March 2002 - openSUSE Security - openSUSE Mailing Lists

Problems with ssh and firewall script
by Ralf Schoenian 27 Mar '02

27 Mar '02

Hello list, I cannot connect to our network from at home. I always get the error message: Connection refused at port 10022. The sshd doesn' t log anything in /var/log/messages and the firewall script is also empty. Without the active firewall I can login without any problems. We are running SuSE Linux 7.3 Has anyone an idea, what is wrong with our firewall script? Any hint is welcome. Million thanks for your help, Ralf Schoenian And here comes the script: #!/bin/bash ### Bestehende Regeln lAöschen (eingebaute Regeln, eigene u. die ### Counter zurAücksezten. iptables -F iptables -X iptables -Z # Default policy. iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP ### =========================================================== ### Variablen IFACE="ppp0" IFACE2="vmnet1" IFACE3="eth0" BROADCAST="192.168.1.255" LOOPBACK="127.0.0.0/8" CLASS_C="192.168.0.0/16" UP_PORTS="1024:65535" #UP_PORTS="1:65535" ### ============================================================ ### Kernel flags ### Auf Pings reagieren wir nicht. /bin/echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all ### Auf broadcasts wollen wir auch nicht reagieren. /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ### Source routed packets werden nicht akzeptiert. Mit ihnen kAönnen Angreifer ### vorgeben, dass sie aus dem inneren des Netzwerkes kommen. /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route ### ICMP redirects wollen wir nicht, da sie missbraucht werden kAönnen, um ### unsere Routen zu Aändern. /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects ### Enable bad error message protection. /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ### ============================================================ ### REGELN ### LOOPBACK ### Lokal erlauben wir wirklich alles. Einige Programme nutzen das lo device. iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ### Lokale devices # iptables -A INPUT -i $IFACE2 -j ACCEPT iptables -A OUTPUT -o $IFACE2 -j ACCEPT iptables -A INPUT -i $IFACE3 -j ACCEPT iptables -A OUTPUT -o $IFACE3 -j ACCEPT ### SYN-FLOODING PROTECTION # iptables -N syn-flood iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j DROP ## Make sure NEW tcp connections are SYN packets iptables -A INPUT -i $IFACE -p tcp ! --syn -m state --state NEW -j DROP ### FRAGMENTS # iptables -A INPUT -i $IFACE -f -j LOG --log-prefix "IPTABLES FRAGMENTS: " iptables -A INPUT -i $IFACE -f -j DROP ### SPOOFING # ### Alle Pakete die aus dem Internet kommen u. vorgeben aus einem Class-C Netz zu stammen ### werden ignoriert iptables -A INPUT -i $IFACE -s $CLASS_C -j DROP iptables -A INPUT -i $IFACE -d $LOOPBACK -j DROP # Refuse broadcast address packets. iptables -A INPUT -i $IFACE -d $BROADCAST -j DROP ## DNS # Allow UDP packets in for DNS client from nameservers. iptables -A INPUT -i $IFACE -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT # Allow UDP packets to DNS servers from client. iptables -A OUTPUT -o $IFACE -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 22 -j ACCEPT ### SSH inbound # iptables -A INPUT -i $IFACE -p tcp --dport 10022 --sport $UP_PORTS -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport 10022 --dport $UP_PORTS -j ACCEPT # iptables -A INPUT -i $IFACE -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport 22 -j ACCEPT # ### SSH outbound # iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport 10022 -j ACCEPT iptables -A INPUT -i $IFACE -p tcp --dport $UP_PORTS --sport 10022 -j ACCEPT # iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport 22 -j ACCEPT iptables -A INPUT -i $IFACE -p tcp --dport $UP_PORTS --sport 22 -j ACCEPT ### HTTP # iptables -A INPUT -i $IFACE -p tcp --sport 80 --dport $UP_PORTS -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 80 --sport $UP_PORTS -j ACCEPT # iptables -A INPUT -i $IFACE -p tcp --sport 3128 --dport $UP_PORTS -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 3128 --sport $UP_PORTS -j ACCEPT ### HTTPS # iptables -A INPUT -i $IFACE -p tcp --sport 443 --dport $UP_PORTS -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 443 --sport $UP_PORTS -j ACCEPT ### NTP # iptables -A INPUT -i $IFACE -p tcp --sport 123 --dport 123 -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 123 --sport 123 -j ACCEPT iptables -A INPUT -i $IFACE -p udp --sport 123 --dport 123 -j ACCEPT iptables -A OUTPUT -o $IFACE -p udp --dport 123 --sport 123 -j ACCEPT # iptables -A INPUT -i $IFACE -p tcp --sport 37 --dport 37 -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 37 --sport 37 -j ACCEPT iptables -A INPUT -i $IFACE -p udp --sport 37 --dport 37 -j ACCEPT iptables -A OUTPUT -o $IFACE -p udp --dport 37 --sport 37 -j ACCEPT ##FTP # Allow ftp outbound. iptables -A INPUT -i $IFACE -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport 21 -m state --state NEW,ESTABLISHED -j ACCEPT # SMTP iptables -A INPUT -i $IFACE -p tcp --sport 25 -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --dport 25 -j ACCEPT # POP iptables -A INPUT -i $IFACE -p tcp --sport 110 --dport $UP_PORTS -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport 110 -j ACCEPT # ICMP # We accept icmp in if it is "related" to other connections (e.g a time #exceeded (11) # from a traceroute) or it is part of an "established" connection (e.g. an #echo reply (0) # from an echo-request (8)). iptables -A INPUT -i $IFACE -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT # We always allow icmp out. iptables -A OUTPUT -o $IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT # Logging # iptables -A INPUT -m limit --limit 1/s -j LOG --log-prefix "INPUT " iptables -A OUTPUT -m limit --limit 1/s -j LOG --log-prefix "OUTPUT " iptables -A FORWARD -m limit --limit 1/s -j LOG --log-prefix "OUTPUT " echo "Firewall......done"

1 0

Squid 2.3.x (Maybe Off-Topic)
by BLeonhardt＠analytek.de 26 Mar '02

26 Mar '02

Hi all, have a question : I've now successfully installed a Squid-Proxy with SquidGuard. Now, I have to create about 100 users with their passwords and home-dirs. Is there a possibility to automate this ??? Maybe grepping from a text-file or something like that ? What's with the passwords ? The users have to verify with username and password before they're able to access the squid-cache. To check for users / passwords " pam_auth /etc/passwd " is used. Is that ok ? I'm thankfull for all replies ... ... bye bruno

2 1

Re: [suse-security] SuSEfirewall2 and SMB UDP Ports
by Florian Flad 25 Mar '02

25 Mar '02

>Make sure to restart the firewall after you made a change to it. Ok, that's not the problem. "rcfirewall restart" should do it... :-) (I alos tried a complete restart...) >FW_SERVICE_SAMBA="no" Same effect, as SuSEFirewall2 checks rc.config --> "Warning: detected START_SMB=yes in /etc/rc.config, enabling FW_SERVICE_SMB!". >Thats the point where in /sbin/SuSEfirewall the udp ports will be >enabled if it yes. Simple way is to go there and add an interface with >-i option to determine that only traffic from internal is ok. Was a little bit late when I wrote it, so I forgot to say that I allredy tried this: smb.conf-->"interfaces = eth0" (same effect with 192.168.0.0/24) Thanks, Flo

3 3

Snort.rpm
by Togan Muftuoglu 25 Mar '02

25 Mar '02

Hi Snort-1.8.1-16.rpm is still in the needs review directory ( at least that is what I have in my mirror). IIRC this was due to to a review as Roman said , yet no knews about teh current situation. Yes I can download the newer release from snort.org but I would prefer to use SuSE binaries on my SuSE boxes. I can imagine as the release date for 8.0 is coming the pressure is increasing in fixing last minute bugs, yet loyalty should not be overlooked IMO Thanks -- Togan Muftuoglu

1 0

Help!
by Brevsville 25 Mar '02

25 Mar '02

Hi I am getting this in my ps x list everytime I execute anything as root. Can anyone advise me as to where to look for the hack that is doing this? I can't find any information anywhere. Thanx! (loemtd) -f mnm(a)fsemail.com -s auto report logs Chris

1 0

SuSEfirewall2 and SMB UDP Ports
by Florian flad 25 Mar '02

25 Mar '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm using SuSE Linux 7.3 (2.4.10-4GB) and running SuSEfirewall 2.1. Today I used the online security scanner at http://www.symantec.com/securitycheck/ and noticed that it was possible to connect to my samba-server using UDP port 137-138 and read the servername and domainname. I revised my firewallconfig but didn't find a clue: /etc/rc.config.d/firewall2.rc.config: ************************************************************************ FW_DEV_EXT="ppp0" # dsl via pppoe on eth1 FW_DEV_INT="eth0" # internal net 192.168.0.0/255.255.255.0 FW_DEV_DMZ="eth2" # internal net 192.168.1.0/255.255.255.0 FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" # masq eth0 FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_IP="" FW_SERVICES_EXT_UDP="" # thought it must have been here FW_SERVICES_DMZ_TCP="8080 ftp" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" # same effect if turned off FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option - - --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" ************************************************************************ Then "iptables -L -n | grep 137" supplied the following: ************************************************************************ ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpts:137:138 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137 ************************************************************************ According to "SuSEfirewall2 debug" the top line results from "iptables -A INPUT -j ACCEPT -m state --state NEW,ESTABLISHED,RELATED -p udp --dport 137:138" and seems to be the problem. Is it a bug in SuSEfirewall2 or where is the problem?! Thanks, Florian Flad -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (MingW32) - WinPT 0.5.6 iEYEARECAAYFAjyeaYkACgkQk+lziOWgzw3AcgCgvsSp68pmXXFTqxYVVMvwCBka z38AoPJjjR+2tCBqJlrzKxf5vhVgYO2T =VvAI -----END PGP SIGNATURE-----

3 2

RE: [suse-security] PPTP
by Reckhard, Tobias 25 Mar '02

25 Mar '02

> It's not very strange..pptp is a proprietary Microsoft protocal.. I [snip] No, it's not. It's defined in RFC 2637: ftp://ftp.isi.edu/in-notes/rfc2637.txt. Microsoft was heavily involved in its development, but it's not a proprietary standard. MS may well have 'extended' their own client and server implementations beyond what is defined in the standard, but I have no information to that effect. Tobias

1 0

PPTP
by Ken Schneider 24 Mar '02

24 Mar '02

When trying to use PPTP for a vpn connection to work all seems to work well except for the following error: Mar 22 08:48:59 pc1 kernel: Not enough space to encrypt packet: 1304<1304+4! After doing some research I found an article regarding this error and there was a kernel patch. I down loaded the patch and when I tried to apply the patch I found that the patch was already applied. But yet the error still occurs. I am using SuSE 7.3 professional with the 2.4.16 kernel update applied as well as all other updates from the ftp site. I also have a laptop with 7.3 kernel 2.4.10 that gives me the same error. Is there something I am missing here? Is there something that needs to be set in the proc (echo 1 > /proc/somewhere). Thanks for your help in this matter, -- Ken Schneider Senior UNIX Administrator Network Administrator

4 5

Does anyone have experience with VPN...
by Michael Garabedian 22 Mar '02

22 Mar '02

Microsoft to be exact or if not maybe a good mailing list to subscribe to. I am having problems getting the password changes to sync with the domain controller. And microsoft says "sometimes" deleting and adding the accounts fix this. I don't want to do this for 2500 users

2 2

Correct way to implement Firewall2 rules for boot up...
by Evan Montgomery-Recht 22 Mar '02

22 Mar '02

Here's a quick one. Any yes it's probably been answered but I've tried searching and it doesn't seem to come up. Basicly I'm using SuSE 7.3 Pro, and I want to save the Firewall2 rules so that on boot-up these rules are used. Unfortunatly I'm not quite sure what has to be modified in SuSE's enviroment for this to be true. It's a really basic rule set that works properly for our enviroment right now, it'll be expanded once I understand which files need to be modified. I've picked up from the netfilter.samba.org site the basic ruleset, and they have a paragraph that states how you can save ruleset's, but it appears each vendor does their own thing. thanks, evan Here's the commands. iptables -N block_outside iptables -A block_outside -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A block_outside -m state --state NEW -i eth1 -j ACCEPT iptables -A block_outside -j DROP iptables -A INPUT -j block_outside iptables -A FORWARD -j block_outside _________________________________________________________________________ This mail sent via toadmail.com, web e-mail @ ToadNet - want to go fast? http://www.toadmail.com

2 1