May 2002 - openSUSE Security - openSUSE Mailing Lists

Problem with harden_suse
by Ricardo Javier Aranibar León 17 May '02

17 May '02

Hi my friends, I read that if I like a server secure I need install harden_suse. Yesterday I installed harden_suse-3.5-0.noarch.rpm, in my server I have Apache, my database in Postgresql, my scripts cron and my OS is SuSE 7.3 and kernel 2.4.4-4GB but now I have two problems: 1.- I restarted my machine and my services apache and postgres didn't to initialize I have to write as a root:rcpostgres start and rcapache start this method it's slow my work, I need information about a command that initialize my services, chkconfig didn't function if someone can to provide me about a command equal chkconfig I will thankfull. 2.- Before, that I installed harden_suse I worded fine with PostgreSQL I connected as user postgres with: #su - postgres and execute #psql hb and I entered to my Data base, but after that I installed harden_suse I can't connect as user postgres when I writted: su - postgres in my pront didn't show me postgres:~# I don't know what happend,maybe I executed postmaster and I have this message: "root execution of PostgreSQL backend is not permitted. The backend must be started under its own userid to prevent a possible system security comprise. See the Install file for more information on how properly start the postmaster". I try to execute as root: #psql hb I have this message:"psql: FATAL 1 :SetUserId: user "root" is not in pg_shadow". Before, I dind't have this problems I think that harden_suse cause this errors if someone can help me I will be thankfull, because I didn't enter to my database and this is important for me. Please help me Thansks :-( _________________________________________________________________ Descargue GRATUITAMENTE MSN Explorer en http://explorer.yupimsn.com/intl.asp.

5 4

multiple NAT
by Omppu 17 May '02

17 May '02

Hello i am sick and tired of intervally changing operators and ip addresses for my production environment... ive known for a long time that i can do NAT but i am a little bit worried on the load it would cause on the firewall and then again how efficient and easy to maintain it would be. i have a half a C class of Public IP addresses of which about 70 are very active, at best the bandwidth continuous capacity consumption reaches up to 800kb/sec now i have SuSE 7.3 with the latest patches (kernel is the default that comes with the installation) and i intent to use SuSEFirewall 2 on a dual pentium 450mhz with 128mb ram now the question is how can i do so that i have about 40 servers with private addresses in the inside with all sorts of services starting from ftp, telnet, ssh, dns, pop, smtp, imap, stream, http, sms, terminal services, pptp, etc etc how can i configure about 128 IP addresses with NAT to private internal addresses to all ports and port restrictions and what is the most feasible setup regards O.

5 5

Re: [suse-security] NTP über Firewall
by Comptek informatik AG - R. Klippel 17 May '02

17 May '02

At 10:22 17.05.2002 +0200, Michael Seewald wrote: >On Fri, 17 May 2002, Wilfried Philippi wrote: > > ich möchte mit xntp über die Firewall auf meinem Server die Zeit updaten. > > > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl ausser Port > 37 noch > > einen anderen Port brauche. > >If I remember correctly, you need >FW_SERVICES_EXT_UDP="ntp" > >Regards, >Michael > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here Hi, probier mal folgendes in der Konsole oder auch in einem Xterm Fenster # ntpdate -s -u <timeserver.tld> Die beiden Parameter sind meines Wissens für das Überwinden der Firewall notwendig. Mit freundlichen Grüssen Comptek informatik AG Reinhardt Klippel ________________________________ Comptek informatik AG Poststrasse 9 CH-6300 Zug Tel. ++41 +41 720 20 90 Fax ++41 +41 720 20 99 http://www.comptek.ch ________________________________

1 0

RE: [suse-security] NTP über Firewall
by Reckhard, Tobias 17 May '02

17 May '02

Note that this is an english-speaking list. > ich möchte mit xntp über die Firewall auf meinem Server die > Zeit updaten. It's usually also a good idea to have firewalls synchronised to global time as well. > Wenn ich die Firewall abschalte ( alle chains geflusht ) > läuft nntpdate ganz > normal Mit eingeschalteter Firewall meldet mir ntpdate > Segmentation Errors und > bricht ab. That's seems strange to me, ntpdate should fail, saying that it can't find any suitable servers for synchronisation. It should not segfault. > Meine Firewall regeln sind: > /sbin/iptables -A OUTPUT -o eth1 -m tcp -p tcp -s $SELF > --dport 37 -j ACCEPT # > ntp > /sbin/iptables -A INPUT -i eth1 -m tcp -p tcp -d $SELF > --sport 37 -j ACCEPT # > ntp > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl > ausser Port 37 noch > einen anderen Port brauche. You definitely need further rules for NTP. NTP servers listen only on UDP port 123 (no TCP is used, further clarifying what Roman already said). (x)ntpd uses UDP 123 as its source port as well, while ntpdate allocates a high port (i.e. one above 1023) as its query source port. Tobias

1 0

SMTP and POP3 Proxy
by Fiorenza Meini 17 May '02

17 May '02

Hi there! Does anyone know about a SMTP proxy and a POP3 proxy? I'm configuring a firewall and I'd like to use proxy for WWW, FTP, SMTP and POP3; so I'm using squid, ftp proxy from SUSE proxy suite and....I can't find anything for SMTP and POP3. Thanks Fiorenza

4 4

RE: [suse-security] multiple NAT
by Reckhard, Tobias 17 May '02

17 May '02

> now i have SuSE 7.3 with the latest patches (kernel is the > default that comes with the installation) Isn't that one susceptible to the SYN-Cookie vulnerability? If so, you might want to deactivate them. > and i intent to use SuSEFirewall 2 on a dual pentium 450mhz > with 128mb ram Does anyone know if the Linux kernel or, more specifically, netfilter actually benefits from a multi-processor box? I wouldn't expect it to, but I haven't looked at the code (nor am I a coder of any worth). > now the question is how can i do so that i have about 40 > servers with private addresses in the inside > > with all sorts of services starting from ftp, telnet, ssh, > dns, pop, smtp, imap, stream, http, sms, terminal services, > pptp, etc etc > > how can i configure about 128 IP addresses with NAT to > private internal addresses to all ports and port restrictions > > and what is the most feasible setup Well, you're out for opinions, so here's mine. I try to avoid NAT where I can. IMHO, it makes things easy in the short term when prior planning of IP layout was short-sighted and has failed and IP system administration is bad as well and the cost of modifications is high. It doesn't solve the problems but only reduces the impact of the symptoms. However, NAT is complicated and confusing, and thereby tends to turn into an administrative nightmare of its own after a while. Add to that the problems that numerous protocols have with NAT and which force you to use helper applications (the kernel nat modules) that I have rather bad feelings about in general concerning their security, and which quite often don't get the protocol working as (well as) it would without NAT. NAT is fine in small scenarios, where the cost of official IP addresses matters (this means all you home users), where you can't use proxies instead or where substantial cost can be avoided by introducing it (such as connecting a couple of networks of two administratively independent organisations, but that's quite a can of beans in and of itself, security-wise). Tobias

1 0

RE: [suse-security] proftpd and exe uploads
by Peer Stefan 17 May '02

17 May '02

hi > From: Carlos [mailto:linux@lpis.com] > For securiy reasons i want to deny, in my suse proftpd > server, the *.exe > files uploads. > is this posible? > can anybody says me how? PathDenyFilter "\.exe$" should do the trick. > thanks you're welcome ;) stefan

1 0

RE: [suse-security] SMTP and POP3 Proxy
by Peer Stefan 17 May '02

17 May '02

From: Hipolito A. Gonzalez M. [mailto:hgonzale@cantv.net] > Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT .... or an application gateway. for mail you can use fetchmail (pop) and any mta, which works as relay-agent. just be carefull in setting up relaying. regards, stefan

1 0

Auto Online Update!?!
by mario ohnewald 17 May '02

17 May '02

Hallo! Can suse do a Auto online update automatically, lets say every day or something? If yes, where is the option, or how do i do that then? ;) Cheers Mario

2 1

RE: [suse-security] SMTP and POP3 Proxy
by Reckhard, Tobias 17 May '02

17 May '02

> Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT Huh?! No way, dude, you're way out on this one. A proxy server is a broker between client and server, acting as a server towards the client and issuing its requests to the server, thereby acting as a client there. It's a concept and in no way restricted to certain application protocols based on TCP/IP. However, some protocols make it easier to use proxies than others. NAT is an entirely different concept. Tobias

1 0