December 1999 - openSUSE Security - openSUSE Mailing Lists

wvdial and dial-on-demand
by Robert C. Paulsen, Jr. 27 Dec '99

27 Dec '99

Hello, I now have the new fierwals package set up and working in combination with the wvdial.dod script from SuSE's web site: http://sdb.suse.de/sdb/en/html/hoe_wv_dod_start.html The script there needed to be fixed up a little in order to get it working. I have placed my working copy on my web site: http://paulsen.home.texas.net/wvdial.dod Comments near the top of the script explain what I needed to do. It could still use a little work on it's formatting. -- ____________________________________________________________________ Robert Paulsen http://paulsen.home.texas.net

1 0

wvdial.dod and new firewall script (6.3)
by Robert C. Paulsen, Jr. 25 Dec '99

25 Dec '99

Hello, I have both the subject scripts working fine. I get dial-on-demand from wvdial.dod and I can set up masqurading/packet-filter with the firewall script (from the new firewals package). I can't figure out how to get the firewall script to run automatically after the dial-up connection is made (and the ppp networking is established). It is a little inconvenient to have to run the firewall script manually after getting ppp to connect on demand! How can I get pppd and/or wvdial to run the firewall script? Thanks. -- ____________________________________________________________________ Robert Paulsen http://paulsen.home.texas.net

1 0

msq bei SuSE6.3
by Security Webmaster OKDesign oHG 22 Dec '99

22 Dec '99

Hi folks, I recently installed the new SuSE 6.3 and since then I try to enable masquerading. Unfortunately without effort. In the earlier versions it was enabled and configured with the 4 (or 5) lines in rc.config beginning with MSQ... In this version it seems at it must be enabled and configured within /etc/rc.firewall. I tried many times but I can't get it to work. Maybe masquerading is enabled but the firewall (which must be running, as far as I read out of the readme-file) prevents it from working, or it is still disabled. Can anyone please give me a working configuration ? Or tell me what could be the reason ? If you need more info, e.g. my actual config, I`ll mail it. Thanks in advance. --- Stephan

2 1

Strange Nameserver-Messages in Syslog
by Stefan Salzer 21 Dec '99

21 Dec '99

Hi there, I think this has been asked before, but I could not find an answer! (btw: Is this list archived somewhere?) Since upgrading to SuSE 6.3, I find the following messages in my syslog, what do they mean? I know that the named has had several vulnerabilitites, but I thought they were fixed by suse? The Nameserver has several primary and secondary domains, so it has to be running. "rpm -q bind" says "bind-4.9.7-101" --- cut --- Dec 17 22:12:51 havanna named[148]: NSTATS 945465171 945181057 A=162718 NS=3 CNAME=3 SOA=1271 PTR=177530 MX=2894 TXT=1 AAAA=3 AXFR=15 ANY=8174 Dec 17 22:12:51 havanna named[148]: XSTATS 945465171 945181057 RR=40119 RNXD=1465 RFwdR=31813 RDupR=234 RFail=1310 RFErr=0 RErr=0 RAXFR=15 RLame=840 ROpts=0 SSysQ=6107 SAns=320645 SFwdQ=31954 SDupQ=3636 SErr=54 RQ=352612 RIQ=0 RFwdQ=31954 RDupQ=537 RTCP=106 SFwdR=31813 SFail=624 SFErr=5 SNaAns=84099 SNXD=12605 Dec 17 23:26:11 havanna named[148]: NSTATS 945469571 945181057 A=165024 NS=3 CNAME=3 SOA=1292 PTR=179680 MX=2921 TXT=1 AAAA=3 AXFR=15 ANY=8248 Dec 17 23:26:11 havanna named[148]: XSTATS 945469571 945181057 RR=40426 RNXD=1472 RFwdR=32088 RDupR=235 RFail=1310 RFErr=0 RErr=0 RAXFR=15 RLame=840 ROpts=0 SSysQ=6142 SAns=324952 SFwdQ=32227 SDupQ=3640 SErr=54 RQ=357190 RIQ=0 RFwdQ=32227 RDupQ=537 RTCP=106 SFwdR=32088 SFail=624 SFErr=5 SNaAns=84918 SNXD=12662 --- cut --- Thanks for any pointer you could give me... Stefan Salzer -- Qualität ist nicht was man verspricht, sondern was man hält! ======================================================================== = Wollen Sie unseren kostenlosen Newsletter "cinNews" beziehen? = = unter http://news.cin.de können Sie ihn abonnieren! = = -------------------------------------------------------------------- = = Stefan Salzer e-Mail: salt(a)cin.de = = Connect Internetworking Telefon: +49 6106 8498 0 = = Hauptstr. 139 Telefax: +49 6106 8498 299 = = 63110 Rodgau WWW: http://www.cin.de = = Germany = ========================================================================

4 3

Re: [suse-security] msq bei SuSE6.3 (fwd)
by marc＠suse.de 20 Dec '99

20 Dec '99

Hi, > i got this news today and i tried to install the > firewall v1.4. I used "rpm -U firewals.rpm" as > you have recommended but i got this error: > faild dependencies: firewall conflicts with fct-1.1.0-61. > What is wrong ? I hve Suse V6.3. just do: rpm -e fct which will remove the buggy and shitty fct package. then install the update. Greets, Marc > -----Original Message----- > From: Marc Heuse [mailto:marc@suse.de] > Sent: Sunday, December 19, 1999 1:39 PM > To: security(a)okdesign.de > Cc: suse-security(a)suse.com > Subject: [suse-security] msq bei SuSE6.3 (fwd) > > > Hi, > > please, everyone who uses or wants to use the SuSE firewall script, please > update to at least v1.4, which rpm is available on the ftp site. > (if you feel like beta testing, v1.5 is available as .tar.gz file from > http://www.suse.de/~marc) > > before doing an update "rpm -U firewals.rpm", please execute the following > command: > "mv /etc/rc.firewall /etc/rc.firewall.orig" > and reconfigure the firewall after installing the update. > > >I recently installed the new SuSE 6.3 and since then I try to enable > >masquerading. Unfortunately without effort. > > the package builder forgot to create the start scripts in rc2.d, so the > firewall scripts can not be started during boot ... :-( > v1.4 also has got more masquerading features. > Everything is documented in the rc.firewall file. > > (I pasted below my signature the CHANGE file of the SuSE firewall script > since the version which is on the CD. current beta is v1.5, the version on > the update ftp rpm is v1.4) > > Greets, > Marc > -- > Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg > E@mail: marc(a)suse.de Function: Security Support & Auditing > "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" > Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C > > v1.5 16.12.99 (beta version) > * Changed the firewall setup during bootup, now there are three > parts: > 1) Filters everything incoming, just allows dhcp replies. > This is done before interface setup. > 2) Setup the filters, > This is done after interface and routing setup > 3) Final setup of the filters. This is only necessary, if > either FW_SERVICE_DNS or the FW_AUTOPROTECT features > are used. > This is done as the last step of runlevel 2 (or 3) > This fixes some problems an adds even more security through bootup > * Added FW_SERVICE_DHCLIENT in rc.firewall for dhclient users > * Fixed some typos (thanks Fabian) > > v1.4 26.11.99 (gamma version) -> SuSE update > * Added some text to rc.firewall to help understanding the > configuration options > > v1.3 18.11.99 (beta version) > ! SuSEfirewall, which rpm name is "firewals" was incorrectly build > for SuSE 6.3 - the start scripts in rc2.d are missing :-( > * Added "SuSEfirewall stop" option, which will disable the firewall > * Added new options to load rules anyway if the interface is not > active. Requires static IP addresses of course. > Check out FW_DEV_{WORLD,INT}_[device] examples in rc.firewall > * Added support for defining a masquerading interface and masq > modules > * Added special support for DNS (new question 14 inserted, set > FW_SERVICE_DNS to "yes", if you are running named.) > * Disallowing 0/0 in FW_LOCALNETS > * Fixed some more mixed up log_deny and log_accept definitions > * Added online kernel config for reassambling of fragmented packets > * Fixed two warning messages when ip_forwarding was of (FW_ROUTE=no) > * Added adaptions for SuSE 6.3 introduced by the package maintainer > :-) > * Added the GNU GPL licence file to the package > * Misc. beauty stuff > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > > > -- Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

imap with chroot environment or something like that
by Dominic Santi 20 Dec '99

20 Dec '99

Hello at all I'm looking for a imapd version with chroot environment. Exist such a imapd or is there any other possibility to restrict the filesystem "export"? Thanks for help (in german or in english). sincerely yours dominic

1 0

Re: Possible problems with firewall 1.5 script
by marc＠suse.de 19 Dec '99

19 Dec '99

Hi, > Nice script. I will be the first to admit I still need to learn alot more > about packet filtering however I am getting continuous deny entries like > > Dec 17 15:47:24 machine_name kernel: Packet log: input DENY eth0 PROTO=17 > 222.111.100.128:520 222.111.100.255:520 L=32 S=0x00 I=7066 F=0x0000 T=64 (#6) > Dec 17 15:47:24 machine_name kernel: Packet log: input DENY eth1 PROTO=17 > 192.168.0.1:520 192.168.0.255:520 L=32 S=0x00 I=7067 F=0x0000 T=64 (#5) have you the routing daemon running on your firewall? from the rule number which denied the packets, it looks like that (#4 and #5) ... the reason is simple: the firewall itself sends a broadcast to the network. because it's a broadcast the same firewall interface, which sent the packet also receives a copy. then the filter rules hit, because the screening rules identify this packet as an ip-spoofed packet ... solution: don't run broadcast services on the firewall. especially samba (hi frank :-) , and routed are a very bad idea. to subvert or DOS the firewall through RIP spoofing is rather trivial... I'll add something for a future version of the script. > Also I added > $IPCHAINS -M -S 14400 10 60 > > to the SuSEfirewall script since I like to keep ssh sessions to my work > open for long periods of time. Might want to consider adding this by default. any other opinions? do you people think this is a good idea? > And any pointers towards VPN Masquerading would be helpful. Specifically, > do I need to VPN Masquerading Kernel Patch for SuSE 6.3 (kernel 2.2.13)? have you taken a look at the freeswan package? Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

[suse-security] msq bei SuSE6.3 (fwd)
by marc＠suse.de 19 Dec '99

19 Dec '99

Hi, please, everyone who uses or wants to use the SuSE firewall script, please update to at least v1.4, which rpm is available on the ftp site. (if you feel like beta testing, v1.5 is available as .tar.gz file from http://www.suse.de/~marc) before doing an update "rpm -U firewals.rpm", please execute the following command: "mv /etc/rc.firewall /etc/rc.firewall.orig" and reconfigure the firewall after installing the update. >I recently installed the new SuSE 6.3 and since then I try to enable >masquerading. Unfortunately without effort. the package builder forgot to create the start scripts in rc2.d, so the firewall scripts can not be started during boot ... :-( v1.4 also has got more masquerading features. Everything is documented in the rc.firewall file. (I pasted below my signature the CHANGE file of the SuSE firewall script since the version which is on the CD. current beta is v1.5, the version on the update ftp rpm is v1.4) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C v1.5 16.12.99 (beta version) * Changed the firewall setup during bootup, now there are three parts: 1) Filters everything incoming, just allows dhcp replies. This is done before interface setup. 2) Setup the filters, This is done after interface and routing setup 3) Final setup of the filters. This is only necessary, if either FW_SERVICE_DNS or the FW_AUTOPROTECT features are used. This is done as the last step of runlevel 2 (or 3) This fixes some problems an adds even more security through bootup * Added FW_SERVICE_DHCLIENT in rc.firewall for dhclient users * Fixed some typos (thanks Fabian) v1.4 26.11.99 (gamma version) -> SuSE update * Added some text to rc.firewall to help understanding the configuration options v1.3 18.11.99 (beta version) ! SuSEfirewall, which rpm name is "firewals" was incorrectly build for SuSE 6.3 - the start scripts in rc2.d are missing :-( * Added "SuSEfirewall stop" option, which will disable the firewall * Added new options to load rules anyway if the interface is not active. Requires static IP addresses of course. Check out FW_DEV_{WORLD,INT}_[device] examples in rc.firewall * Added support for defining a masquerading interface and masq modules * Added special support for DNS (new question 14 inserted, set FW_SERVICE_DNS to "yes", if you are running named.) * Disallowing 0/0 in FW_LOCALNETS * Fixed some more mixed up log_deny and log_accept definitions * Added online kernel config for reassambling of fragmented packets * Fixed two warning messages when ip_forwarding was of (FW_ROUTE=no) * Added adaptions for SuSE 6.3 introduced by the package maintainer :-) * Added the GNU GPL licence file to the package * Misc. beauty stuff

1 0

RE: [suse-security] delay of msgs on the announce list
by Volker Kuhlmann 17 Dec '99

17 Dec '99

> By analyzing that I think, suse-security is a direct list and > suse-security-announce is a moderated list, e. g. an individual > here named "hatred" proofed und passed the mail. Yes perhaps, I was wondering too whether it has something to do with the approvement process, but 12 hours is rather a long time which you can only really explain by taking the time difference between Europe/USA into account. Still, the problem remains - suse-security-announce is not a high-priority get-important-info-fast type list. It would be nice if SuSE changed the handling of this list - those SuSE employees which issue security announcements should have write-access to the list in that case. Volker

1 0

SuSE Security Announcement - pine
by thomas＠suse.de 16 Dec '99

16 Dec '99

-----BEGIN PGP SIGNED MESSAGE----- _____________________________________________________________________________ SuSE Security Announcement Package: pine-4.10 Date: Wed Dec 15 18:32:56 MET 1999 Affected SuSE versions: 5.3 - 6.3 Vulnerability Type: remote command execution SuSE default package: no Other affected systems: all unix systems using the pine prior 4.21 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on an "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The pine mail agent doesn't filter special shell characters in URLs. 2. Impact An attacker can trick a user using pine to executing shell commands by sending an email with malicious formatted URL embedded in it. 3. Solution Update the package from our FTP server. ______________________________________________________________________________ Please verify these md5 checksums of the updates before installing: bbfa5cb60f8f5c29f18bb14744071953 pine-4.21-11.alpha.rpm (6.1, AXP) b2980666737dd4a4db46e1c3d3c7aea0 pine-4.21-11.i386.rpm (5.3, x86) d70ef356f093683c85cba53cc573c1b5 pine-4.10-40.i386.rpm (6.0, x86) 7286ed1525c94a7b36c7a2c68ccb4890 pine-4.21-11.i386.rpm (6.1, x86) 159d028af3aaca959cada37c7a68cc07 pine-4.21-11.i386.rpm (6.2, x86) df36f3e6da96dc4c6a5811302e5b926f pine-4.21-13.i386.rpm (6.3, x86) ______________________________________________________________________________ You can find updates on our ftp-Server: ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pine-4.21-11.alpha.rpm ftp://ftp.suse.com/pub/suse/i386/update/5.3/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.0/n1/pine-4.10-40.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/pine-4.21-11.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/pine-4.21-13.i386.rpm or try the following web pages for a list of mirrors: http://www.suse.de/de/support/download/ftp/inland.html http://www.suse.de/de/support/download/ftp/ausland.html or http://www.suse.de/en/support/download/ftp/germ_mirrors.html http://www.suse.de/en/support/download/ftp/int_mirrors.html Our webpage for patches: http://www.suse.de/de/support/download/updates/index.html or http://www.suse.de/en/support/download/updates/index.html Our webpage for security announcements: http://www.suse.de/security If you want to report vulnerabilities, please contact security(a)suse.de ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security(a)suse.com - moderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe to the list, send a message to: <suse-security-subscribe(a)suse.com> To remove your address from the list, send a message to: <suse-security-unsubscribe(a)suse.com> Send mail to the following for info and FAQ for this list: <suse-security-info(a)suse.com> <suse-security-faq(a)suse.com> _____________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - ------BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - ------END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOFkEYXey5gA9JdPZAQGTEQf8D5HbyQraHg8gKT6aN2HXYZ8c4FqbH8+L piI/XfpVoEkg3tXDomt+JeGmXEa22veNooqfXQIdTvU2mWR6adgdP4297a/+id7N vM9KE2RRJPTSZBeKM2uLtvz2yc6cgb2hZmgQUY0eNmYi9FbZJiUqweueZG9TS1GS o+ddCgZSrw6XgkoyiquyFWE5b/EKD8uO+XtGJQhToylgkVGUERFHy0AeSc6hSjMV BBWKFTkwgJouY6h/+0BXxOTozHtSL6vgSjma7eBK/O/60Z36t7ZLReIAz1OC4BoB nRcTk2tk4NTiExBngaa18oMJ4Tz6T0DdLuqudGEcI3J5tKocWadwsQ== =vE4K -----END PGP SIGNATURE-----

1 0