October 1999 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Log Surf ?
by Martin P. Peikert 18 Oct '99

18 Oct '99

Hello all, today in the morning I wrote: > >The same can be done by adding to your /etc/syslog.conf: >*.warn admin@whereeveryouare > That' s nonsense, I'm sorry. Wasn't awake at that moment and mixed the hosts.deny-file with syslog.conf-file in an stupid way. Martin -- ---------------------------------------------------- Dipl. Math. Martin Peikert EN 636 TU Berlin fon 314-23881 Sekretariat EN 2 fax 314-22284 http://www-tet.ee.tu-berlin.de/peikert/index.html ----------------------------------------------------

1 0

RE: [suse-security] Firewall/router - doesn't forward
by Steffen Bauer 18 Oct '99

18 Oct '99

Hello, look at directory /proc/sys/net/ipv4 and check the value in the file ip_forward. The value must be set to 1. regards Steve ----- Original Message ----- From: <romba(a)fem.maschinenbau.uni-dortmund.de> To: <suse-security(a)suse.com> Sent: Monday, October 18, 1999 10:50 AM Subject: [suse-security] Firewall/router - doesn't forward > > Hello! > > We are currently trying to build a packet filtering firewall using > SUSE Linux 6.2 and ipchains. The hardware used is a Pentium 133 with > two Level One NICs using the Realtek 8139 chipset. > > >From what we read in the literature (Firewall and Ipchains HowTo, > several articles in the german magazine ct etc.) it seemed quite > manageable, but then reality struck. > > After several successless tests with a bigger installation we set up > an installation almost identical to the one shown in part 6.3 of the > "Firewall and Proxy Server HOWTO" written by Mark Grennan, the only > difference being the IP-adresses for the outside part. > > Our setup passes all the tests described except one - it doesn't > forward. I can ping any computer from the firewall/router, I > can ping both sides of the firewall from the LAN, but I can only ping > the outside adress from the outside and I can't get through it. > IP-forwarding is switched on and all default policies in ipchains are > set to ACCEPT. > > We are quite desperate (and my boss is losing patience), so any ideas > are highly welcome. Might it be useful to try some other network > adapters? Is there something we have overlooked? Is there a fault in > the HOWTO? > > Best regards > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

Log Surf ?
by Kelvin Rundle 18 Oct '99

18 Oct '99

Hi, In the days of running RedHat systems I was able to easily have highlights from the system logs mailed to me. Since moving across to SuSE, I haven't been able to get this working. I am presuming that the tool to use is logsurf, but I am having great difficulty understanding the man pages. Does anyone know how to get key system events emailed to you, such as login attempts, anything that appears in /var/log/warn and the like ? Or alternatively, can anyone recommend a good FAQ on Log Surf that is easy to understand and will help me to get this back up and running? Thanks, Kelvin.

6 5

Re: [suse-security] Which ftp daemon to use?
by Mark Lutz 15 Oct '99

15 Oct '99

I sent this on Mon, 11 Oct but I think it didn't make it to the list. If it did, I apologize: * On 22 Sep 1999, Volker Wiegand wrote: > The "SuSE Proxy-Suite" project will be announced publicly during the > next few days. Maybe it will help you. Using FTP-Proxy you can hide > any server you like (and are able to administer most easily) from > the clients. Did I just miss the announcement or are you being late? Any URLs?

2 1

Re: [suse-security] Which ftp daemon to use?
by Richard Klein 14 Oct '99

14 Oct '99

can somebody finally take me OFF the list. I unsbuscribed myself a thousand times luma(a)nikocity.de on 10/14/99 04:09:00 PM To: suse-security(a)suse.com cc: (bcc: Richard Klein/NL/ABNAMRO/NL) Subject: Re: [suse-security] Which ftp daemon to use? I sent this on Mon, 11 Oct but I think it didn't make it to the list. If it did, I apologize: * On 22 Sep 1999, Volker Wiegand wrote: > The "SuSE Proxy-Suite" project will be announced publicly during the > next few days. Maybe it will help you. Using FTP-Proxy you can hide > any server you like (and are able to administer most easily) from > the clients. Did I just miss the announcement or are you being late? Any URLs? -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] lpd problem
by Peter Münster 13 Oct '99

13 Oct '99

On Wed, 13 Oct 1999, Erwin S. Andreasen wrote: > > When accidentally someone prints binary data to stdout (in a xterm) > > for example "cat image.tif", a connection to the lpd-daemon > > is established, and the printer prints a lot of nonsense. > > There is a vt100 control code which when printed starts printing to the > local printer. > > I'm not sure how you can disable that; a quick glance at ``man xterm'' > shows that there is a "printerCommand" resource which allows you to supply > a replacement for lpr. You could set that to something else that wil just > eat your input, like cat > /dev/null (I'm not sure you can specify > redirection there though). Or maybe it will be disabled entirely if you > just set it to nothing, try it out :) Hello Erwin! Thank you very much for your explanation! >/dev/null didn't work, but I'll just use xterm*printerCommand: "true" now. ( "" didn't work neither) When someone knows other issues for other terminals (linux console, vt??...), please let me know. Cheers, Peter -- ************************************************************** URL: http://gmv.spm.univ-rennes1.fr/~peter/ -Powered by LinuX- **************************************************************

1 0

lpd problem
by Peter Münster 12 Oct '99

12 Oct '99

Hello, this problem is perhaps not realy security related, but I know that here are a lot of competent people, at least to give some hints for other sources of help. ;) When accidentally someone prints binary data to stdout (in a xterm) for example "cat image.tif", a connection to the lpd-daemon is established, and the printer prints a lot of nonsense. Especially in the case of a printer in another room, this can be nasty, when you realise after an hour that 100 useless pages are printed. It depends certainly on the binary you send to stdout, but with a huge tiff or something like that, it should be reproduceable. Thanks in advance for any hints, Peter P.S.: Some system specifications: lpd invoked by inetd (lpd from plp package) SuSE-6.x system (x= 0-2) -- ************************************************************** URL: http://gmv.spm.univ-rennes1.fr/~peter/ -Powered by LinuX- **************************************************************

1 0

AW: [suse-security] security/firewall help needed
by Michael Hamm 12 Oct '99

12 Oct '99

If you wanna build up a Firewall, you have to check out, witch goals you wanna reach for the future. After this you have to know that there are several levels of security you can reach. you can build up IP-Filters or Applikation-Level-Gateways or a little network (called DMZ) witch have several of both. tip: never run anything else on your pipe to the internet. run no X, run no print server and absolutely nothing else than you need to get a safe connect........... > >I am soon to get a cable modem and need to set-up some security. I am >running ip-masq for my home network. I have one machince that is a file >and print server as well as serving as my pipe to the internet. I have >another suse box and a windows box on the home lan. The box I will be >setting this up on is running SuSE6.1 w/ kernel 2.2.2. Any and all help >would be greatly appreciated. TIA >

1 0

Re: WARNING: Firewall package - security hole?
by Ralph Clark 12 Oct '99

12 Oct '99

Bodo, I'm a little surprised by this. If my limited understanding is correct, then in the brief moments between ppp0 coming up and the "2" getting written to ppp0's rp_filter, during those moments the network is unprotected against spoofing, right? If I were to completely restart the firewall at that time then I'd be opening an even bigger hole, albeit still temporarily. Or, is there a way to frig the routing tables at that time in order to block off any outside access during the time between ppp0 setup and the subsequent firewall restart? I'm not sure whether this can be done without closing off the very connection request that brought ppp0 up in the first place - I'm using diald to bring the link up and down on demand, and I know diald and ppp do their own routiing table/interface configuration which I barely understand. BTW, I don't actually have a problem with the IP address as my ISP (Demon) has supported *nix users quite well since before the advent of the web...we all get static IP addresses ;o). So no dynamic substitution is required in my case. I can therefore keep the firewall up from boot time - it's just this rp_filter value that needs to be set for the ppp0 interface when it is created. Jon Pennington on suse-linux-e suggested that I should post this stuff to the suse-security list so I've subscribed and included them in the circulation list too. Once again, I'll be grateful for any constructive comments. Ralph Bodo Bauer wrote: > There is one more problem if you start up the firewall before the > ppp device exists, you probably don't know the IP address of the > interface. > > The resolution is to start/stop the firewall in your dialup script. Also > use the special value 'IP@ppp0' to specify the address of ppp0 like > specified in my HOWTO: > > Instead of specifying an IP address you also can use the special string > IP@device. This will be replaced by the IP address the given networking > device has at the moment the firewall script is started. It's in specially > useful if you have a dialup connection where your IP address changes every > time you connect to your ISP. If you use PPP dialup, you can specify your > outgoing interface as ppp0 and put IP@ppp0 in the list of your local > networks. In this case however it's important, that you start the firewall > after you powered up the connection to your ISP. This means you don't want > to start the firewall at boot time, as there is no internet connection at > this moment. You rather start the firewall from the script you use to dial > up to your ISP. > > You find the HOWTO at > -> http://skaro.nightcrawler.com/~bb/FW-HOWTO/FW-Howto.html > > Ciao, > BB > > PS: I'm not on the SuSE list, so please reply to me personally if you > have any further questions. > -- > Bodo Bauer bb(a)zenguin.com > Zenguin, Inc. Simplicity in Linux Applications > http://www.zenguin.com http://skaro.nightcrawler.com/~bb > PGP available -- rclark(a)virgosolutions.demon.co.uk Ralph Clark, Virgo Solutions Ltd (UK) __ _ / / (_)__ __ ____ __ * Powerful * Flexible * Compatible * Reliable * / /__/ / _ \/ // /\ \/ / *Well Supported * Thousands of New Users Every Day* /____/_/_//_/\_,_/ /_/\_\ The Cost Effective Choice - Linux Means Business!

1 0

[Fwd: WARNING: Firewall package - security hole?]
by Ralph Clark 12 Oct '99

12 Oct '99

I posted the following security warning on the suse-linux-e list earlier today and someone sensibly suggested I forward it to this list. More later.... Ralph Clark wrote: > Gentlemen, > > I am a grateful user of your firewall-2.2-12.rpm package on SuSE Linux 6.1, > which uses ipchains. However I think I may have identified a security hole. It's > rather obvious, so feel free to shoot me down in flames if either I'm doing > something daft or if this was identified and resolved already. > > The problem seems to lie in the fact that I have ppp support compiled directly > into my 2.2.12 kernel instead of as a loadable module, but perhaps someone else > can check for us if the same problem occurs with the loadable module version. > > The /sbin/init.d/firewall script included in the package, which is run at boot > time, tries to send a message to the external network interface ppp0 to tell the > kernel to defeat spoofed IP addresses coming through that interface. It does > this by writing a "2" into the file "/proc/sys/net/ipv4/conf/ppp0/rp_filter". > > However, at the time the boot process runs this script, the ppp0 interface has > not yet been initialised. As a consequence, there is no entry in > /proc/sys/net/ipv4/conf for this device and so the message does not get sent to > the kernel. > > This means that anybody using this package as it is shipped will not be > protected against spoofed packet headers coming in through their modem link. > > Apart from that ipchains and this firewall package are just the bee's knees. > > I'm going to try getting my connect script to write this message immediately > after ppp has been started at the remote end but I'm not sure if the rp_filter > file will available yet, and in any case the spoofing protection really needs to > be enabled BEFORE the ppp device starts accepting packets from the modem. > > I'd be grateful if anyone could tell me whether this issue has any known > resolution. > > -- > rclark(a)virgosolutions.demon.co.uk Ralph Clark, Virgo Solutions Ltd (UK) > __ _ > / / (_)__ __ ____ __ * Powerful * Flexible * Compatible * Reliable * > / /__/ / _ \/ // /\ \/ / *Well Supported * Thousands of New Users Every Day* > /____/_/_//_/\_,_/ /_/\_\ The Cost Effective Choice - Linux Means Business! -- rclark(a)virgosolutions.demon.co.uk Ralph Clark, Virgo Solutions Ltd (UK) __ _ / / (_)__ __ ____ __ * Powerful * Flexible * Compatible * Reliable * / /__/ / _ \/ // /\ \/ / *Well Supported * Thousands of New Users Every Day* /____/_/_//_/\_,_/ /_/\_\ The Cost Effective Choice - Linux Means Business!

1 0