I posted the following security warning on the suse-linux-e list earlier today and
someone sensibly suggested I forward it to this list. More later....
Ralph Clark wrote:
> I am a grateful user of your firewall-2.2-12.rpm package on SuSE Linux 6.1,
> which uses ipchains. However I think I may have identified a security hole. It's
> rather obvious, so feel free to shoot me down in flames if either I'm doing
> something daft or if this was identified and resolved already.
> The problem seems to lie in the fact that I have ppp support compiled directly
> into my 2.2.12 kernel instead of as a loadable module, but perhaps someone else
> can check for us if the same problem occurs with the loadable module version.
> The /sbin/init.d/firewall script included in the package, which is run at boot
> time, tries to send a message to the external network interface ppp0 to tell the
> kernel to defeat spoofed IP addresses coming through that interface. It does
> this by writing a "2" into the file "/proc/sys/net/ipv4/conf/ppp0/rp_filter".
> However, at the time the boot process runs this script, the ppp0 interface has
> not yet been initialised. As a consequence, there is no entry in
> /proc/sys/net/ipv4/conf for this device and so the message does not get sent to
> the kernel.
> This means that anybody using this package as it is shipped will not be
> protected against spoofed packet headers coming in through their modem link.
> Apart from that ipchains and this firewall package are just the bee's knees.
> I'm going to try getting my connect script to write this message immediately
> after ppp has been started at the remote end but I'm not sure if the rp_filter
> file will available yet, and in any case the spoofing protection really needs to
> be enabled BEFORE the ppp device starts accepting packets from the modem.
> I'd be grateful if anyone could tell me whether this issue has any known
> rclark(a)virgosolutions.demon.co.uk Ralph Clark, Virgo Solutions Ltd (UK)
> __ _
> / / (_)__ __ ____ __ * Powerful * Flexible * Compatible * Reliable *
> / /__/ / _ \/ // /\ \/ / *Well Supported * Thousands of New Users Every Day*
> /____/_/_//_/\_,_/ /_/\_\ The Cost Effective Choice - Linux Means Business!
rclark(a)virgosolutions.demon.co.uk Ralph Clark, Virgo Solutions Ltd (UK)
/ / (_)__ __ ____ __ * Powerful * Flexible * Compatible * Reliable *
/ /__/ / _ \/ // /\ \/ / *Well Supported * Thousands of New Users Every Day*
/____/_/_//_/\_,_/ /_/\_\ The Cost Effective Choice - Linux Means Business!