April 2002 - openSUSE Security - openSUSE Mailing Lists

Re: RE: [suse-security] Problems with ssh and firewall script
by ralf＠schoenian-online.de 02 Apr '02

02 Apr '02

Hello Holger, Holger Gossmann <hgossmann(a)rs2group.com> schrieb am 02.04.2002, 09:49:54: > Hallo Ralf, > you specified IFACE=ppp0 but the packets are received on ippp0. Yes, sorry. I have the same configuration at home. But at work we have the IFACE=ippp0 > thanks for all the answers. Unfortunately, I still cannot find the solution. > My sshd is running on port 10022. I verified this several times. > > If I am opening the firewall with the default policies ACCEPT and drop all > my > rules I can connect to my server from outside without any problem. Therefore > I can guess that I have some problems with the firewall and not the sshd. > > I will cut the parts of my firewall with drop rules and the kernel flags. > Beneath the rules I will paste a short chunk from my logfile. > > Please, please help me. I am really desperate and running out of ideas. > > Regards, Ralf Schoenian. > > # Default policy. > iptables -P INPUT DROP > iptables -P FORWARD DROP > iptables -P OUTPUT DROP > > ### =========================================================== > ### Variablen > > IFACE="ppp0" > IFACE2="vmnet1" > IFACE3="eth0" > > > BROADCAST="192.168.1.255" > LOOPBACK="127.0.0.0/8" > CLASS_C="192.168.0.0/16" > UP_PORTS="1024:65535" > #UP_PORTS="1:65535" > > ### ============================================================ > ### Auf Pings reagieren wir nicht. > /bin/echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all > > ### Auf broadcasts wollen wir auch nicht reagieren. > /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts > > ### Source routed packets werden nicht akzeptiert. Mit ihnen kAönnen > Angreifer > ### vorgeben, dass sie aus dem inneren des Netzwerkes kommen. > /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route > > ### ICMP redirects wollen wir nicht, da sie missbraucht werden kAönnen, um > ### unsere Routen zu Aändern. > /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects > > ### Enable bad error message protection. > /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses > > ### SYN-FLOODING PROTECTION > # > iptables -N syn-flood > iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood > iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN > iptables -A syn-flood -j DROP > > ## Make sure NEW tcp connections are SYN packets > iptables -A INPUT -i $IFACE -p tcp ! --syn -m state --state NEW -j DROP > > ### SPOOFING > # > ### Alle Pakete die aus dem Internet kommen u. vorgeben aus einem Class-C > Netz zu stammen > ### werden ignoriert > iptables -A INPUT -i $IFACE -s $CLASS_C -j DROP > > iptables -A INPUT -i $IFACE -d $LOOPBACK -j DROP > # Refuse broadcast address packets. > iptables -A INPUT -i $IFACE -d $BROADCAST -j DROP > > ### SSH inbound > # > iptables -A INPUT -i $IFACE -p tcp --dport 10022 --sport $UP_PORTS -j > ACCEPT > iptables -A OUTPUT -o $IFACE -p tcp --sport 10022 --dport $UP_PORTS -j > ACCEPT > # > ### SSH outbound > # > iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport 10022 -j > ACCEPT > iptables -A INPUT -i $IFACE -p tcp --dport $UP_PORTS --sport 10022 -j > ACCEPT > > ---------------------------------------- > Here is some part of my firewall log > ----------------------------------------- > > Mar 28 17:01:02 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42963 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:01:14 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42964 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:01:38 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42965 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:02:26 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42966 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:22 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24380 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:25 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24381 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:31 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24382 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:43 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24383 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:07 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59595 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:10 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59596 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:16 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59597 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:28 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59598 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

1 0

Locked out
by Erwin Zierler - stubainet.at 02 Apr '02

02 Apr '02

Hi list, seems I have a little problem there. On a SuSE 6.4 system (kernel 2.2.19) that I am administering which is running mainly as a mailserver (smtp & pop3) I recently updated libz by fetching the sources from ftp.suse.com and doing a rpm -bb libz... and then rpm -Uhv libz... Anyway, for remote administration I use ssh (latest version available for 6.4) and access is restricted via /etc/hosts.deny. Also protocol version 1 is disabled. The next time (after I updated libz) I could not log in anymore, this is what I get when I try to connect from any of the allowed IP addresses: ssh_exchange_identification: Connection closed by remote host Could it be that the newly installed libz is the reason? I have checked with ldd /usr/sbin/sshd and it tells me on all my other systems that its linked against /usr/lib/libz.so.1 So now the big question: can the libz update really be the reason or is it more likely that I messed something else up that I can't remember? Or in other words: do I have to drive ~ 550 kilometers to fix that server or is there any other way to be able to log in again :-) Thanks in advance for all your help! Erwin -- Erwin Zierler | web- / host- / postmaster - stubainet.at | erwin.zierler(a)stubainet.at / webmaster(a)stubainet.at | Tel.: 0 5225 - 64325 Fax 99 Mobil: 0664 - 130 67 91

3 2

SuSEFirewall2, masquerade port 80 to internal box, please help
by Geordon VanTassle 02 Apr '02

02 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I'm trying to get Firewall2 to forward/masquerade port 80 from the public IP address of the firewall to a private IP address on another SuSE box inside. Can someone suggest where I can find a HOWTO? Thanks in advance - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "Be the change that you want to see in the world." (Mohandas Gandhi) -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPKkEdN77fDX88Gt5AQFVmQf+K+1Kt8vpWiDKQ9DpD6Ebo/9QdFo4xwJf yxfy9mm9evve84X9hk2ek39ECMswFlsAePcvsTDTobTWWXgK1F7FfbIDA8tK5Udz u8OYRnIgZldrikZg/z9FDmeOBwIJj+B0zN9tEbD4Yn6hAZHFmpy7j20vkXloBh9z K13d6vK867oOfRW/TazorMk/l4ZK8rIMACHvMpO8WuJNrUB7BF6PRmb/VXlF/TL2 OULWkObpybHtb87SJnLTCkdCR0j3WZHYaCsZhgvDdKUHvHMaT5SV04Xxc3TZJWnr p9Ds6DZBZSIyXGyTj2BQXq8zISx5C5i4BNEMlV0NOV1/hHrPp7pfjg== =K7HY -----END PGP SIGNATURE-----

3 2

Re: [suse-security] file creation with a different gid?
by Axel Zindler 02 Apr '02

02 Apr '02

Hi all, "problem" solved - newgroup was exactly the cmd I was looking for (hours). Thanks for the quick help. BTW in no section of doc about permissions (I've read) this cmd is mentioned - maybe it can go into the SuSE Reference manual. axel Am Montag, 1. April 2002 16:26 schrieben Sie: > Axel Zindler schrieb: > > Hi, > > > > was wondering how to create files with a different gid then the standard > > group. > > > > Suppose one wants to share files with a second (or third and so far) > > user. They create a common group different from (standard) users, ie. > > projectx. If both users are now members of projectx and keep the > > membership of users the files will be written always with the uid of > > users, ie: > > > > -rw-r--r-- 1 axel users 16 Mär 31 22:50 test.txt > > > > How is it possible to edit a file and save files in that way to achive > > the following without doing a chgrp after the file is saved? > > > > -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt > > Hi Axel, > > there should be different means of doing that: > 1) Change your primary group from within yast (you'd need to create a > new group prior to that) > 2) edit the user into a new group (same as above) and > use the command "newgrp" to change your group identety. > > cannot say much more to the latter, see the man pages of "newgrp" and > "su". Just dug that up for you. > > Juergen

1 0

Yast2 (ot)
by CJB 01 Apr '02

01 Apr '02

Ok, this doesn't have to do with security, sorry about that. But I'm trying to update my system with yast. It downloaded the You update, but then crashed and didn't get it installed. Now it won't show that there's any packages that need to be updated. How do I get it to re-download the You update, and let me download other packages? Thanks, Cj B

1 0

Re: [suse-security] file creation with a different gid?
by Michael Stern 01 Apr '02

01 Apr '02

>This is definitely the wrong list for such a question ;) why is that? the question is definitely security related. i've seen other posts which were more off-topic than this one. michael

1 0

RE: [suse-security] file creation with a different gid?
by Björn Engels 01 Apr '02

01 Apr '02

Axel Zindler wrote: > was wondering how to create files with a different gid then the standard > group. [...] > How is it possible to edit a file and save files in that way to achive > the > following without doing a chgrp after the file is saved? > > -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt This is definitely the wrong list for such a question ;) But anyway: change the associated group of the direcory you want to share the files in to the desired group and chmod it SGID. (chmod 2770 for example) That's it. New files will be created with group owenership according to the directory's group. Bjoern

2 1

How to install src.rpm updates
by Nikos Psarrakis 01 Apr '02

01 Apr '02

Has anyone any idea of how can we install ...src.rpm update files? (security patces, updates etc. from Suse) Although there is no error message when we try to install them, when we run a query we see that there hasn't been any update. Therefore, we have no problem installing .rpm files. In that case everything seems to work fine. Do we miss something or there's a special procedure to install ...src.rpm updates? Thanks in advance, i remain...

2 1

How to install src.rpm updates
by Nikos Psarrakis 01 Apr '02

01 Apr '02

Has anyone any idea of how can we install ...src.rpm update files? (security patces, updates etc. from Suse) Although there is no error message when we try to install them, when we run a query we see that there hasn't been any update. Therefore, we have no problem installing .rpm files. In that case everything seems to work fine. Do we miss something or there's a special procedure to install ...src.rpm updates? Thanks in advance, i remain...

2 1