January 2002 - openSUSE Security - openSUSE Mailing Lists

yast2 updates security related
by Roger Larsson 31 Jan '02

31 Jan '02

Hi, I occasionally check for updates this time there were several. Some for things that I have installed - but those were NOT autoselected... package installed new ---------- --------- ----- openssh 2.9p2-39 2.9.9p2-73 really suspect glibc/-devel 2.2.4-21 2.2-17 backed?? java2 1.3.1-47 1.3-69 really suspect timezone 2.2.4-21 2.2-17 backed?? xli 1.16-385 1.16-351 backed?? at 3.1.8-382 3.1.8-458 was correctly selected I am updating via ftp.gwdg.de /RogerL -- Roger Larsson Skellefteå Sweden

2 1

Concerned about possible crack, ssh warning message
by JW 31 Jan '02

31 Jan '02

Ok, there's the thing. Take everything from here down with a large grain of salt because right now I'm paranoid and apt to jump to conclusions hastily. I have a few test servers that we use for all kinds of misc. hacking and testing. I was just looking at one and noticed some things I'm not happy with that make me conclude this box is at least _possibly_ cracked. However, remember we use this as a do-anything-to-it-it-doesn't-matter test box - unstable software and the works, it's a throw-away-install on our LAN. Because of this I can't be sure one of the other guys that have root haven't done the things I'm eying suspiciously Anyway I'm currently alarmed because the box I'm eyeing is testbox2, and I just tried to ssh from testbox1 to testbox2 and got the following message: jw@suse1:~ > ssh jw@suse2 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that the RSA1 host key has just been changed. The fingerprint for the RSA1 key sent by the remote host is 73:40:ed:40:fd:65:0a:bb:77:a9:2f:f7:9a:2e:54:62. Please contact your system administrator. Add correct host key in /home/jw/.ssh/known_hosts to get rid of this message. Offending key in /home/jw/.ssh/known_hosts:5 RSA1 host key for emerald has changed and you have requested strict checking. jw@suse1:~ > The last time I ssh'd from 1 to 2 was about 5 hours ago and I received no such message. box2 has _not_ been rebooted, I know because my VNC session was running with my apps open just the way I set them up. I really, really doubt any of the other admins restarted sshd, but *maybe*. Also, I've seen messages in /var/log/* before about ssh regenerating the key but there are none today. What do you think? ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

3 2

SuSEFirewall2 redirect question
by Robert Rottscholl 31 Jan '02

31 Jan '02

Dear List, do I have to add Port 80 to FW_SERVICES_INT_TCP if I've already configured FW_REDIRECT="IP_INT_NET,IP_SERVER,80,3128"? Ciao ;-) Robert Rottscholl - DE

1 0

Re: [suse-security] Concerned about possible crack, ssh warning message
by JW 31 Jan '02

31 Jan '02

At 11:34 PM 1/30/2002 -0600, you wrote: >Ok, there's the thing. Take everything from here down with a large grain of salt because right now I'm paranoid and apt to jump to conclusions hastily. Ok, I'm really sorry about this post last night, it was totally unnecessary. The weird things I mentioned (like the new shell account) were indeed the actions of another "admin". And the ssh warning I mentioned.... I have to even admit this, but I accidently type the host name of a 3rd un-related box instead of the other one I was messing with. The warning scared me since I was already paranoid and I didn't even realize what I'd done until I scrolled back up my console. Duh. So nothing's wrong. Sorry to cause trouble - I was really tired, somewhat alarmed and not thinking too clearly when I sent that in. I guess that's what I get for working @ 01:00 in the morning.... Sorry to waste ya'lls time....... ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

1 0

Re: Re: [suse-security] proxy server
by Dimitri Melnikowitsch 31 Jan '02

31 Jan '02

Hi Robert, Robert Rottscholl <lv426(a)rinx.de> schrieb am 31.01.02: > Hi Dimitri, > > i think you should use different proxy for example: yes, was not going to use circuit-gateway-proxies or would it be a better method ? > HTTP : squid > FTP : proxy-suite i thought the same > SMTP : use a stor and forward proxy i thought of smtpd ? Thanks Dimitri Melnikowitsch ________________________________________________________________ Keine verlorenen Lotto-Quittungen, keine vergessenen Gewinne mehr! Beim WEB.DE Lottoservice: http://tippen2.web.de/?x=13

2 1

Re: [suse-security] SuSE-Firewall Question
by Robert Rottscholl 31 Jan '02

31 Jan '02

Hi Marc, thanks a lot. Is 2.1 the current release? And if yes, where can i find it?(I use 1.7) Ciao ;-) Robert Marc Mutsaers wrote: >Download SuSEfirewall2 (2.1) from the SuSE FTP site or 7.3 CD-ROM's > >SuSEfirewall (5.1) is only compatible with ipchains. > >Gtx, > >Marc > >-----Original Message----- >From: Robert Rottscholl [mailto:lv426@rinx.de] >Sent: donderdag 31 januari 2002 17:48 >To: suse-security(a)suse.com >Subject: [suse-security] SuSE-Firewall Question > > >Dear List, > >does SuSE-Firewall support iptables? >My problem is that I designed a firewall myself and I now want to change >to SuSEFirewall because I think I'm not perfect in designing a firewall. > >Ciao ;-) > >Robert Rottscholl - DE > >

3 2

firewall2: routing between DMZ and INT
by Andreas Marbet 31 Jan '02

31 Jan '02

Hello all, SuSE firewall2 on SuSE 7.3 with external, internal and DMZ-interface EXT: statical (official) IP-Address (a.b.c.d) DMZ: statical (official) IP-Address (w.x.y.z) with the appropriate subnet attached to it INT: 192.168.1.1 (masqueraded on DEV_EXT) Almost everything is working: routing between the subnets as far as allowed in FW_FORWARD and FW_FORWARD_MASQ is working properly (almost too good) masquerading is working as well as squid in transparent mode now I have two problems with using the rules for the DMZ: I'd like to allow the machines in the DMZ unrestricted access (for beginning) to the internet (in front of EXT). For that reason I put the following rules in FW_FORWARD: "DMZ-net,0/0 0/0,DMZ-net" #DMZ-net is of course written as w.x.y.0/24 well, everything works now for the DMZ, but the DMZ can also reach the internal hosts (192.168.1.0/24) directly and thats absolutely not what I want. Does anybody know how I could prevent this? the second problem is that I'd like to access the DMZ from the internal network but without allowing the DMZ to connect to the internal LAN. How can I tell the firewall to allow only connections from the DMZ to the INT that have been initiated from internal? In the DMZ all internal machines appear with their proper IPs (e.g. 192.168.1.50). Is this a question of FW_MASQ_DEV? probably the two problems are of the same kind and perhaps I could do this in firewall2-custom.rc.config? But because I'm rather a beginner, I don't want to do something very stupid that would open my firewall. If anybody has any advice or experience on this topic, please let me know. any help very welcome, Andreas slightly censored firewall2.rc.config: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/16" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="domain ssh 3128" FW_SERVICES_DMZ_UDP="domain" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh domain 3128" FW_SERVICES_INT_UDP="domain" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="192.168.1.0/24,DMZ" FW_FORWARD_MASQ="" FW_REDIRECT="192.168.100.0/24,0/0,tcp,80,3128" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no"

1 0

SuSE-Firewall Question
by Robert Rottscholl 31 Jan '02

31 Jan '02

Dear List, does SuSE-Firewall support iptables? My problem is that I designed a firewall myself and I now want to change to SuSEFirewall because I think I'm not perfect in designing a firewall. Ciao ;-) Robert Rottscholl - DE

2 1

proxy server
by Dimitri Melnikowitsch 31 Jan '02

31 Jan '02

Hi folks, im going to set up an proxyserver for HTTP/FTP/SMTP/POP3 and maybe ssh(i don't know how, yet) in my mind the network construction is looking like this: $I-Net$ <---> $Outdoor router$ <---> $proxy/fw$ <---> $web-server/smtp$ Some words towards the "grafic": I'm going to proxy the services for the internet users. The proxy is not a router. I think it might be more securer than a firewall. May be you have some idea which proxy server will be the best choice? I request comments for this idea. Wich advantage and disadvantage brings this method with it ? thanks Dimitri Melnikowitsch _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de _______________________________________________________________________ Das WEB.DE Zertifikat zur Pruefung digitaler Unterschriften gibts bei: http://trust.web.de/root.sql

2 1

SuSE-FW-OUTPUT-ERRORIN log
by mario libraro 31 Jan '02

31 Jan '02

Hi to all listmates, I found these lines in /var/log/messages: Jan 31 11:51:20 goemon kernel: SuSE-FW-OUTPUT-ERRORIN= OUT=eth0 SRC=<my ip!> DST=<external ip 1> LEN=60 TOS=0x00 PREC=0x00 TTL=46 ID=19546 PROTO=TCP SPT=45274 DPT=21 WINDOW=3072 RES=0x00 URGP=0 OPT (03030A0102040109080A3F3F3F3F000000000000) Jan 31 12:01:53 goemon kernel: SuSE-FW-OUTPUT-ERRORIN= OUT=eth0 SRC=<my ip!> DST=<external ip 2> LEN=60 TOS=0x00 PREC=0x00 TTL=43 ID=49052 PROTO=TCP SPT=54417 DPT=139 WINDOW=4096 RES=0x00 URGP=0 OPT (03030A0102040109080A3F3F3F3F000000000000) <external ip 1> and <external ip 2> are from the same subnet but are different. Is this a spoofing attack or what? -- Mario Libraro Web Applications Developer Fulltrading S.p.A. 00148 Roma - Via Di Affogalasino, 105 tel. +39 06 65 73 170 fax +39 06 65 73 529 mob. +39 347 5205 752 email: m.libraro(a)fulltrading.it m.libraro(a)tiresia.it web: www.fulltrading.it -- "I worry about my child and the Internet all the time, even though she's too young to have logged on yet. I worry that 10 or 15 years from now, she will come to me and say 'Daddy, where were you when they took freedom of the press away from the Internet?'" Mike Godwin, Electronic Frontier Foundation

3 2