gryszczuk Some info about my settings: ifconfig: eth0 Link encap:Ethernet HWaddr ... inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... eth1 Link encap:Ethernet HWaddr ... inet addr:x.x.x.x Bcast:x.x.x.191 Mask:255.255.255.192 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... eth2 Link encap:Ethernet HWaddr ... inet addr:y.y.y.y Bcast:y.y.y.127 Mask:255.255.255.224 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 ... # ip rule ls 0: from all lookup local 32765: from all fwmark 1 lookup ic.out 32766: from all lookup main 32767: from all lookup 253 # ip route ls table ic.out default via y.y.y.97 dev eth2 # ip route ls table main y.y.y.96/27 dev eth2 proto kernel scope link src y.y.y.y x.x.x.128/26 dev eth1 proto kernel scope link src x.x.x.x 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.100.100 default via x.x.x.129 dev eth1 SuSEfirewall2 settings: FW_DEV_EXT="eth1 eth2" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain www ntp https" FW_SERVICES_EXT_UDP="domain ntp" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ftp-data:telnet smtp domain www pop3 ntp 139 https" FW_SERVICES_INT_UDP="domain syslog ntp" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" SuSE 7.3 kernel 2.4.16 iptables 1.2.2 If anything else is needed to help me - please let me know...

2 4

DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Hi Folks, we are pretty much done with our firewall now, but unfortunately we have a tiny problem. Basically we want to use dNAT. We see that the translation of the IP works out pretty good already. Actually he does everything right, but he still drops the packages. Do we need an additional rule ? Thanks for your help Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com

2 1

POSTROUTING SNAT or MASQ
by Nils Wunsch 23 Jan '02

23 Jan '02

Question We wanted official IP for externally however with the internal network over it out is there snat better?? or Masq. Masp is nevertheless better for dynamic IP? status: Chain POSTROUTING (policy ACCEPT 16 packets, 792 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT all -- * eth2 192.168.1.0/24 0.0.0.0/0 to:extip rule: iptables -t nat -A POSTROUTING -o eth2 -s $dmz3 -j SNAT --to-source $extIP eth2 networkkart intern dmz internal network 192.168.1.0/24 eth0 extip /nils

1 0

AW: [suse-security] probs with ftp-masquerading
by Peer Stefan 23 Jan '02

23 Jan '02

ftp-data is port 20, ftp control port is 21. regards, stefan -----Ursprüngliche Nachricht----- Von: Azman Salleh [mailto:azmansal@nti.infomal.com.my] Gesendet: Mittwoch, 23. Jänner 2002 02:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] probs with ftp-masquerading I got similar problem last time. Found out that I had to let through port "ftp-data" as well as "ftp". I think they are ports 21 and 22 respectively. My original firewall config only let thru port "ftp", that's why I could connect to an ftp server, but could not get a dir listing. azman ----- Original Message ----- From: OKDesign oHG Security Administrator <security(a)okdesign.de> To: <suse-security(a)suse.com> Sent: Tuesday, January 22, 2002 3:24 PM Subject: RE: [suse-security] probs with ftp-masquerading > Okay, > > I've now learned a lot of security-wisdom and that the SuSE-firewall 2 is a > damned good tool (something I already knew). > But my problem is still unsolved. For any reasons ftp-masquerading doesn't > work. > I tried what Ralf recommended, but the two iptables-commands didn't have any > result (okay, maybe they had, but they didn't enable ftp-masquerading). > I also looked for the modules ip_conntrack_ftp and ip_nat_ftp as GertJan > told me. I had no luck to find the first one anywhere on my system although > the FW-Packe is installed. The second one is there and I did an insmod, but > this also didn't solve the problem. > Ah yes, Lars pointed me to an error I made. Of course I didn't install my > system from the crab, but from the scratch. Funny to image a crab with > SuSE-Linux tied on the back :-) > To Roman: Of course you are right, but as I already mentioned, I have to > live with DAUs in my LAN, and it's hard enough to have my phone actually > ringing like hell because this damn ftp doesn't work. By now I only answer > "I'm working on it and I'll send a message to all users when it's working > again..."; but to imagine to have to explain all users what FTP-passive-mode > is and how and why it must be used, is as hard as to imagine that my > mother-in-law is going to stay for more than one week (one week is bad > enough, but more will ruin my nerves *sigh*). I really don't know which one > I would prefer if I had only these two choices... > > Anyway, could someone help me in solving my problem ? I'm sure out there on > this list are lots of iptables-freaks knowing nearly all tricks one can do > with it and it should be no big problem for them to find out how to enable > this ftp-masquerading. > > Thanks in advance > > Stephan > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 & mysql
by efbiei＠gmx.de 22 Jan '02

22 Jan '02

Obwohl ich den Port 3306 nicht als EXTERNAL TCP definiert habe, ist dieser Port vom mysqld offen laut nmap. Und das seit der mysqld läuft. Wie kann das sein ? FW_SERVICES_EXT_TCP="ssh smtp www pop3 https domain"

2 1

RE: [suse-security] SuSEfirewall2 & mysql
by Boris Kimel 22 Jan '02

22 Jan '02

> And what about high ports access in your config? > > (on the run) > > Boris Kimel. > > > ----- Original Message ----- > From: "Karsten Schell" <efbiei(a)gmx.de> > To: <suse-security(a)suse.com> > Sent: Tuesday, January 22, 2002 4:19 PM > Subject: [suse-security] SuSEfirewall2 & mysql > > > > and now in English, sorry! > > > > Since I am running mysqld on my server the port 3306 is open though its > not > > inlcuded in EXTERNAL_TCP services > > > > services I allow: > > FW_SERVICES_EXT_TCP="ssh smtp www pop3 https domain" > > > > any clue why this port is open ? > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

SuSEpersonal-firewall - Reason for not using a default policy for INPUT
by Robert Davies 22 Jan '02

22 Jan '02

Just curious the reasons for not using default 'policy', but preferring 'back stop' rules in SuSEpersonal-firewall. Can anyone explain the reasons? Initial impression, would be that setting a policy of DENY on INPUT would be more secure. The usage is commented on, but not explained which makes me curious! Rob

2 2

a simple question
by Omppu 22 Jan '02

22 Jan '02

now with the basic installation of susefirewall2 no server from the dmz can access the world. what parameter can should i add and where to if i want the servers on the dmz to access for example ports 22, 25, 80, 5800 hoping for a reply this time, regards O.

2 1

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

> We had a discussion about djbdns on a local maillinglist in > Berlin. It's not offering all features that bind offers. While this may well be true, many people probably don't need certain features at all. And there are workarounds or patches for quite a few of the 'problems' that a certain number of people have with the pure djbdns. Perhaps you could point out which specific features you miss? > I don't > know if zone transfers are supported currently, some time ago you > had to fiddle around with rsync or such things. Zone transfers are supported in the current version (djbdns 1.05), but you need the separate ucspi-tcp package to provide TCP client and server. DJB argues against zone transfers and urges people to use rsync (preferrably over SSH) instead, for several reasons outlined on his web page. However, tinydns (the DNS server) in combination with axfrdns (the TCP request and AXFR responder) servers zone transfers just fine. tinydns does not pull zones per zone transfer automatically, so you need to use cron jobs to pull from the clients on a regular basis to emulate AXFR behaviour. DJB favours a push approach (which BIND8, I believe, has introduced with NOTIFY as well) via rsync/ssh. You could also use SSH with automatic command execution (command='cd /etc/tinydns/root && tcpclient 1.2.3.4 53 axfr.get zone data data.tmp && && make') to achieve the same effect. > For non-trivial > setups (i.e. some hunderds zones and a handful secondaries) I > would not recommend such approach but use bind8 instead. IMHO, that depends on what you favour: a relatively bloated piece of software with a pretty poor security track that most organisations and documents expect, which therefore means that you'll find HowTos, etc. geared towards it, or a couple of small, highly secure tools that work differently than the former and may require some scripting around them to achieve the same features, however usually implemented with higher quality. > If you > need cryptography, I think there is no way around bind9 > currently. For a small private caching only server djbdns may be > a nice solution. Hmm, what do you mean with 'cryptography'? You may be right, if you mean that djbdns doesn't support 'SecDNS', which DJB doesn't believe in, BTW (this is meant merely as an explanation, my opinion doesn't necessarily converge with DJB here or elsewhere). It can be configured to support FreeS/WAN's opportunistic encryption by handing out KEY records, and the FreeS/WAN docs speak of SecDNS... so maybe djbdns does actually support 'cryptography'. I don't know enough about the so-called Secure DNS to be able to say. Cheers Tobias

6 5

Why MY ftp failed always
by sambit 22 Jan '02

22 Jan '02

Hi, Can any one help me, i am trying to do ftp to my Linux suse 7.2 server and i am always gettig 421 Service not available, remote server has closed connection i changed the file like Search for the following entries in /etc/inetd.conf : ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -a # ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd but i did not get any luck , is there any command to find /see all packages installed in SUSE-7.2, or what is the bast way to install or remove package in SUSE, if i am not using rpm -i for install, but is there any option in rpm to display all packages ? Thanks Sambit

5 4

Why can't root login at xdm on one system?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

Hi all Does anyone have an idea why xdm can't successfully verify root's password on one of my systems? This not only prevents root from logging in, but also forces me to login to be able to shut the system down, because I've set the system to allow only root to perform shutdown. This is the only one of my SuSE 7.3 systems with this problem. I've compared /etc/pam.d/xdm, /opt/kde2/share/config/kdm/kdmrc, /etc/passwd and /etc/shadow. I see nothing in /var/log/messages, /var/log/warn or /var/log[k|x]dm to indicate a problem when I attempt to login as root. I *can* su to root. The only thing I see in /var/log/messages that seems relevant to me are entries similar to the following: Jan 18 05:58:52 snsfr002 PAM-unix2[9802]: session started for user reckhard, service xdm Jan 18 06:31:22 snsfr002 PAM-unix2[9802]: session finished for user reckhard, service xdm I see those for user root on the working systems, but nothing on the one with the problem (snsfr002). Any hints? Cheers Tobias -- Tobias Reckhard secunet Security Networks AG Tel : +49(6196)95888-42 Mergenthalerallee 77 Fax : +49(6196)95888-88 D-65760 Eschborn E-Mail: tobias.reckhard(a)secunet.com

2 1

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

> you forgot one reason to use bind, and this one is important > and security > relevant: The number of others using it and the resulting amount of > documentation and help available! The same is true für MS products. > > Customers use bind because if they have problems help is > available. There are > books they can buy. The DNS technicians of their ISP can > help. This is an > important reason to use bind. This would be a valid point. But it is my experience that an extremely high percentage of the people using MS software doesn't know how to use it properly. And regarding the server components, even very many 'experts' are too ignorant to deserve the title at all. Same goes for most BIND installations out there. The people in charge of them know the basics of DNS, but that's about it, most of the time. I have yet to come to a customer site and find the current version of BIND, i.e. one without known security issues, aka root exploits, running. Many of the configurations I see are wrong or highly insecure, reverse zones are missing, etc... IMHO, this is very much similar to the high proportion of vulnerable IIS servers on the 'Net. Cheers Tobias

1 0

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 22 Jan '02

22 Jan '02

Re Kurt > > Have you read DJB's comments? > > Yes. And? His comments with regard to Postfix are incorrect > (i.e. wrong) and > seriously out of date. True. And I agree that his social skills leave to be desired.. > Have you read this: > > http://www.sigmasoft.com/~openbsd/archive/openbsd-ports/200108/msg00461.html > > It got bad enough that OpenBSD dropped his software from _ports_. Ah yes, the eternal DJB license debate. I don't like it either and it prohibits distribution vendors from distributing his software, but it's not the software or its quality that's the problem (though I agree that Dan is rather unorthodox in his use of directories and he invents new root-level subdirectories every now and then, which I don't really much like - OTOH, lots of programs use very different directories for similar tasks..), it's Dan's urge to remain totally in control and his crusade for his beliefs. > Plus most of his software stagnates quite quickly, and he doesn't officially > accept contributions, so you end up missing basic functionality that is > addressed by third party (unaudited typically) patches. Well, if features you need are missing, you shouldn't use the software and go find something else instead. I don't feel that each and every mail server needs or should even have all the bells and whistles of MS Exchange. When the product is done and the task its coder wanted it to perform is completed by it, why shouldn't he call it a final? Note that I don't use Qmail, but rather Postfix, and I prefer Wietse's attitude to Dan's any day (and this is my personal opinion). But regarding DNS servers, there is no choice corresponding to the one between Postfix and Qmail. It's BIND or djbdns, which is more like a Qmail to Sendmail comparison. And I don't really trust 'complete rewrites' a lot, honestly, it takes time to produce a certain number of lines of code and the BIND folks were pretty fast with BIND9 if it's from scratch.. It probably also retains a lot of the not-so-good ideas of former BIND versions with regard to handling glue, etc.. Cheers Tobias

1 0