October 2002 - openSUSE Security - openSUSE Mailing Lists

No access to Apache behind SuSEfirewall2
by Dr. Peter Bast 09 Oct '02

09 Oct '02

Hi, I have a small network with a Linux-Server (SuSE 8.0) with SuSEfirewall2. The server has a internal Interface eth0 (ip = 192.168.12.80) and an external interface eth1 (ip = 192.168.0.3). eth1 is connected to a Hadrwarerouter with a LAN-interface (ip = 192.168.0.2) and a WAN-Interface for a dynamic IP-adress. All clients from the internal net can acces to the Internet via squid-proxy on the Linux-Server. But wenn I try to access the Apache webserver on my Linuy-Server from the Internet I get the following log-messages: ....kernel: SUSE-FW-UNAUTHORIZED-TARGED IN=eth1 OUT=MAC=...... SRC='dynamic IP' DST=192.168.12.80 ....... SuSEfirewall2 is configured as following: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="21 53 http https pop3 pop3s smtp telnet" FW_SERVICES_EXT_UDP="53" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="25 53 80 110 137 3128" FW_SERVICES_INT_UDP="53 137" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" I hope every body can help me Thanks Peter ______________________________________ Inflex - installed on mailserver for domain @inis.inf Queries to: postmaster(a)inis.inf

3 2

AW: [suse-security] No access to Apache behind SuSEfirewall2
by V. Lieder 09 Oct '02

09 Oct '02

>>cut eth1 > is connected to a Hadrwarerouter with a LAN-interface (ip = > 192.168.0.2) > and a WAN-Interface for a dynamic IP-adress. All clients from the > internal net can acces to the Internet via squid-proxy on the > Linux-Server. But wenn I try to access the Apache webserver on my > Linuy-Server from the Internet I get the following log-messages: > > ....kernel: SUSE-FW-UNAUTHORIZED-TARGED IN=eth1 OUT=MAC=...... > SRC='dynamic IP' DST=192.168.12.80 ....... > > SuSEfirewall2 is configured as following: > Hi, perhaps it isn´t a problem of your linux-server. Is it possible taht there is also a firewall in the hardware-router?

3 2

RE: [suse-security] harden_suse on 8.1
by mailinglists＠belfin.ch 09 Oct '02

09 Oct '02

Hi yes, this is a suse linux. rc.config was already nearly empty in suse 8.0. try chkconfig in /sbin/ HTH Philipp > -----Original Message----- > From: Thomas Kerkau [mailto:thomas.kerkau@io-software.com] > Sent: Wednesday, October 09, 2002 4:19 PM > To: SuSE-Security > Subject: [suse-security] harden_suse on 8.1 > > > Hi All, > > yust installed SuSE Linux 8.1 and the harden_suse script. The script > terminates with: > > /etc/rc.config doesn't exist! Is this really a SuSE Linux? > > Not really surprising but will SuSE provide an update or is > harden_suse > no longer usefull?? > > Greetings, Thomas > > > > ----- < iO > --------------------------------------------------------- > Interactive Objects Software GmbH > mailto:Thomas.Kerkau@io-software.com > http://www.io-software.com > Basler Strasse 65, D-79100 Freiburg, Germany > Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 > ---------------------------------------------------------------------- > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

IPSEC aware version of SuSEfirewall2
by wilm＠tas.nl 09 Oct '02

09 Oct '02

Hi, I'm having some troubles trying to configure a site-to-site VPN connection using SuSe 8.0, FreeS/WAN and SuSEfirewall2. The IPSEC tunnel is working fine but as soon as I start the firewallscript things go wrong. In september i read something about extra rules in the latest version of firewall2 (http://lists.suse.com/archive/suse-security/2002-Sep/0164.html) But after downloading the archive I found no snip ---- # 19.) # Say yes, if you use IPSEC # Defaults to "no" # FW_IPSEC="yes" # # 20.) # IPSEC device # FW_DEV_IPSEC="ipsec0" # 21.) # local/remote network # masquerading is disabled through the tunnel automatically, # if you enabled it above # FW_IPSEC_LOCALNET="192.168.1.0/24" FW_IPSEC_REMOTENET="192.168.2.0/24" ---- snap In the config files......... :-( Can anyone tell me where this IPSEC aware version of SuSEfirewall2 is hidden ???? Thanks *************************************************** Wilm v Welbergen *************************************************** Only Robinson Crusoë had everything done by Friday... ***************************************************

1 0

harden_suse on 8.1
by Thomas Kerkau 09 Oct '02

09 Oct '02

Hi All, yust installed SuSE Linux 8.1 and the harden_suse script. The script terminates with: /etc/rc.config doesn't exist! Is this really a SuSE Linux? Not really surprising but will SuSE provide an update or is harden_suse no longer usefull?? Greetings, Thomas ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0

Security announcements on web page
by Frank Steiner 09 Oct '02

09 Oct '02

Hi, I saw all the glibc/postgres announcements on the SuSE web page with date October 1st, but it hasn't made it to the announce list yet. What does that mean? Is it safe to assume the linked files from the web page are stable, or could sth. change before we get an announcement mail? If not, why isn't the mail sent when the announcements appear on the web page? (Please note that this is not meant as an accusation, I'm just asking to know how to judge web/mail announcements...) Best regards, Frank -- Dipl.-Inform. Frank Steiner mailto:fst@informatik.uni-kiel.de Lehrstuhl f. Programmiersprachen mailto:fsteiner@web.de CAU Kiel, Olshausenstraße 40 Phone: +49 431 880-7265, Fax: -7613 D-24098 Kiel, Germany http://www.informatik.uni-kiel.de/~fst/

3 6

RE: [suse-security] Hide/Change MTA Mailheader
by Reckhard, Tobias 09 Oct '02

09 Oct '02

Ben, gang, I've been keeping my head down in my little foxhole, waiting for the artillery bombardment to stop. Now it seems the thread is ready to die and most of the participants' gasoline tanks are empty. ;-) Good. Here's my view of what happened. Some newbie (no judgement meant in that term) asked a question which struck me as very basic for a security mailing list. I don't know about the rest of you, but back when I got involved in UseNet and mailing lists it was expected of new group members to read the charter and, if available, the FAQ(s). People asking FAQs were flamed quite harshly in some groups, something I do *not* generally approve of. The nicer folks did answer the questions or pointed to sources of information, often criticising the newbie, this criticism ranging from very polite to mild flames. I think that's OK. They are helping the newbie and the group. Mild flames should be tolerable by grown-ups. Now, to this specific thread. This is my original mail: --- snip --- > is it possible to change the Mailer information in der > EMailheader from > Sendmail 8.xx to a other Name? Have you even *tried* Google? Check http://www.google.com/search?q=change+sendmail+banner&sourceid=opera&num=0&i e=utf-8&oe=utf-8, when I queried that just now, the fourth hit gives you exactly what you want.. Sheesh.. Tobias --- snip --- This struck me as a newbie question with a high probability of having been posted without prior consultation of Google. As it turns out, that was actually the case, as the newbie in question didn't know what to use as search terms. Fair enough, although if you look at the Google query I suppied, I used three terms, two of which occur in his question. I'll agree that the (missing) term 'banner' is very important in this context, though. However, I am not sure if he wouldn't have had success by using a couple of other terms. I think that people can generally be expected to make several attempts at googling and I also generally expect people to check out several pages of Google's answers. Others have already pointed out that I did answer his question, I even told him which hit to follow. That's almost as good as the link itself, but I wanted him to look at the Google page. I don't think that was inappropriate. This is your response, Ben: > ::>Wow! Your a rude bastard. I suppose you took offense because of the 'sheesh'. Apart from that, I don't see anything rude in my mail. In my book, that doesn't make me a bastard, though. Actually, in reference to what I say above, I'd call my mail something perhaps close to a mild flame. As it is, I do agree with the second sentence in the following snippet: > ::No, simply accurate and direct. Although one could consider calling > ::someone a "bastard" as rude. And I also think my mail was accurate and direct. The 'sheesh' can be understood as being rude. Allow me to: I sincerely apologise to the poster of the original question for this mistake on my behalf. I shouldn't have used that 'word'. > Well, sorry about that response but the attitude that was > displayed was > that of "OH MY God! You are so stupid that you couldn't figure out > Google!" "Why don't you RTFM before bringing your petty, very easy > questions to this list." I disagree with this, however. You are inventing things I did not say. I asked a very clear question. Yes, it was slightly provocative, but nowhere did I make any implications on the level of expertise or intelligence of the person I was answering. I didn't even use the acronym with the (offensive) F word. And I didn't say anything about the list and appropriate posts either. I didn't even call his question basic, come to think of it. > My question would be how does one tell the difference between lazy and > just a bit freaked out about the overwhelming nature of being > a newbie. Well, I usually judge them by the way they ask their questions. I expect people to explain what they've tried to do up to that point and that includes where they've searched for information. I expect them to show their willingness to not waste the time of the group members by exhibiting an attitude of wanting to help themselves to the extent of their abilities. > I guess my horrors in joining the club and learning these > things made me > give everyone the benefit of the doubt and not have a "Oh My how > simple..just do this." attitude. Oh, actually I myself have no idea how to change the greeting banner in sendmail, I use postfix. As for the benefit of doubt, I agree that that's a nice thing, but my idealism has worn off a bit over the last ten years.. I tend to trust my judgement. As you can see, I wasn't wrong here. Not to say I'm not wrong (perhaps more than) often enough.. > Sorry that my tired, cranky attitude at 1am got the better of > me. Let's call it that on both sides, OK. I was a bit miffed at your bastard comment, but I did see that my sheesh was uncalled for. That's why I decided to wait until things had quieted down a bit. I was probably in a state of mind similar to your's when I wrote that original answer. > It's just > that when I started with Linux and Unix a number of years ago and I > found it a bit overwhelming. Same here and I believe most of the list will be able to relate to this feeling. > Sometimes the simple route > eluded me and I > needed the help of people who knew more. I and most noone on the list has a problem with this. > The reply email was > condescending and > quite rude to the guy's question. It was condescending, I'll admit to that. However, I think that outbursts of temper every now and then can and should be condoned. I could take your bastard mail, I do expect a mature person to be able to handle my mail. As for its level of rudeness, that's highly subjective, of course. I consider it to be direct and more or less impolite. A little rude, perhaps. Not rude nor very rude, though. But that's just me, feel free to disagree. Any level of impoliteness on by behalf was uncalled for. > I should have just hit the > d key. I didn't > and I'm sorry. Actually, I didn't mind this flamewar all that much. I've witnessed much worse... I expect any UseNet veterans have. > I apologize. So do I. Cheers, everybody /me raises beer Tobias

1 0

FYI: trojaned sendmail source
by Sven 'Darkman' Michels 09 Oct '02

09 Oct '02

Just a note for those wo don't know already: http://www.cert.org/advisories/CA-2002-28.html have a nice day

1 0

connection Problems after upgrade to 8.1 form 8.0
by MichaelHoeller＠t-online.de 09 Oct '02

09 Oct '02

Hello Experts, my problem is about a ppp-chat connection which I manually to connect to a remote machine. The is a mgetty/callback running. I get the callback and establish a connection. That worked fine with version 8.0 but after the upgrade to 8.1 - it seems as if I get the connection but then I am blocked. I have added some statements which may help to show what happens. I am lost since I am a novice dealing with firewalls. And I only guess that it call be the firewall. Since the machines are uncritical, I can run tests without a firewall. How can I make sure that everything works, without a firewall? = How do I switch all this stuff down. I tried it but something seems to bolck me recieving data, though emailing works fine. Thanks a lot Michael tamboti:~ # ping 196.168.55.1 PING 196.168.55.1 (196.168.55.1) from 196.168.55.200 : 56(84) bytes of data. <CTRL-C> --- 196.168.55.1 ping statistics --- 15 packets transmitted, 0 received, 100% loss, time 14016ms tamboti:~ # ssh 196.168.55.1 <CTRL-C> tamboti:~ # SuSEfirewall2 stop Removing filter rules and disabling IP forwarding ... SuSEfirewall2: clearing rules now ... done tamboti:~ # ssh 196.168.55.1 <CTRL-C> tamboti:~ # /home/michael/tmp/peer-down PPP link to ppp0 terminated. tamboti:~ # SuSEfirewall2 status Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 7 packets, 461 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 7 packets, 461 bytes) pkts bytes target prot opt in out source destination Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 69 packets, 4951 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 69 packets, 4951 bytes) pkts bytes target prot opt in out source destination tamboti:~ # This is the log, from the connection: Connect: ppp0 <--> /dev/ttyS1 rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xf44b66d7> <pcomp> <accomp>] sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x93045a4e> <pcomp> <accomp>] sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xf44b66d7> <pcomp> <accomp>] rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x93045a4e> <pcomp> <accomp>] sent [LCP EchoReq id=0x0 magic=0x93045a4e] cbcp_lowerup want: 2 sent [IPCP ConfReq id=0x1 <addr 196.168.55.200> <compress VJ 0f 01>] sent [CCP ConfReq id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>] rcvd [LCP EchoReq id=0x0 magic=0xf44b66d7] sent [LCP EchoRep id=0x0 magic=0x93045a4e] rcvd [IPCP ConfReq id=0x1 <addr 192.168.55.1> <compress VJ 0f 01>] sent [IPCP ConfAck id=0x1 <addr 192.168.55.1> <compress VJ 0f 01>] rcvd [CCP ConfReq id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>] sent [CCP ConfAck id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>] rcvd [LCP EchoRep id=0x0 magic=0xf44b66d7] rcvd [IPCP ConfAck id=0x1 <addr 196.168.55.200> <compress VJ 0f 01>] local IP address 196.168.55.200 remote IP address 192.168.55.1 Script /etc/ppp/ip-up started (pid 11740) rcvd [CCP ConfAck id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>] Deflate (15) compression enabled rcvd [LCP EchoReq id=0x1 magic=0xf44b66d7] sent [LCP EchoRep id=0x1 magic=0x93045a4e] sent [LCP EchoReq id=0x1 magic=0x93045a4e] rcvd [LCP EchoRep id=0x1 magic=0xf44b66d7] Script /etc/ppp/ip-up finished (pid 11740), status = 0x0 rcvd [LCP EchoReq id=0x2 magic=0xf44b66d7] sent [LCP EchoRep id=0x2 magic=0x93045a4e] sent [LCP EchoReq id=0x2 magic=0x93045a4e] rcvd [LCP EchoRep id=0x2 magic=0xf44b66d7] rcvd [LCP EchoReq id=0x3 magic=0xf44b66d7] sent [LCP EchoRep id=0x3 magic=0x93045a4e] sent [LCP EchoReq id=0x3 magic=0x93045a4e] rcvd [LCP EchoRep id=0x3 magic=0xf44b66d7] Terminating on signal 2. cbcp_lowerdown Script /etc/ppp/ip-down started (pid 12033) sent [LCP TermReq id=0x2 "User request"] rcvd [LCP TermAck id=0x2] Connection terminated. Connect time 1.8 minutes. Sent 2867 bytes, received 62 bytes. Waiting for 1 child processes... script /etc/ppp/ip-down, pid 12033 Script /etc/ppp/ip-down finished (pid 12033), status = 0x0 michael@tamboti:~/tmp>

1 0

Hide/Change Mind
by Michael Zimmermann 08 Oct '02

08 Oct '02

At Dienstag, 8. Oktober 2002 11:42 Volker Kuhlmann <hidden(a)paradise.net.nz> wrote: > [when I was critizing Ben Rosenberg] > Can you take your personal problems offlist please? Thanks. > Volker And can you post under an address where personal responses are possible, Mr. Hidden Paradise? These are not my personal problems alone. The list is overflowing with request from people who are too lazy to look first for themselves. In the beginning of email-list and newsgroups it was very common to receiving some RTFM responses and IMO that did good and helped us to get the self-training through reading available material FIRST before posting. But nowadays our conditioned "politeness" tells us to answer everything and thus train lazy dogs to become even more lazy. Now even totally appropriate "have you *tried* google" criticism is criticized. As you do, as Ben did. And it was a complete google-link to click on plus the remark that the forth item will contain the wanted material - and I checked it, the 4th google reference is indead very valuable regarding the original question. 'Please' and 'thanks' are cheap to type into a keyboard. Learning is not that cheap. But of course somebody will certainly identify with poor lazy Ben if he is himself asking questions like "Is anyone able/willing to give a brief opinion about the level of security of bind 8 and 9? There must be a reason why SuSE ships both. If they're equally secure it would seem to be more sensible to go with the new version for new servers?" Was there anyone willing to give a <whatever>, Volker? Perhaps offlist to your "undeliverable" mail-box? Man, you made it... Michael -- Michael Zimmermann (http://vegaa.de)

7 7