January 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] firewall2 and portforwarding
by Ralf Moeller 20 Jan '02

20 Jan '02

Hi! THX for the tip! But Masqurading for exsample is working fine. but this port forwarding is my problem. the comments are hard to understand for germans like me ;) Thx again! s@mmy

1 0

What is the meaning of FW_TRUSTED_NETS?
by Paul Elliott 20 Jan '02

20 Jan '02

What is the meaning of FW_TRUSTED_NETS? Are the hosts/servers/ports listed hear automaticly allowed access? Or perhaps they are only considered internal? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

Two questions about services on the local host and SuSEfirewall2?
by Paul Elliott 20 Jan '02

20 Jan '02

Q1) Does it make sense or is it usefull to talk about the loopback interface as a trusted interface? FW_DEV_INT="lo" Or is this in some sense builtin? Q2) Is there any reason while the "root" account can not start a local xterm, but other users can? Password: hrnowl:/home/pelliott # xterm Xlib: connection to ":0.0" refused by server Xlib: Invalid MIT-MAGIC-COOKIE-1 key Warning: This program is an suid-root program or is being run by the root user. The full text of the error or warning message cannot be safely formatted in this environment. You may get a more descriptive message by running the program as a non-root user or by removing the suid bit on the executable. xterm Xt error: Can't open display: %s hrnowl:/home/pelliott # echo $DISPLAY :0 hrnowl:/home/pelliott # How do I do I change this? Only for the localhost, A similar problem is preventing me from doing a "make xconfig" Thank You. P.S. I would be using the personal firewall rather than SuSEfirewall2 except I have to cut a hole for my connection to my ntp server for chrony. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

firewall2 and portforwarding
by Ralf Moeller 19 Jan '02

19 Jan '02

Hi everybody! I´m using suse 7.3 and firewall2. Maybe anyone could tell me how to get some ports forwarded to a client? Please tell me how this works with the firewall2 and not with this iptables commands. dont know them a bit... THX in advance!!! s@mmy

1 0

Is bind 9.1.0 secure?
by Praise 19 Jan '02

19 Jan '02

Hi all, I am planning to set up this name server in the near future, so I have looked at ISC web site to see if there were some new bugs I did know of. I have noticed that they raccomend version 9.2.0, but I do not see why, as the vulnerabilities listed are all for version < 8.2.5 Will I be safe with Suse's package of bind (9.1.0) in Suse 7.1? Praise

3 2

FW: [suse-security] optimal kernel config for firewall gateway ?
by Thomas Schmidt 19 Jan '02

19 Jan '02

-----Original Message----- From: Thomas Schmidt Sent: Monday, January 14, 2002 11:16 AM To: 'Torsten Mueller' Subject: RE: [suse-security] optimal kernel config for firewall gateway ? It´s true, that you can use a 486 for Firewall, but a prefer to a P-II or AMD K6-2 as minium requieremnt for 1 Mbit. The problem ist not the traffic, but the syslog. We have serveral costumers, who are connected with 2 mbit. If someone portscan your system or tries an dos-attack, increased your system load dramaticly and the traffic stops :( > -----Original Message----- > From: Torsten Mueller [mailto:torsten@archesoft.de] > Sent: Friday, January 11, 2002 10:40 AM > To: Bernhard Held > Cc: SuSE-Security List > Subject: Re: [suse-security] optimal kernel config for > firewall gateway > ? > > > Hey, > > Bernhard Held schrieb: > > > > >Well, if you compile a kernel with ip-forwarding turned on > but filtering > > >disabled, one would expect that the router is faster > because the code is > > >just missing in the kernel. On a reasonably fast machine > I'd say that > > >these effects should be neglectable. > > But what do think is a reasonable machine? What will I need > for a simple > > firewall with Internet (1 MBit), DMZ (Mailserver) and a > local network in > > terms of MHz and MByte? > > for me works a 486-with i think 33 MHZ and 12 MB RAM. > It connects my wireless lan to the internet (adsl - german > telekom) > > Greetings Torsten > > > > > Thanks, > > Bernhard > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

5 4

not security related
by Marios Marti 19 Jan '02

19 Jan '02

I m trying to compile the kernel and have the following error: $make menuconfig $make:**** No rule to make target 'config' . Stop anyone knows how to solve this or a website that would help? Thanks Marios

4 3

Re: [suse-security] vnc masqueraded
by Andreas Schamanek 19 Jan '02

19 Jan '02

On Thu, 17 Jan 2002, Jens Woch wrote: > But sniffing could happen even if I replace 0/0 with something > (much) more specific, couldn't it? The ssh-suggestion by Markus > Gaugusch would prevent it, I guess (have to play with it yet). Jens, in your situation I recommend using SSH port forwarding. Log in to the firewall and port forward your connection. Depending on your setup you have 2 possibilities: a) port forward a port on your firewall to the desired machine b) port forward your localhost through the firewall ad a) you will need _ssh -g -L...._ see _man ssh_ and man sshd especially section AUTHORIZED_KEYS FILE FORMAT on how to restrict the -g (global access) ad b) the better solution: login from the remote machine and forward a port from the remote machine (which is localhost for you) through the firewall to the desired VNC server. i.e. ssh -L12344:vnc_server:5900 firewall (this is for Unix/Linux but other clients are not much different.) then connect your viewer to _localhost:12345_ hope that helps, -- Andreas

1 0

Allow ICQ under SuSEfirewall2?
by Paul Elliott 19 Jan '02

19 Jan '02

I have a single system protected by SuSEfirewall2. I do not use personal firewall because I want to allow chrony to set the time, and for this I need access to offsite NTP servers. How do I allow use of ICQ? Thank you. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

11 10

Re: postfix suse 7.1
by Roman Drahtmueller 19 Jan '02

19 Jan '02

> > we have 5 suse 7.1 servers with postfix marked as open relay > > is there a new postfix problem ? Your email address is known from the support at SuSE. No, it's not a postfix problem, it's a configuration error. > > bye > Ernesto > Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

1 0

Small home network and SuSEfirewall 2
by Stefan Fricke 18 Jan '02

18 Jan '02

I have a small network of three computers at home. All of them are running under SuSE Linux 7.3. I call them A, B and C. A has a permenent connection to the internet with an IP, B and C have private IPs which are masqueraded. On A SuSE firewall 2 is running, right now all connections from outside are blocked, all connections from inside to the internet are open. Now I want to do the following: 1. An SSH connection from outside should be forwarded to B. That means, Users who have an account on B should be able to login from outside (SSH only, no Telnet or RLogin) without getting an account on A. 2. B should work as SMPT server. A connect on port 25 from outside should be forwarded to B so that the SMTP server on B responds and handles the mail. 3. Users on B and C should be able to use all functions of LICQ. 4. Users of B and C should be able to use these computers as X terminal to run X-Window-Software on distant servers. How do I do that? Stefan

1 0

logging users in suse
by Mike Garabedian 18 Jan '02

18 Jan '02

How can I keep a log of users accessing the system. I would like to keep a log of specific users and the times and possibly the commands that they might access during a logon. Please let me know if ou have any ideas. Mikey

3 2

I have been hacked: who to contact
by g x 18 Jan '02

18 Jan '02

Dear Admins Our server has been hacked a few weeks ago (sshd 1.2.27 crc32 compensation attack/rootkit installed/visa- and mastercard scanned/irc relay installed/own sshd installed/ssh attack from tw/irc and logins from ro/lan sniffer installed/collected data sent to yahoo mail address). As we are located in Switzerland, we do not have FBI or CIA to handle this. Who should I contact: police, CERT(a)switch.ch, federal bureau of computer crime (if it exist?) How do you handle hacker attacks: after cleaning your computers you fall back into normal operation or do you have the gouvernment/big boss/... informed? How should I react on this attack? I hope somebody has already made some experience with swiss laws. Yours Andreas (genesis_xix(a)yahoo.com) __________________________________________________ Do You Yahoo!? Send FREE video emails in Yahoo! Mail! http://promo.yahoo.com/videomail/

3 2

Re: [SLE] recover from bad chown?
by Nadeem Hasan 18 Jan '02

18 Jan '02

Christopher Mahmood wrote: > > A good example of why / should be on a separate filesystem from > /var, /home, and /tmp and mounted readonly. If you don't want to do > that, at least chattr +i if using ext2 or chmod -w if using > reiserfs. How would this help when he used -R option with chown? It would still recurse down the whole tree. Only the files in the root filesystem would be protected. Am I missing something? Cheers, -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

1 0

Re: [suse-security] SuSEFirewall2, FreeS/WAN and VPN
by Argentium G. Tiger 18 Jan '02

18 Jan '02

Nadeem Hasan writes: >I have since been successful in getting the setup running >with SuSEFirewall2, FreeS/WAN and SSH Sentinel using X.509 >certificates. I am currently in the process of writing this >whole thing into a nice document. Wait for a couple of days :) Many thanks... I'm looking forward to seeing how you got it working. I need to keep looking at any and all options, because this _has_ to be working by Monday morning. Failure means I'm holding up an entire office from moving from one location to another, and that's the holdup I'd really rather not continue to be the cause of. So, further to that need, here's a bit more information given what I've learned since yesterday (and many thanks to participants in this mailing list, the fact that people are offering suggestions is _very_ much appreciated. I don't feel quite so alone trying to tackle this giant.) I've set up SSH (SSH-1.9.9-OpenSSH_2.9.9p2) with public keys such that the machines can log into each other without any trouble. I used ipsec rsakeysig to generate keys sufficient for my security needs, and I've set up my ipsec.conf and ipsec.secrets files accordingly. On the side where the firewall is actually active, I'm getting the error that I documented last message: ipsec_setup: Starting FreeS/WAN IPsec 1.91...WARNING: ipsec0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = '1', should be 0) ipsec_setup: WARNING: eth0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/eth0/rp_filter = '1', should be 0) I'm assuming this problem will dog me on both sides when I activate the firewall/IPSEC machine on the inside of the CiscoPIX firewall on the 10.100.0.0/24 network. And now to Markus' message: > You must disable IP spoofing protection for ipsec to work properly. > > Something like that should do the job: > echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter > echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter But where does that go, and when should they be executed? I tried putting those in the /etc/rc.config.d/firewall2-custom.rc.config file in the fw_custom_before_denyall() section at the end, and enabling the customized command script in /etc/rc.config.d/firewall2.rc.config in section 25: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" With IPSEC not running, I activated the Firewall final portion: /etc/init.d/SuSEfirewall2_final start I get this error message: /sbin/SuSEfirewall2: /proc/sys/net/ipv4/conf/ipsec0/rp_filter: No such file or directory Okay... So ipsec0 doesn't exist without ipsec loaded. That makes sense. So I reactivate ipsec: /etc/init.d/ipsec start It comes back with: ipsec_setup: Starting FreeS/WAN IPsec 1.91...WARNING: ipsec0 has route filtering turned on, KLIPS may not work. ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = '1', should be 0) ipsec_setup: Okay, we're down to one error... Do I need to re-run the firewall final portion of the script *again*? From my perception, I have a chicken and the egg problem here. :-( Which comes first? Argentium

2 4

monitor iptables user
by Matthias Krauss 18 Jan '02

18 Jan '02

Hi folks i set my new iptables firewall active in my office, there are ~~ 70 users behind. Is there any way to track/monitor single users by activity ? Thanks Matthias

1 0

Multicast-Müll aus den logs 'rausbringen
by Alexander Topolanek 18 Jan '02

18 Jan '02

Hallo, mein Provider schickt mir jede Minute Multicast-Pakete, die mir die Messages zumüllen: -- Jan 18 00:04:47 rohrpostfix kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= S RC=195.3.94.57 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=7983 PROTO=2 -- Ich verwende die SuSE-FW2, und brauche jetzt noch eine iptable-regel, die mir die Pakete still verwirft. Ich habs mit "iptables -A INPUT -i ippp0 -d 224.0.0.1/24 -j ACCEPT" versucht, das hat aber nicht so geklappt... wo habe ich den Denkfehler gemacht? danke Alexander

2 1

Request
by Dan Banyard 18 Jan '02

18 Jan '02

Hi, I have signed up to the security list under: dan(a)edentify.com.au dan(a)www.edentify.com.au Could you please unsubscribe me from dan(a)edentify.com.au Thanks Dan

2 1

Re: [suse-security] SuSEFirewall2, FreeS/WAN and VPN
by Argentium G. Tiger 18 Jan '02

18 Jan '02

Kai writes: >what's about the kernel parameter rp_filter?! There is for each network >device a dir in /proc/sys/net/ipv4/conf/ ! Yes, I see those settings there... >And for IPSec it must be set to "0" (the default value, I think)!! Yes, before the SuSEfirewall2 script runs, these are 0. >The >/sbin/SuSEfirewall2 script look at start time for ipsec devices (in v2.0 -> >less +522 /sbin/SuSEfirewall2), but is there no IPSec device present the >rp_filter parmeter ist set to "1"! >May you want to set them all to "0": >for i in /proc/sys/net/ipv4/conf/* ; do { echo "1" > $i/rp_filter ; } done ; Okay, but: When? >If that dosen't help you can switch off the kernel security at #17 in >/etc/rc.config.d/firewall2.rc.config. I checked, it's already off. I left it off until I got a working config, which I don't appear to have yet. I'm trying to give myself the best chance for success. :-) >A litte bug on the /sbin/SuSEfirewall2 script is that the changes on the >kernel parameteres are a one-way-ticket! Once set the script didn't roll it >back to the original values if you stop/refresh/reload the firewall, so the >only way I see is to reboot the machine (or roll back the values by hand ;-) Thank you, I didn't know that! >btw. works IPSec correctly if you didn't start the firewall?! On one end, I'm already behind a CISCO PIX firewall, so I have the luxury of not running the firewall. On the other end, I'm wide open to the world, and I'm not willing to shut the firewall down. That strikes me as downright dangerous. >PS remember: you CAN'T ping from one IPSec router to the other!!! You must >use other IPs than the route IPs a source / target IPs for ping tests: >http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/faq.html#cantping A good reminder, thank you. >PSS Very important (the real trick): >http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/faq.html#masq.faq Thanks... though with SuSEfirewall2 in play, I'm not sure how to issue manual commands with IPTables and not screw up what SuSEfirewall2 has done for me. The prospect of manually creating firewall scripts is not a pretty one. I have a bunch of port forwarding going on. :-( >Have a nice day.... I'll try, thanks.

1 0

Re: [suse-security] Firewall setup
by Michael Appeldorn 18 Jan '02

18 Jan '02

>I think there is something wrong with the spacing in >FW_TRUSTED_NETS="192.150.180.137" "192.150.180.138" "192.150.180.139" "192.150.180.140" >Can someone help me. Simple, use FW_TRUSTED_NETS="192.150.180.137 192.150.180.138 192.150.180.139 192.150.180.140" instead nice weekend :O)_ Michael Appeldorn

1 0

Firewall setup
by Marios Marti 18 Jan '02

18 Jan '02

Dear all I have a suse 7.1 proffesional running as a server, kernel 2.2.18, jakarta-tomcat as serving html pages (port 8080), postgres (port 5432) and ssh (22). i am trying to setup the firewall but i dont seem to be able to figure it out. What i want to do is deny all packets coming to the system except, allow all for the website, and allow ssh access only from specified ip addresses. I enclose the part of the configuration responsible for that part and i would like to know where i am doing wrong. # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # FW_SERVICES_EXTERNAL_TCP="22 8080" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="" # Common: domain FW_SERVICES_EXTERNAL_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_DMZ_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_INTERNAL_TCP="22 25" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain syslog FW_SERVICES_INTERNAL_IP="" # For VPN/Routing which END at the firewall!! # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="192.150.180.137" "192.150.180.138" "192.150.180.139" "192.150.180.140" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # FW_SERVICES_TRUSTED_TCP="ssh" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp FW_SERVICES_TRUSTED_IP="" # For VPN/Routing which END at the firewall!! I think there is something wrong with the spacing in FW_TRUSTED_NETS="192.150.180.137" "192.150.180.138" "192.150.180.139" "192.150.180.140" Can someone help me. Thanks Marios

2 1

status of SuSE version of pine
by Bob Vickers 18 Jan '02

18 Jan '02

Hello, I'm almost sure that somewhere in the sea of information I wade through every day was a statement that SuSE pine is not vulnerable to the recently discussed problem with following maliciously-crafted URLs. But I've searched the archives and I can't find it; could some kind soul put me at ease by confirming that SuSE pine is not vulnerable to this attack? The version I am running is 4.33-42 on SuSE 7.2. Thanks, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

2 1

Server shut down by hacker ?? --> solution
by gerol＠web.de 18 Jan '02

18 Jan '02

Hi, for all interested people here : i wanted to inform you that my problems were caused by a broken mainboard. I put an identic one in and everything was fine. So, i didn't mess up with my system services and programs...as some wrote :-) so , if anyone has similar probs, IT COULD BE THE MAINBOARD. period. full stop (aso) ;o))) bye ;o) Gero ________________________________________________________________ Keine verlorenen Lotto-Quittungen, keine vergessenen Gewinne mehr! Beim WEB.DE Lottoservice: http://tippen2.web.de/?x=13

1 0

AW: [suse-security] Multicast packets fill up my log files
by Peer Stefan 18 Jan '02

18 Jan '02

Hi, have a look at /etc/rc.config.d/firewall2.rc.config. Section 16 deals with logging: FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" You can safely change the FW_LOG_DROP_CRIT="yes" to FW_LOG_DROP_CRIT="no", once you are sure your firewall rules work the way they should. regards, Stefan -----Ursprüngliche Nachricht----- Von: Alexander Topolanek [mailto:atopo@ocv.org] Gesendet: Freitag, 18. Jänner 2002 07:01 An: suse-security(a)suse.com Betreff: [suse-security] Multicast packets fill up my log files Hi, (and now in english :) My provider sends me multicast packets every minutes, that are denied by the SuSE-FW2 rules, and logged: -- Jan 18 00:04:47 rohrpostfix kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= S RC=195.3.94.57 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=7983 PROTO=2 -- I would need and iptable rule that discards those packets silently. I tried "iptables -A INPUT -i ippp0 -d 224.0.0.1/24 -j ACCEPT" without success, has anyone an idea where I went wrong? thanks Alexander -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

AW: [suse-security] Production app or web server firewall set-up - questions
by Peer Stefan 18 Jan '02

18 Jan '02

Question is, how paranoid are you? My suggestion is to use a firewall and put the webserver in a DMZ. Shut down all services you don't need. Allow the services needed in /etc/hosts.allow and permit everything else in /etc/hosts.deny. Allow ssh from dedicated hosts only. Don't allow mail, instead redirect it to the mail server and deal with it there. Ad iptables: are you using a firewall or do you build your rules for yourself? I'd suggest using SuSEfirewall2-2.1, which is very easy to configure. (FW_SERVICES_EXT="http 443" and FW_TRUSTED_NETS="<trusted_host_ip>,tcp,ssh") If you want to secure apache, you can use squid to act as transparent proxy. Redirect all http-stuff to squid, enable squidgard and block/redirect all requests, which looks a bit suspicous (e.g. "GET HTTP/1.0 /cgi-bin/root.exe" et al) Most important thing: keep your system up to date and an eye on the logfiles. regards, Stefan -----Ursprüngliche Nachricht----- Von: Steven Thompson [mailto:steven@bidorbuy.co.za] Gesendet: Freitag, 18. Jänner 2002 10:20 An: SuSE security mailing list (E-mail) Betreff: [suse-security] Production app or web server firewall set-up - questions Hi All In a production environment what is the recommend security settings with performance in mind and only services that I will be providing is http, https, ssh2 - scp, smtp. (i.e. secure , but with as little overhead) Kernel 2.4.x and using iptables , postfix, stronghold apache. Q.1 What services can hosts.deny & hosts.allow secure? (mainly in regards to the services that I'm using above) Q.2 Should I use stateful connection tracking on all ports or only the ssh,smtp and https ports? What is the stateful connection overhead like. Q3. What ICMP should you block and what must you answer directly or indirectly, so that you don't break other services or slow them down. Q4. What is recommend minimum ports and protocol that I must log, so that I can audit attacks , problems and keep logging overhead to a minimum. Given that our ISP environment has a lot of broadcast traffic. e.g. Q5. What DOS of protection options are there with iptables and how do you workout the rate to limit @. I have syncookie protection enabled. Q6. Is it still recommend to Reject mail server connections to port 113. Is the following setting correct: iptables -A INPUT -i eth1 -p tcp --dport 113 -j REJECT --reject-with tcp-reset Thanks in Advance Steven -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0