November 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] FreeSwan <-> CheckPoint
by J J 04 Nov '03

04 Nov '03

Yes. The lookup of PSKs in ipsec.secrets uses "leftid" not "left" if it can. It's confusing because if you don't set "leftid" then it will default to the same value as "left"! Your rightupdown will probably not do anything and doesn't need to be there, probably justs adds confusion to people reading the ipsec.conf file! Possibly rightid doesn't carry over to Checkpoint too... Carl >From: "Thorsten Marquardt" <thom(a)kaupp.chemie.uni-oldenburg.de> >To: suse-security(a)suse.com >Subject: [suse-security] FreeSwan <-> CheckPoint Date: Tue, 4 Nov 2003 >16:24:42 +0000 (MEST) > >Hi, > >I need to build an ipsec tunnel between CheckPoint and FreeSwan. >The policy of my communication partner froces me to use presharedkeys > >If we try to negotiate the connection the following messages shows >up in /var/log/messages > > >Nov 4 15:56:08 mail Pluto[2450]: packet from aaa.bbb.ccc.ddd:500: ignoring >Vendor ID payload >Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: responding to Main Mode >Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: Can't authenticate: no >preshared key. Attri >Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: no acceptable Oakley >Transform > >with /etc/ipsec.conf like: ># sample connection >conn here-there > # Left security gateway, subnet behind it, next hop toward right. > type=tunnel > authby=secret > keylife=1440 > ikelifetime=6h > keyexchange=ike > auth=esp > pfs=no > leftid=@.... > left=www.xxx.yyy.zzz > leftnexthop=www.xxx.yyy.zzx > leftsubnet=192.168.1.0/24 > leftupdown=/usr/lib/ipsec/_updown.cust > # Right security gateway, subnet behind it, next hop toward left. > right=aaa.bbb.ccc.ddd > rightupdown=/usr/lib/ipsec/_updown.cust > rightid=@---- > rightsubnet=10.1.0.0/16 > # To authorize this connection, but not actually start it, at >startup, > # uncomment this. > auto=add > keyingtries=1 > >and > >/etc/ipsec.secrets like: > >[...] ># Must be same on both; generate on one and copy to the other. >aaa.bbb.ccc.ddd www.xxx.yyy.zzz : PSK "Rumpelstielzchen" > > > ># RSA private key for this host, authenticating it to any other host ># which knows the public part. Put ONLY the "pubkey" part into connection ># descriptions on the other host(s); it need not be kept secret. >: RSA { >[...] >} > >What may go wrong? Any hints are welcome. > >Yours sincerly > > Thom > > > >-- > >------------------------------------------------------------------- >bye bye (c) by Thom | Thorsten Marquardt > | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de > | Member of the pzt project. > | http://kaupp.chemie.uni-oldenburg.de/pzt >------------------------------------------------------------------- > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > _________________________________________________________________ Tired of 56k? Get a FREE BT Broadband connection http://www.msn.co.uk/specials/btbroadband

1 0

FreeSwan <-> CheckPoint
by Thorsten Marquardt 04 Nov '03

04 Nov '03

Hi, I need to build an ipsec tunnel between CheckPoint and FreeSwan. The policy of my communication partner froces me to use presharedkeys If we try to negotiate the connection the following messages shows up in /var/log/messages Nov 4 15:56:08 mail Pluto[2450]: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: responding to Main Mode Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: Can't authenticate: no preshared key. Attri Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: no acceptable Oakley Transform with /etc/ipsec.conf like: # sample connection conn here-there # Left security gateway, subnet behind it, next hop toward right. type=tunnel authby=secret keylife=1440 ikelifetime=6h keyexchange=ike auth=esp pfs=no leftid=@.... left=www.xxx.yyy.zzz leftnexthop=www.xxx.yyy.zzx leftsubnet=192.168.1.0/24 leftupdown=/usr/lib/ipsec/_updown.cust # Right security gateway, subnet behind it, next hop toward left. right=aaa.bbb.ccc.ddd rightupdown=/usr/lib/ipsec/_updown.cust rightid=@---- rightsubnet=10.1.0.0/16 # To authorize this connection, but not actually start it, at startup, # uncomment this. auto=add keyingtries=1 and /etc/ipsec.secrets like: [...] # Must be same on both; generate on one and copy to the other. aaa.bbb.ccc.ddd www.xxx.yyy.zzz : PSK "Rumpelstielzchen" # RSA private key for this host, authenticating it to any other host # which knows the public part. Put ONLY the "pubkey" part into connection # descriptions on the other host(s); it need not be kept secret. : RSA { [...] } What may go wrong? Any hints are welcome. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0

RE: [suse-security] FreeSwan <-> CheckPoint
by Michael Ryan 04 Nov '03

04 Nov '03

Thom, have a look here: http://www.fw-1.de/aerasec/ng/vpn-freeswan/CP-FW1-NG+Linux-FreeSWAN-Gate way.html might be of some use ... Michael -----Original Message----- From: Thorsten Marquardt [mailto:thom@kaupp.chemie.uni-oldenburg.de] Sent: Tuesday, November 04, 2003 4:25 PM To: suse-security(a)suse.com Subject: [suse-security] FreeSwan <-> CheckPoint Hi, I need to build an ipsec tunnel between CheckPoint and FreeSwan. The policy of my communication partner froces me to use presharedkeys If we try to negotiate the connection the following messages shows up in /var/log/messages Nov 4 15:56:08 mail Pluto[2450]: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: responding to Main Mode Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: Can't authenticate: no preshared key. Attri Nov 4 15:56:08 mail Pluto[2450]: "here-there" #8: no acceptable Oakley Transform with /etc/ipsec.conf like: # sample connection conn here-there # Left security gateway, subnet behind it, next hop toward right. type=tunnel authby=secret keylife=1440 ikelifetime=6h keyexchange=ike auth=esp pfs=no leftid=@.... left=www.xxx.yyy.zzz leftnexthop=www.xxx.yyy.zzx leftsubnet=192.168.1.0/24 leftupdown=/usr/lib/ipsec/_updown.cust # Right security gateway, subnet behind it, next hop toward left. right=aaa.bbb.ccc.ddd rightupdown=/usr/lib/ipsec/_updown.cust rightid=@---- rightsubnet=10.1.0.0/16 # To authorize this connection, but not actually start it, at startup, # uncomment this. auto=add keyingtries=1 and /etc/ipsec.secrets like: [...] # Must be same on both; generate on one and copy to the other. aaa.bbb.ccc.ddd www.xxx.yyy.zzz : PSK "Rumpelstielzchen" # RSA private key for this host, authenticating it to any other host # which knows the public part. Put ONLY the "pubkey" part into connection # descriptions on the other host(s); it need not be kept secret. : RSA { [...] } What may go wrong? Any hints are welcome. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt ------------------------------------------------------------------- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

suse to be bought by novell
by Andreas Bittner 04 Nov '03

04 Nov '03

http://www.suse.de/de/company/press/press_releases/archive03/novell_suse.ht… http://linuxtoday.com/it_management/2003110401526NWBZSS http://news.google.com/news?hl=en&edition=us&q=suse+novell no comment

3 2

RE: [suse-security] Trace user logins in SAMBA
by Lovette Burland 04 Nov '03

04 Nov '03

Try the link below for info http://www.oreilly.com/catalog/samba/chapter/book/ch04_08.html -----Original Message----- From: João Reis [mailto:joao.reis@2000comp.pt] Sent: 04 November 2003 10:32 To: suse-linux-e(a)suse.com; suse-security(a)suse.com Subject: [suse-security] Trace user logins in SAMBA Hi to all I have read a lot of documentation but i cannot find a way to track user logins, from a Windows machine, in Samba. Does the log parameter in the smb.conf file does the job. I have the log files of the machines present (log.%m) but they do not register the time when the users login and logout. is there a way to register this information? Thanks -- \|/ "Do or do not. There is no try" - Yoda \|/ |==============================================| | 2000Comp - Consultoria e Informática, Lda | | Tel: +351 22 941 99 32 | \|/ | Fax: +351 22 941 99 34 | \|/ O | www: http://www.2000comp.pt | O -|--| |--|- \| | João Reis | |/ / \ |==============================================| / \ ========================================================== -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here _____________________________________________________________________ This message has been checked for all known viruses on behalf of Vivista by MessageLabs. http://www.messagelabs.com or Email: mailsweeper.info(a)vivista.co.uk Vivista formerly Securicor Information Systems for further information http://www.vivista.co.uk ********************************************************************** The information contained in this e-mail message is intended only for the individuals named above. If you are not the intended recipient, you should be aware that any dissemination, distribution, forwarding or other duplication of this communication is strictly prohibited. The views expressed in this e-mail are those of the individual author and not necessarily those of Vivista Limited. Prior to taking any action based upon this e-mail message you should seek appropriate confirmation of its authenticity. If you have received this e-mail in error, please immediately notify the sender by using the e-mail reply facility. ********************************************************************** _____________________________________________________________________ This message has been checked for all known viruses on behalf of Vivista by MessageLabs. http://www.messagelabs.com or Email: mailsweeper.info(a)vivista.co.uk Vivista formerly Securicor Information Systems for further information http://www.vivista.co.uk

1 0

Trace user logins in SAMBA
by João Reis 04 Nov '03

04 Nov '03

Hi to all I have read a lot of documentation but i cannot find a way to track user logins, from a Windows machine, in Samba. Does the log parameter in the smb.conf file does the job. I have the log files of the machines present (log.%m) but they do not register the time when the users login and logout. is there a way to register this information? Thanks -- \|/ "Do or do not. There is no try" - Yoda \|/ |==============================================| | 2000Comp - Consultoria e Informática, Lda | | Tel: +351 22 941 99 32 | \|/ | Fax: +351 22 941 99 34 | \|/ O | www: http://www.2000comp.pt | O -|--| |--|- \| | João Reis | |/ / \ |==============================================| / \ ==========================================================

1 0

Problem with IPSec and SuSEfirewall2 SuSE-FW-ILLEGAL-TARGET
by R. Peters 03 Nov '03

03 Nov '03

Hi, after weeks of reading FAQ's, guides and everything I found about firewalls and FreeS/WAN I still have a big problem. But first I describe what is working and my network setup: roadwarrior (a.b.c.d) | internet | (d.e.f.g, static ip, ext. device, eth1, ipsec0) gateway with SuSE 8.2 and FreeS/WAN (10.10.11.3, int. device, eth0) | (10.10.11.0/24, int. network) LAN IPSec connection between roadwarrior and gateway external device works without any problem. But no matter what I try, if I try to ping the gateway's internal device (10.10.11.3) or the internal network I always get SuSE-FW-ILLEGAL-TARGET IN=ipsec0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=xxx.xxx.xxx.x DST=10.10.11.3 LEN=60 TOS=0x00 PREC=0x00 TTL=128 ID=3540 PROTO=ICMP TYPE=8 CODE=0 ID=1280 SEQ=256 *SRC=xxx.xxx.xxx.x is the adress of my roadwarrior I did set up the Firewall as described in /usr/share/doc/packages/SuSEfirewall2/EXAMPLES Scenario4: FW_DEV_EXT="eth1 ipsec0" FW_DEV_INT="eth0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="10.10.11.0/24" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="50 51" FW_FORWARD="a.b.c.d,10.10.11.0/24 10.10.11.0/24,a.b.c.d" a.b.c.d is the adress of my roadwarrior I left all other options default for testing the IPSec connections. Even without routing and masquerading I still get the error above and the above settings for routing forwarding and masquerading did not change anything. I also tried to make a custon updown script to be executed when ipsec0 comes up, that didn't change anything too. If the firewall is disabled I can ping the gateway's internal device (10.10.11.3) from an external IPSec connection. With the firewall enabled I can only access the external device of the gateway - I cannot ping to the internal network. Any suggestions what I am doing wrong here? I guess I have to use a custom updown script that allows traffic between the roadwarrior and the internal network and is executed each time an IPSec connection comes up. I tried this script but still had the SuSE-FW-ILLEGAL-TARGET error: up-client:) iptables -I FORWARD 1 -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT -j ACCEPT iptables -I FORWARD 1 -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -s $PLUTO_PEER_CLIENT -j ACCEPT ;; down-client:) iptables -D FORWARD -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT -j ACCEPT iptables -D FORWARD -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -s $PLUTO_PEER_CLIENT -j ACCEPT ;; I checked the Pluto variables at execution time of the script and ip-adresses represented by those were correct. I appreciate any suggestions, thanks in advance, R. Peters

2 2

fw.suse.com compromised?
by Kastus 01 Nov '03

01 Nov '03

Hello, I just received a james virus message originated at fw.suse.com (209.3.226.225) I checked both mail log and firewall log, connection was from 209.3.226.225 Did anybody else receive that? Does it mean that fw.suse.com was compromised? Thanks, -Kastus

6 8

Using CryptoAPI
by Bo Jacobsen 01 Nov '03

01 Nov '03

Can parts of the CryptoAPI (in the kernel) replace the block devices: Loopback device support & Twofish encryption for Loopdevice I prently use The loopback device & Twofish modules on an encrypted file by mouting the file on the loopback device, and I would like to know if it's possible to do the same using CryptoAPI. Thanks in advance Bo Jacobsen

1 0