November 2003 - openSUSE Security - openSUSE Mailing Lists

Firewall script
by Luc MAIGNAN 27 Nov '03

27 Nov '03

Hi list, I need to configure a IPTABLES-based Linux router. Has anyone a sample script to do this to win some time ??? Any help would be appreciated Best regards

5 4

RE: Re: [suse-security] Firewall script
by Barry Gill 27 Nov '03

27 Nov '03

Axel Sintermann <Axel.Sintermann(a)MATERNA.de> wrote the Nov 27, 2003 3:45 PM: > Would you mind to mention what kind of instance this was? > Sure. I needed to terminate Microsoft PPTP VPN on an internal machine running MS PPTP VPN Server. The Susefirewall2 script allows you to terminate these sessions on the firewall directly with no problem. My problem was that I needed the MS Authentication to occur and being a firewall, I did not want to run SMB or allow the FW to query the auth to the NT system. I set up an allow rule for the IP addesses of the various users (simple because all had fixed IP) Then I installed a little script (pptpproxy) ala freshmeat. (I had a look at this dudes code and it is very neat and clean - ok, so I am no programmer, but it looks pretty good) To run the PPTPROXY, I configured ini /etc/sysconfig/SuSEfirewall2 [snip] # Common: ssh smtp domain FW_SERVICES_EXT_TCP="1721" ## Type: string # Common: domain syslog FW_SERVICES_EXT_UDP="" # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="gre" [/snip] and did the same for FW_SERVICES_DMZ_IP This did allow me to run a very neat little app that proxied the connection between interfaces. (could use this for any number of protocols (gre=47) > I still don't know how to use the > iptables -I OUTPUT --match owner --uid-owner foobar [...] > feature _within_ SuSEfirewall2 (SuSE 8.1). > > (No problem to do this separately from SuSEfirewall2; the solution > is right there above.) Yup, the real problem was that SuSEfirewall2 did not allow that to be configured, I didn't want (eventually) to use the direct IPtables commands as if I am not available and somebody else has to admin the box that type of stuff gets forgotten. Keep it simple and it is supportable by a number of people. > Hints, anybody? no more from me sorry, anyone else?

1 0

Fw: [suse-security] Firewall script
by Mario 27 Nov '03

27 Nov '03

----- Original Message ----- From: "Mario" <webmaster(a)oggi.it> To: "Luc MAIGNAN" <contact(a)winxpert.com> Sent: Thursday, November 27, 2003 8:43 AM Subject: Re: [suse-security] Firewall script > Shorewall is a good idea .... > > http://www.shorewall.net/ > > > > ----- Original Message ----- > From: "Luc MAIGNAN" <contact(a)winxpert.com> > To: <suse-security(a)suse.com> > Sent: Wednesday, November 26, 2003 10:27 PM > Subject: [suse-security] Firewall script > > > > Hi list, > > > > I need to configure a IPTABLES-based Linux router. Has anyone a sample > > script to do this to win some time ??? > > > > Any help would be appreciated > > > > Best regards > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > >

1 0

RE: [suse-security] Firewall script
by Barry Gill 27 Nov '03

27 Nov '03

Luc MAIGNAN <contact(a)winxpert.com> wrote the Nov 26, 2003 11:27 PM: > I need to configure a IPTABLES-based Linux router. Has anyone a sample > script to do this to win some time ??? I still find that the config file for SuSEfirewall2 is the most simple way to manage an iptables/netfilter firewall. Works like a bomb, thanks to the SuSE team for putting loads of examples and configuration hints into the config. Flat file means you can ALWAYS remotely admin your firewall very simply. I have also only come across ONE single instance of not being able to do what I need to in the firewall script, and that is passing non-tcp/udp traffic through to an internal machine, i.e. vpn using gre to ms box.

1 0

accounting in ifconfig
by Frank Stuehmer 26 Nov '03

26 Nov '03

Hi, in one of my servers (Suse 8.2) traffic statistic from the provider I have suddenly much more traffic as expected. Some weeks I have only a few MB a day, since some days the provider shows 1 GB daily. All logfiles appear normal. No more running services as expected. Is the counter from ifconfig eth0 right? Can I trust this numbers? There are much less bytes transfered as the provider statistic shows. (1:10) Could someone explain where cause the difference ? Thanks, Frank

2 3

RE: [suse-security] Disabling remote root login
by Barry Gill 26 Nov '03

26 Nov '03

Watson Michael <MWatso(a)lsuhsc.edu> wrote the Nov 25, 2003 4:21 PM: > I was eventually able to disable remote root logins via ssh by setting > "PermitRootLogin" to "no" in /etc/ssh/sshd_config, but I'm still curious why > the settings in securetty don't seem to be working. Can anyone point out > what I'm missing? AFAIK, the securetty settings are ONY for TTY's, not PTY's. Somebody correct me if I am wrong. You can check to see if root is permitted to login to the TTY's on your machine...

1 0

Intrusion
by Antun Balaz 26 Nov '03

26 Nov '03

Hi to all, it seems that I have a serious problem, although I updated my SuSE 8.1 server quite recently (all security updates were applied). I have two questions: 1) What to do right now to prevent any misconduct of my server? 2) How to clean up the server? Description of the problem: one of my users (mvasilic) noticed that someone from IP 81.196.122.7 logged to his account (that IP originates from Romania, and we are in Serbia). Close inspection shows that indeed someone was logged to our server from that IP, and obviously was running some kind of a rootkit: ------------------------------------------------------------------------ octopus:~ # ps aux | grep mvasilic mvasilic 6620 0.0 0.2 1644 580 ? S Nov22 0:00 bash mvasilic 3241 0.0 0.0 1380 4 ? S Nov22 0:00 ./root root 11279 0.0 0.2 1624 600 pts/1 S 16:10 0:00 grep mvasilic ---------------------------------------------------------------------- In the /tmp directory there are several interesting files: ----------------------------------------------------------------------- octopus:/tmp # ls -l | grep mvasilic drwxr-xr-x 3 mvasilic users 72 2003-11-22 20:26 -rw-r--r-- 1 mvasilic users 0 2003-11-22 13:30 982235016-gtkrc-429249277 -rw-r--r-- 1 mvasilic users 4215 2003-11-22 21:08 lstermcap -rwxr-xr-x 1 mvasilic users 5410 2003-11-22 21:11 own.so -rw-r--r-- 1 mvasilic users 453 2003-11-22 21:10 report -rw-r--r-- 1 mvasilic users 58 2003-11-22 21:10 suidprogs ---------------------------------------------------------------------- File report says: ---------------------------------------------------------------------- octopus:/tmp # cat report RwX Super Linux Xploit report : ======================================== .o. The scanner found /usr/bin/lpr could be xploitable. .o. The scanner found /usr/X11R6/bin/X could be exploitable. .o. The scanner found /usr/bin/crontab could be xploitable. .o. The scanner found /bin/mount could be exploitable. This script was originally scripted by so1o(a)insecurity.org Modifications to Linux by Kbyte(a)biogate.com 2 bugs found. --------------------------------------------------------------------- There is also the directory ' ', which contains directory s: --------------------------------------------------------------------- octopus:/tmp/ /s # ls -l total 48 drwxr-xr-x 3 mvasilic users 144 2003-11-22 20:42 . drwxr-xr-x 3 mvasilic users 72 2003-11-22 20:26 .. drwxr-xr-x 9 mvasilic users 376 2003-01-14 14:34 .haos -rwxr-xr-x 1 mvasilic users 37162 2003-07-19 22:37 c -rwxr-xr-x 1 mvasilic users 35 2003-05-19 12:40 s -rwxr-xr-x 1 mvasilic users 29 2003-05-17 04:46 t -------------------------------------------------------------------- Directory .haos is a very rich one: ------------------------------------------------------------------- octopus:/tmp/ /s/.haos # ls -l total 146 drwxr-xr-x 9 mvasilic users 376 2003-01-14 14:34 . drwxr-xr-x 3 mvasilic users 144 2003-11-22 20:42 .. drwxr-xr-x 2 mvasilic users 120 2002-05-12 05:16 FTP -rwxr-xr-x 1 mvasilic users 15633 2002-02-01 04:18 dat1 -rwxr-xr-x 1 mvasilic users 21794 2002-02-01 04:18 dat2 drwxr-xr-x 3 mvasilic users 96 2002-05-11 13:43 haos1 drwxr-xr-x 3 mvasilic users 96 2002-05-11 11:00 haos2 -rwxr-xr-x 1 mvasilic users 14380 2002-02-01 05:24 haosp -rwxr-xr-x 1 mvasilic users 16500 2002-02-01 05:17 haosv -rwxr-xr-x 1 mvasilic users 1560 2002-02-01 04:18 haosx drwxr-xr-x 6 mvasilic users 1920 2002-03-30 05:30 libpcap-0.6.2 drwxr-xr-x 11 mvasilic users 392 2003-01-07 00:26 massrooter drwxr-xr-x 2 mvasilic users 272 2002-10-02 15:31 nebunu drwxr-xr-x 2 mvasilic users 408 2002-01-12 18:00 strobe -rwx------ 1 mvasilic users 64652 2002-04-01 19:45 superwu ---------------------------------------------------------------- And so on. Please, help! Best regards, Antun Balaz Institute of Physics, Belgrade Serbia and Montenegro

8 12

Disabling remote root login
by Watson, Michael 25 Nov '03

25 Nov '03

Greetings! I am experimenting with SuSE 9.0 professional and have encountered something I don't understand. I have disabled telnet, allowing only ssh for remote logins. Problem is, I can ssh from Windows using putty to the test computer and login remotely as root, even though my /etc/securetty includes only entries for tty1 through tty6. I don't want to allow remote root logins. I did find a reference elsewhere to a similar problem, which was caused by /etc/pam.d/login having its lines for pam_securetty.so and pam_nologin.so commented out. I've checked my /etc/pam.d/login, and the relevant lines read: auth required pam_securetty.so auth required pam_nologin.so I was eventually able to disable remote root logins via ssh by setting "PermitRootLogin" to "no" in /etc/ssh/sshd_config, but I'm still curious why the settings in securetty don't seem to be working. Can anyone point out what I'm missing? Thanks, Michael Watson mwatso(a)lsuhsc.edu

2 1

Re: [suse-security] Disabling remote root login
by Quintin Womack 25 Nov '03

25 Nov '03

Add "auth required /lib/security/pam_listfile.so item=user sense=allow file=/etc/sshusers onerr=fail" to /etc/pam.d/sshd touch /etc/sshusers chmod 600 /etc/sshusers Add "username" to /etc/sshusers where username is the authorized user you would want to be able to login. In the above "auth required..." line, "onerr" can also have a value of succeed. It depends on how you want the machine to react. Hope this helps. Quintin Womack -----Original Message----- From: "Watson, Michael" <MWatso(a)lsuhsc.edu> Sent: Nov 25, 2003 9:21 AM To: "'suse-security(a)suse.com'" <suse-security(a)suse.com> Subject: [suse-security] Disabling remote root login Greetings! I am experimenting with SuSE 9.0 professional and have encountered something I don't understand. I have disabled telnet, allowing only ssh for remote logins. Problem is, I can ssh from Windows using putty to the test computer and login remotely as root, even though my /etc/securetty includes only entries for tty1 through tty6. I don't want to allow remote root logins. I did find a reference elsewhere to a similar problem, which was caused by /etc/pam.d/login having its lines for pam_securetty.so and pam_nologin.so commented out. I've checked my /etc/pam.d/login, and the relevant lines read: auth required pam_securetty.so auth required pam_nologin.so I was eventually able to disable remote root logins via ssh by setting "PermitRootLogin" to "no" in /etc/ssh/sshd_config, but I'm still curious why the settings in securetty don't seem to be working. Can anyone point out what I'm missing? Thanks, Michael Watson mwatso(a)lsuhsc.edu

1 0

Re: [suse-security] Disabling remote root login
by Quintin Womack 25 Nov '03

25 Nov '03

Add "auth required /lib/security/pam_listfile.so item=user sense=allow file=/etc/sshusers onerr=succeed" to /etc/pam.d/sshd touch /etc/sshusers chmod 500 /etc/sshusers Add "username" to /etc/sshusers where username is the authorized user you would want to be able to login. Hope this helps. Quintin Womack -----Original Message----- From: "Watson, Michael" <MWatso(a)lsuhsc.edu> Sent: Nov 25, 2003 9:21 AM To: "'suse-security(a)suse.com'" <suse-security(a)suse.com> Subject: [suse-security] Disabling remote root login Greetings! I am experimenting with SuSE 9.0 professional and have encountered something I don't understand. I have disabled telnet, allowing only ssh for remote logins. Problem is, I can ssh from Windows using putty to the test computer and login remotely as root, even though my /etc/securetty includes only entries for tty1 through tty6. I don't want to allow remote root logins. I did find a reference elsewhere to a similar problem, which was caused by /etc/pam.d/login having its lines for pam_securetty.so and pam_nologin.so commented out. I've checked my /etc/pam.d/login, and the relevant lines read: auth required pam_securetty.so auth required pam_nologin.so I was eventually able to disable remote root logins via ssh by setting "PermitRootLogin" to "no" in /etc/ssh/sshd_config, but I'm still curious why the settings in securetty don't seem to be working. Can anyone point out what I'm missing? Thanks, Michael Watson mwatso(a)lsuhsc.edu

1 0