January 2002 - openSUSE Security - openSUSE Mailing Lists

non-working mail-funktion
by Daniel Quappe 02 Jan '02

02 Jan '02

hi list, the last days i configured a firewall-machine with a stripped-down suse 7.2 (all patches installed). i am using SuSEfirewall2 etc. and have installed postfix for dependency-reasons, but stopped it. as far as i know i can use the command "mail ..." for mailing to other hosts without running postfix. but i have got problems with the seccheck-info-mails because no mail has ever been delivered. do i have to start the mail-software to get the info- mails by secceck or other processes? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

[suse-security] WAS Help: Port Forwarding using SuSEfirewall2
by Luke Loh 02 Jan '02

02 Jan '02

Problem solved with much thanks to Nadeem Hassan. Wasn't a port forwarding problem - it's just that FW_MASQ_NETS needs to be set to allow the DNS server in the DMZ to be able to talk to all port numbers or the firewall will drop all return packets to the external queryer. Luke -----Original Message----- From: nhasan(a)nadmm.com [mailto:nhasan@nadmm.com] Sent: Wednesday, January 02, 2002 1:12 PM To: Luke Loh Subject: Re: [suse-security] Help: Port Forwarding using SuSEfirewall2 Good. I guess you wanna post the whole thread to the list too. Someone else may need this in the future :) Luke Loh wrote: > > Nadeem > > Thank you for your help:) Yes, the firewall was dropping the reply packets - > I had to explicitly set FW_MASQ_NETS to allow my DNS server to connect to > high port numbers in order for the replies to go through:) > > Wish I'd thought of this first before assuming it was a pfw problem. Argh. > > Again, many thanks. > > Luke > > -----Original Message----- > From: nhasan(a)nadmm.com [mailto:nhasan@nadmm.com] > Sent: Wednesday, January 02, 2002 11:36 AM > To: Luke Loh > Subject: Re: [suse-security] Help: Port Forwarding using SuSEfirewall2 > > Luke Loh wrote: > > > > Nadeem > > > > Thanks for replying. Yes, I'm using the external IP address of my firewall > > as my DNS IP address. Doesn't seem to work. I assume then that this line > is > > correct? > > > > FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,53 0/0,192.168.1.2,udp,53" > > That line looks correct to me. > > > > > I don't get much in error logs, all I know is that when I try to do an > > nslookup using my firewall's external IP address as my server (I use a > > seperate dial-up to test external-to-internal connectivity) I get a > timeout. > > Looks like a firewall issue. Your firewall seems to be dropping the > reply packets. Try running tcpdump on both the EXT and DMZ interfaces > to look at whats going through. > > Try in one session (for EXT): > > # tcpdump -i eth2 host your-dialup-ip > > and in onother session (for DMZ): > > # tcpdimp -i eth1 host your-dialup-ip > > and then try to run nslookup like before. You should now see what is going > on :) > > > > > What I did try was to telnet to port 53 to see if it would forward the > > packet. > > > > From /var/log/firewall: > > > > Jan 2 10:29:48 zeus kernel: SuSE-FW-ACCEPT-REVERSE_MASQIN=eth2 OUT=eth1 > > SRC=211 > > .28.77.195 DST=192.168.1.2 LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=1075 DF > > PROTO=TC > > P SPT=3467 DPT=53 WINDOW=8760 RES=0x00 SYN URGP=0 OPT (020405B401010402) > > > > Does this mean that portforwarding *has* worked and the problem might lie > > with my DNS server? Which is odd, because it works fine internally, and > once > > it's pfwed it's already a private ip address ... > > > > Thanks again. > > > > Luke > > -- > Nadeem Hasan > nhasan(a)nadmm.com > http://www.nadmm.com/ -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

1 0

Help: Port Forwarding using SuSEfirewall2
by Luke Loh 01 Jan '02

01 Jan '02

My apologies if this is not the right place to ask for help with regards to SuSEfirewall2, in which case please point me in the right direction. I'm running an out-of-box install of SuSE 7.3, kernel 2.4.10 and using Marc Heuse's SuSEfirewall2 script. I've gone through the examples and readme and everything works fine except for port forwarding. My scenario: Internet ------ Firewall ------- LAN | DMZ I'm running a DNS server on a private ip address in my DMZ and I need the firewall to automatically forward all requests to tcp + udp 53 to my DNS server, which is 192.168.1.2. I've set up the following in firewall.rc.config: FW_FORWARD_MASQ="0/0,192.168.1.2,tcp,53 0/0,192.168.1.2,udp,53" FW_SERVICE_DNS="yes" FW_SERVICES_EXT_TCP="53" <---- curious, are these necessary? I assume so because if port 53 isn't open the firewall will drop the packet before port forwarding FW_SERVICES_EXT_UDP="53" I don't think it is a BIND9 problem because I can successfully contact and resolve names from both my DMZ and my LAN (using the private IP address). I just can't get the internet to see my DNS server. Also, do I need to have inetd running at all? Luke Loh Network Engineer Nicholls Price Pty Ltd Ph : 61 2 9222 9155 Fx : 61 2 9222 9166 www.nph.com.au Level 1, 70 Pitt Street Sydney NSW 2000

2 1

updated class A's not in use
by Kurt Seifried 01 Jan '02

01 Jan '02

68.0.0.0 is now in use and I am seeing activity from it, looks like Cox got 68.0-68.15, with more assignments to others expected. I am compiling a list of active class B's and C's (essentially, has anyone from them talked to me, or can I talk to anyone on them). Anyone interested in helping should contact me (essentially sanitized www/email logs containings hostnames/IP's that have connected to you are what I am looking for). 0.0.0.0/255.0.0.0 1.0.0.0/255.0.0.0 2.0.0.0/255.0.0.0 5.0.0.0/255.0.0.0 7.0.0.0/255.0.0.0 10.0.0.0/255.0.0.0 23.0.0.0/255.0.0.0 27.0.0.0/255.0.0.0 31.0.0.0/255.0.0.0 36.0.0.0/254.0.0.0 39.0.0.0/255.0.0.0 41.0.0.0/255.0.0.0 42.0.0.0/255.0.0.0 58.0.0.0/254.0.0.0 60.0.0.0/255.0.0.0 69.0.0.0/255.0.0.0 70.0.0.0/254.0.0.0 72.0.0.0/248.0.0.0 82.0.0.0/254.0.0.0 84.0.0.0/252.0.0.0 88.0.0.0/248.0.0.0 96.0.0.0/224.0.0.0 197.0.0.0/255.0.0.0 219.0.0.0/255.0.0.0 220.0.0.0/252.0.0.0 224.0.0.0/224.0.0.0 Kurt Seifried, kurt(a)seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://www.seifried.org/security/

1 0