October 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEFirewall 2 / SuSE 8.1 accepting packets it should not
by Juergen.Mell＠t-online.de 24 Oct '02

24 Oct '02

Hi Uli, >> checking my logs today I found that my firewall accepts some >> (not all!) >> packets to TCP high ports, although I thought I had them all closed. >> The firewall script is the latest update for 8.1, the system is SuSE >> 8.1 with all current patches installed. Any ideas? > Maybe the packets in your log are answer packets to a connection > your computer initiated. Guess your computer initiates an ftp > connection > to some computer in the internet. The destination port is the port 21 > of the ftp server, and the source port is e.g. port 1234 of your > computer. No, I definitely did not use FTP or any other protocol which would listen on the ports where these packets were accepted (the ports are the Kazaa / eDonkey ports). > So the answer packet from the ftp server has source port 21, and the > destination port is the port 1234 of your computer. Do you want the > firewall to drop this packet? The source port of the packets is no well-known port, so most likely this is a Kazaa or eDonkey client which did not recognize that the dynamic IP was re-issued to my computer when it was in use before for file sharing. So I definitely want the firewall to drop ALL these packet, not only some of them (each second packet, as it seems...) Bye, Jürgen

2 1

Re: [suse-security] suse-security list
by Chris 24 Oct '02

24 Oct '02

As far as I know then (as I have the same, only my webserver is on the Gateway itself (home network)), the mail from Andreas Mueller could help you out! FW_FORWARD_MASQ="0/0,10.3.1.34,tcp,5678,80" meaning indeed : source ip, destination ip, protocol, source port, destination port What you should definitly do is open port 5678 on FW_SERVICES_EXT_TCP, otherwise the firewall won't allow clients to connect. And you can get rid of port 80 on EXT because you use the other port for it. FW_SERVICES_EXT_TCP="25 53 5678" as for opening port 80 on the gateway on FW_SERVICES_INT_TCP ... If you run a webserver on it , you can leave it open else close it as this is an open port doing nothing ;) (meaning if you want security to be high : close everything you don't need) If LAN users connect to your webserver the routing tables on the network know they don't have to go over the gateway so it will find the webserver anywayz ... Hope this helped you out a bit ... regards Chris >You wrote : Thanks for your prompt answer a.) The local users enter by default port 80 (transparently) Nevertheless for external users this should not be the case. They should give on the explorer the address http://204.87.34.12:5678 (just an example) . Then the firewall should redirect this request on port 5678 on device (206.87.34.1) to the internal server 10.3.1.34 port 80. b.) The Webserver accesses the database itself presenting the result in a webpage obviously. René On Thursday 24 October 2002 09:00, you wrote: > Hi, > > When users are connecting to your webserver , do they have to enter the > portnumber or is it port 80 by default. > > I know here in belgium ports under 1024 get blocked with certain providers > unless you pay for a more expensive "solution" > > Plus: Does the webserver access the database itself (localhost) and then > presents the results in a webpage or do the clients have to have a > connection to the database themselves ? > > regards > > Chris > > ----- Original Message ----- > From: "René Garizzao" <rgarizzao(a)comfenalco.com> > To: <suse-security(a)suse.com> > Sent: Thursday, October 24, 2002 3:54 PM > Subject: [suse-security] suse-security list > > > Hello Uli, > I present to you following porblem I haven't closed succesfully: > > Configuration: > ========== > > Internal <---> Firewall (SuSE8.0) <---> Internet <---> Client > Web Server (int_dev: 10.3.1.10) > (10.3.1.34) (ext_dev: x.y.z.a) > > Well, certain client shall connect to the internal Web server to make use > of a data base application. The Client should give the ext_dev ip address > and the desired port to connect, i.e. http://x.y.z.a:5678 > The request should pass through the firewall and be redirected straight to > the > webserver 10.3.1.34 .(port 80) > I tried different configuration examples without success. Have you any > experience wuthin? > > SuSEfirewall Configuration > =================== > (This configuration uses port 80 and not the desired high port 5678) > > FW_DEV_EXT="eth1" > > FW_DEV_INT="eth0" > > FW_ROUTE="yes" > > FW_MASQUERADE="yes" > > FW_MASQ_NETS="10.3.0.0/16" > > FW_PROTECT_FROM_INTERNAL="yes" > > FW_AUTOPROTECT_SERVICES="yes" > > FW_SERVICES_EXT_TCP="25 53 80" > > FW_SERVICES_EXT_UDP="53" > > FW_SERVICES_INT_TCP="25 53 80" > > FW_SERVICES_INT_UDP="53" > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" > > FW_SERVICE_DNS="yes" > > FW_FORWARD="0/0,x.y.z.a,tcp,80 x.y.z.a,10.3.1.34,tcp,80 > 0/0,10.3.1.34/255.255.255.255,tcp,80" > > # > FW_REDIRECT="10.3.0.0/16,0/0,tcp,53,53 10.3.0.0/16,0/0,tcp,25,25 > 10.3.0.0/16,0/0,udp,53,53 10.3.1.34,0/0,tcp,80,80" > =========================================================== > > Thanks in advance for any further help you could provide me.

3 3

Sec. Update of KDE
by matthias-wieser＠t-online.de 24 Oct '02

24 Oct '02

Hi, i try to get the official Suse secutity update of KDE. Two weeks ago there was a security advisory for KGhostView (http://www.kde.org/info/security/advisory-20021008-1.txt) I tried to use YOU to get KDE3.0.4 but at least for Suse 8.1 I could not find the update (within YOU). But there *are* KDE3.0.4 RPMs at ftp.suse.com/[...]/update/8.1/rpm/i586. Why don't they show up within YOU? Are they not yet ready or will they get replaced within the next few days? Or maybe am I save with my KDE3.0.3 Suse 8.1 standard installation? Thanks in advance, Matthias

2 1

suse-security list
by René Garizzao 24 Oct '02

24 Oct '02

Hello Uli, I present to you following porblem I haven't closed succesfully: Configuration: ========== Internal <---> Firewall (SuSE8.0) <---> Internet <---> Client Web Server (int_dev: 10.3.1.10) (10.3.1.34) (ext_dev: x.y.z.a) Well, certain client shall connect to the internal Web server to make use of a data base application. The Client should give the ext_dev ip address and the desired port to connect, i.e. http://x.y.z.a:5678 The request should pass through the firewall and be redirected straight to the webserver 10.3.1.34 .(port 80) I tried different configuration examples without success. Have you any experience wuthin? SuSEfirewall Configuration =================== (This configuration uses port 80 and not the desired high port 5678) FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="10.3.0.0/16" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="25 53 80" FW_SERVICES_EXT_UDP="53" FW_SERVICES_INT_TCP="25 53 80" FW_SERVICES_INT_UDP="53" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_DNS="yes" FW_FORWARD="0/0,x.y.z.a,tcp,80 x.y.z.a,10.3.1.34,tcp,80 0/0,10.3.1.34/255.255.255.255,tcp,80" # FW_REDIRECT="10.3.0.0/16,0/0,tcp,53,53 10.3.0.0/16,0/0,tcp,25,25 10.3.0.0/16,0/0,udp,53,53 10.3.1.34,0/0,tcp,80,80" =========================================================== Thanks in advance for any further help you could provide me.

2 1

Martian Source
by Grosswiler Roger 24 Oct '02

24 Oct '02

Oct 23 15:34:38 trinity kernel: martian source 255.255.255.255 from 10.225.80.1, on dev eth1 Oct 23 15:34:38 trinity kernel: ll header: ff:ff:ff:ff:ff:ff:00:09:7b:8d:08:54:0 8:00 --> as i heard, this problem is known and it is not an intrusion by another system - there is a malconfigured adress somewhere in the system oder in the kernel. But this message is filling my logs and my disks. So: - is it like i heard? (hopefully yes) - how can i solve this problem, so i will not get anymore message in my logs for that? Thx in advance! Roger

8 18

AW: [suse-security] SuSEFirewall 2 / SuSE 8.1 accepting packets it should not
by Ulrich Roth 24 Oct '02

24 Oct '02

Hi Jürgen, > checking my logs today I found that my firewall accepts some > (not all!) > packets to TCP high ports, although I thought I had them all closed. > The firewall script is the latest update for 8.1, the system is SuSE > 8.1 with all current patches installed. Any ideas? Maybe the packets in your log are answer packets to a connection your computer initiated. Guess your computer initiates an ftp connection to some computer in the internet. The destination port is the port 21 of the ftp server, and the source port is e.g. port 1234 of your computer. So the answer packet from the ftp server has source port 21, and the destination port is the port 1234 of your computer. Do you want the firewall to drop this packet? Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Re: [suse-security] port 80 closed, Firewall up and still accepted??
by Andreas J Mueller 23 Oct '02

23 Oct '02

-----BEGIN PGP SIGNED MESSAGE----- Hi Piet! > FW_SERVICES_EXT_TCP="www" That's about the same as FW_SERVICES_EXT_TCP="http". ;-) See /etc/services: http 80/tcp # World Wide Web HTTP www 80/tcp # World Wide Web HTTP www-http 80/tcp # World Wide Web HTTP So you're allowing outside access to your WWW server, whether it's running or not. If you want to DROP packets when Apache is not active, you need to find a way to modify the config file (remove the www from the line above) and reload the firewall rules. Regards, Andy - -- Andreas J. Mueller email: <andy(a)muelli.net> PGP RSA Public Key ID 0x3D41D941 FP: ED261973D51D3D20 C840B0542E69F602 We strongly urge you to encrypt information sent by email. Our public PGP key is available from http://132.176.114.28/q4408950/pubkey.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (MingW32) iQC9AwUBPbcbZ/obN5o9QdlBAQHY8gVAhKwXktrmilK5pXTiPZ38DgUhb+o0peW9 97/3ne5kJvrDCs2CexOQLNFcpWc7lBPGAKo2lV3jeJM4CNc0C3SrYwevI6TZg7oV Q56LbXCGH/lFjIpnilmCmTgHi9kxYb6PjSguP3p+FrNAzdDdwtkGg/Fefdlw94fl 5VVQt0cd5lxY0eQHquykQgVJLPwzsktw5oH5/QVtXpicDQgFYzLPN8MuCDtNalsE =up67 -----END PGP SIGNATURE-----

1 0

Re: [suse-security] AmaVis or InterScan VirusWall
by Thomas Lamy 23 Oct '02

23 Oct '02

Arjen de Korte [mailto:arjen@nijntje.xs4all.nl] wrote: > > On Tuesday 22 October 2002 20:08, Thomas Lamy wrote: > > > Personally I use amavisd, with AntiVir from H+B EDV > (www.hbedv.de), trophie > > (http://www.vanja.com/tools/trophie/), an alternative frontend for > > TrendMicro's libvsapi shared library, and clamav > > (http://clamav.elektrapro.com/), a free scanner which uses OpenAV's > > (http://www.openantivirus.org) signatures, but is > implemeted in C (openav > > is written in Java). All these in different combinations, > and they all work > > very well. > > I must say that amavisd is a really outstanding piece of > software, and can > > only recommend using it. > > <shamelessplug> > > If you only use the H+BEDV scanner (AntiVir), you can also use their > 'avmilter' package. It is available for download on their homepage > (http://www.hbedv.com). > > </shamelessplug> I must admit this is true, but keeps you from using more than one scanner (on the same machine), which amavisd is capable of (at least after some tweaking). At customers with > 50 viral mails every day I recommend to use at least 2 scanners of different vendors (saved my life once when Trend's download site was busy). > > Private, non commercial use is free with a key they send once > registered > (you'll need a key anyway, even if you use 'amavisd' with > AntiVir after the > evaluation period). I must admit I have no experience with > 'amavisd', but > 'avmilter' speeded up scanning significantly compared to > 'amavis-perl'. The speed increase is enormous. I twice got 3000 Mails in one hour because we had an obscure mail loop; amavis (old) kicked the machine to death (flaky motherboard/RAM), on the same machine amavisd did it's job properly (with at least 3x throughput). > > Arjen Thomas

3 3

port 80 closed, Firewall up and still accepted??
by Piet Roorda 23 Oct '02

23 Oct '02

/var/log/warn came up with: my firewall2 is up, Apache not running.... why is it accepted?? piet ct 23 21:22:41 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=217.85.113.150 DST=213.17.111.20 LEN=52 TOS=0x08 PREC=0x00 TTL=118 ID=48926 DF PROTO=TCP SPT=64687 DPT=80 WINDOW=32767 RES=0x00 SYN URGP=0 OPT (020405840103030001010402) Oct 23 21:22:42 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=217.85.113.150 DST=213.17.111.20 LEN=52 TOS=0x08 PREC=0x00 TTL=118 ID=49160 DF PROTO=TCP SPT=64687 DPT=80 WINDOW=32767 RES=0x00 SYN URGP=0 OPT (020405840103030001010402) Oct 23 21:22:42 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=217.85.113.150 DST=213.17.111.20 LEN=52 TOS=0x08 PREC=0x00 TTL=118 ID=49426 DF PROTO=TCP SPT=64687 DPT=80 WINDOW=32767 RES=0x00 SYN URGP=0 OPT (020405840103030001010402)

2 2

SuSEFirewall 2 / SuSE 8.1 accepting packets it should not
by Juergen.Mell＠t-online.de 23 Oct '02

23 Oct '02

Hi List, checking my logs today I found that my firewall accepts some (not all!) packets to TCP high ports, although I thought I had them all closed. The firewall script is the latest update for 8.1, the system is SuSE 8.1 with all current patches installed. Any ideas? Here is my firewall configuration: FW_DEV_EXT="ppp0 ippp0" FW_DEV_INT="eth0 ippp1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/16" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" # <<<<< !!!!! FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="yes" FW_IGNORE_FW_BROADCAST="no" FW_ALLOW_CLASS_ROUTING="yes" FW_QUICKMODE="no" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_CUSTOMRULES="" FW_REJECT="no" Here is an excerpt from the logs: Oct 23 19:58:03 akira kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=217.82.120.18 6 DST=80.134.29.51 LEN=64 TOS=0x00 PREC=0x00 TTL=124 ID=63058 DF PROTO=TCP SPT=3 822 DPT=4662 WINDOW=44032 RES=0x00 SYN URGP=0 OPT (020405AC010303030101080A00000 0000000000001010402) Oct 23 19:58:03 akira kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=217.82. 120.186 DST=80.134.29.51 LEN=64 TOS=0x00 PREC=0x00 TTL=124 ID=63058 DF PROTO=TCP SPT=3822 DPT=4662 WINDOW=44032 RES=0x00 SYN URGP=0 OPT (020405AC010303030101080 A000000000000000001010402) Oct 23 19:58:05 akira kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=217.82.120.18 6 DST=80.134.29.51 LEN=64 TOS=0x00 PREC=0x00 TTL=124 ID=63258 DF PROTO=TCP SPT=3 822 DPT=4662 WINDOW=44032 RES=0x00 SYN URGP=0 OPT (020405AC010303030101080A00000 0000000000001010402) Oct 23 19:58:05 akira kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=217.82. 120.186 DST=80.134.29.51 LEN=64 TOS=0x00 PREC=0x00 TTL=124 ID=63258 DF PROTO=TCP SPT=3822 DPT=4662 WINDOW=44032 RES=0x00 SYN URGP=0 OPT (020405AC010303030101080 A000000000000000001010402) Oct 23 19:58:11 akira kernel: SuSE-FW-ACCEPT IN=ppp0 OUT= MAC= SRC=217.0.221.1 D ST=80.134.29.51 LEN=52 TOS=0x00 PREC=0x00 TTL=124 ID=48006 DF PROTO=TCP SPT=4351 DPT=4662 WINDOW=32767 RES=0x00 SYN URGP=0 OPT (020405AC0103030001010402) Oct 23 19:58:11 akira kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=217.0.2 21.1 DST=80.134.29.51 LEN=52 TOS=0x00 PREC=0x00 TTL=124 ID=48006 DF PROTO=TCP SP T=4351 DPT=4662 WINDOW=32767 RES=0x00 SYN URGP=0 OPT (020405AC0103030001010402) Bye, Jürgen

1 0