May 2002 - openSUSE Security - openSUSE Mailing Lists

Virtual IP adress on the firewall, the dmz and DNAT / MASQUERADE
by Kai-H. Weutzing 27 May '02

27 May '02

Hi, my problem was that I have a box with three interfaces (ext, dmz, int) and many IPs on the ext-interface and one (or more) server in the dmz. In the moment the SuSEfirewall2 (v2.1) on my SuSE 8.0 installation can't do that (look in the TODO file). So I spend some time in patching the SuSEfirewall2 script and it works well for me. The patch is very small: 1310c1310,1311 < ERROR=`echo $NETS | $AWK -F, '{print $6}'` --- > DEST=`echo $NETS | $AWK -F, '{print $6}'` > ERROR=`echo $NETS | $AWK -F, '{print $7}'` 1337a1339 > test -z "$DEST" || DEST="-d $DEST" 1339c1341 < $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 --to-destination ${NET2}${PORT2} -i $DEV --- > $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 $DEST --to-destination ${NET2}${PORT2} -i $DEV Short description: - edit the test of the arguments of FW_FORWARD_MASQ and add the variable DEST for the IP adress on the firewall - add line for test the variable DEST, if set add '-d ' for later use in the iptables command - edit the iptables command for PREROUTING; added the DEST variable And the point 14 in /etc/sysconfig/SuSEfirewall2 gets a fifth argument: The IP adress on that the firewall listen on the ext-interface, e.g. a www-server: FW_FORWARD_MASQ="0/0,192.168.13.130,tcp,80,80,<public IP adress on ext-interface>" Warning: With that parameter file u can't start the unpachted SuSEfirewall2 script because it controlls how many arguments are given. btw. of cource you must configure the public IP adress on the firewall-box (/etc/sysconfig/network ...)! I test this config but maybe there are some points I can't see with my config... Comments are welcome... Greetings Kai

1 0

sendmail with SMTP-Authentication for roaming users...
by Info 27 May '02

27 May '02

Hi! I´ve Suse 8.0, installed sendmail with TLS and Auth... this works fine... but my problem: I want to allow smtp-relaying only for authenticated users... (that have dynamic ip). I can´t find the right configuration or documentation to do this.... Can someone help me? another question: I where nice to have TLS on POP3 also... any suggestions about? greetings from vienna... André

3 2

Re: [suse-security] Securing SuSE Linux 7.3 (fwd)
by Markus Gaugusch 27 May '02

27 May '02

---------- Forwarded message ---------- Date: Thu, 23 May 2002 11:15:19 +0200 From: Albert Brandl <albert.brandl(a)lindeverlag.at> To: Markus Gaugusch <markus(a)gaugusch.at> Subject: Re: [suse-security] Securing SuSE Linux 7.3 On Tue, May 21, 2002 at 05:08:37PM +0200, Markus Gaugusch wrote: > > dd if=/dev/sda of=/dev/sdb bs=16M > You will have two problems with this: > Minor: Only data lost during the last week can be restored. If you delete > a file, go on holiday for two weeks and want to restore it later, > there is no chance. > Major: Changes in the filesystem during this "backup" will most likely > ruin your copy ... ! Another problem is that this setup does not protect you against most disasters. If e.g. your computer catches fire, chances are that your second harddisk does not survive this. If someone carries your computer away, he/she won't leave the second disk so that you can restore from it. It's thus a good idea to save backups offsite. It's also crucial to have more than one backup - "Unix Backup & Recovery" (W. Curtis Preston, O'Reilly 1999) gives a very good introduction to the subject. There are several open source products for backing up stuff. If you want to use cdroms, see e.g. http://mondo.soureforge.net. We are using AMANDA for backing up to DAT and DLT tapes. AMANDA is also included in the SuSE distribution, see http://www.amanda.org for an introduction (I've found the FAQ-o-matic quite helpful for configuring my system). Best regards, Albert

5 5

Spamming ...
by Martin Schichl 27 May '02

27 May '02

Morning! Since some days I get Returned Mails from unknown mail-users which seems that someone is spamming from our machine. But when i analyze the header of the original mail i fin a line: >> Received: from 210.97.42.1 (HELO scc.co.at) (210.97.42.1) << Although the IP of scc.co.at is 193.81.182.39 The IP 210.97.42.1 will change permanently when reading other similar mails. My questions: 1) Is it possible that someone beoke into our machine and sent this mail directly over scc.co.at 2) What can I do to stop those spammers ... ThanX Martin The header file of the original Message --------------------------------------------------------------- X-Track: 92154: 2 X-Rocket-Spam: 210.97.42.1 X-YahooFilteredBulk: 210.97.42.1 Return-Path: <rjnr3245i37(a)scc.co.at> Received: from 210.97.42.1 (HELO scc.co.at) (210.97.42.1) by mta514.mail.yahoo.com with SMTP; 28 Feb 2002 15:32:36 -0800 (PST) Reply-To: <rjnr3245i37(a)scc.co.at> Message-ID: <001a07e37abc$2777d8d5$6ce83be4@lplwmr> From: <rjnr3245i37(a)scc.co.at> To: <doctorbutcher(a)yahoo.com> --------------------------------------------------------------- ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

9 12

Install harden_suse
by oliver.z 27 May '02

27 May '02

Hey security team I am new in the Linux-world and would like to have some support in installing harden_suse. How I install it and with what switch-options? thnxs Oliver

2 1

Checking Firewall Log
by Majid Leo 26 May '02

26 May '02

How can I check the personal firewall log to see for the IP addresses been stopped? Thanks

1 0

Fast OnlineUpdate for SuSE - fou4s 0.5.0
by Markus Gaugusch 26 May '02

26 May '02

Fou4s is a replacement for YaST OnlineUpdate, with cronjob support and many more features. The new version is available at http://fou4s.gaugusch.at/ >From the changelog: * Fixes for 0.4.1: + UseFullPath installation fixed + Cleanup of packagelist directory fixed (missed some package descriptions) * Config file /etc/fou4s has been renamed to fou4s.conf * New options: --proxy, --noproxy * New option --all downloads all available updates (no checking) for network installations of fou4s). * New option --auto: Automatic installation of packages specified in config file. All other packages are only downloaded, like fou4s -ue. * Fou4s GPG key download moved from rpm installation to fou4s itself. There is also an entry at freshmeat.net, where you can subscribe for notifications about new versions of fou4s. Only major new versions are announced here. Usually an update version is released a few days after a major release, because of the large number of people finding bugs. Bugs and workarounds (if possible) are announced on the fou4s webpage. regards, Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

Re: [suse-security] RE: Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 25 May '02

25 May '02

Hallo Michael, yes, so it is, but I can't change the options of the client-software, it is written for external users of the IRC-Server. I need the program for log all traffic on the IRC and to look for someone, who want to talk to me as operator. So I need the variable to deaktivate the option "SuSE-FW-NO_ACCESS_INT->FWEXT ". In which configuration-file or script is it activatet? Best regards, Jost Schöler ____________________________________________________________________________ ________________ Die IRC-Client-Software soll eigentlich auf eine Adresse im Deinem Netzwerk zugreifen, geht jetzt aba über Deinen Router/Firewall auf eine externe IP. Dann ist es wohl eher 'ne Einstellungsfrage der Client-Software. Ciao Michael ____________________________________________________________________________ _____

5 4

mtr bandwidth
by Ricardo Javier Aranibar León 25 May '02

25 May '02

Hi list, I hope that somebody can help me. I work in enterprise about telecomunications (VoIP) and I need monitor our networks and verify that packets aren't lost. I installed mtr and I create my own scripts for execute whit my crontab every two minutes IP's 64 and every three minutes IP 209. I using five scripts diferents for each site. my scripts its: 1)mtr -rc 100 209.xxx.xxx.xxx >>209.txt 2)mtr -rc 100 64.xxx.xxx.1xx >>64-1.txt 3)mtr -rc 100 64.xxx.xxx.2xx >>64-2.txt 4)mtr -rc 100 64.xxx.xxx.3xx >>64-3.txt 5)mtr -rc 100 64.xxx.xxx.4xx >>64-4.txt But I don't know why in my switch ocuppy quite bandwidth? I need reduce that my tool monitor netword (mtr) the use of bandwidth. If somebody can help me I will thankfull. PD:Sorry for my grammar enghish I talk spanish but I understand Enghis :-) _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

1 0

Treason uncloacked
by Cosimo Longo 24 May '02

24 May '02

In log /var/log/firewall when appear May 22 07:43:36 linux kernel:[]: UDP: bad checksum. From 213.45.9.26:137 to 193.111.78.10:137 ulen 58 May 22 11:43:44 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.42.26:2249/80 shrinks window 486804554:486805020. Repaired. May 22 12:12:39 linux kernel:[]: eth0: Media Link Off May 22 12:13:09 linux kernel:[]: eth0: Media Link On 100mbps full-duplex May 22 18:19:23 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:1443/80 shrinks window 4048139603:4048140058. Repaired. May 22 18:19:23 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:1443/80 shrinks window 4048139603:4048140058. Repaired. May 23 03:07:50 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:2707/80 shrinks window 3193903114:3193903815. Repaired. May 23 03:31:43 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:3420/80 shrinks window 420693197:420693833. Repaired. May 23 03:46:30 linux kernel:[]: TCP: Treason uncloaked! Peer 217.159.15.253:3624/80 shrinks window 1357152501:1357152829. Repaired. the system crash an reboot. I ave activated syn_flood_protection but d'ont work. Please help my.

1 0