August 1999 - openSUSE Security - openSUSE Mailing Lists

tiny firewallscript problem
by DreeVee 05 Aug '99

05 Aug '99

hi, I think this is a Q appropriate for the sec-list. It's a problem trying to run a firewall. And Q is: what's wrong with the below script. It' should run on a cablemodem (24 hour connection) It's slightly changed script from friend running debian for many years (and using cable) problem is: if i make alow rules for specific ip's they do not work with this script (there are no external allowrules in below example, but you get the picture) this firewall script seems to work fine, but when it's run it still blocks FTP_ALLOW rules. Is it because the order of flushing/opening firewall rules is wrong (it seems to work by debian friend) is it because SuSE 6.1 is different in this (than debian, some other great help from debianfriend had similair problems) the script is simply started in runlevel2 with a highnumber (99) i first used wu_ftpd, changed it to prof_ftpd and FWIW got rid of sendmail and implemented qmail qmail working fine, both ftpd same mentioned problem The script follows here (i think i do not need to bother to use bogus ip's) #!/bin/bash /usr/bin/clear # cablemodem ip ETH0="194.134.147.93" # local subnet ETH1="192.168.0.151" # subnetmasks SUBNET1="192.168.0.0/24" # goes without saying ALL="0.0.0.0/0" LOCALHOST="127.0.0.1" LOCALHOSTNET="127.0.0.0/8" HIGHPORTS="1024:65535" LOWPORTS="1:1024" # localnet # localboxes (linux/win95) DVXSNET="192.168.0.151" DREEVEE="192.168.0.150" #etcetera for other win boxes # one var for it USERS="192.168.0.151 192.168.0.150" # denies all CCS="62.172.74.0/24" BSA1="209.70.21.0/24" BSA2="194.7.253.0/24" DENY_ALL="62.172.74.0/24 209.70.21.0/24 194.7.253.0/24" # ftp denied # people we do not want on ftp RUUD="194.134.144.26" # rather not euronet EURONET_SERVICE="194.134.32.134" # no proxy access from cablecomp cause off logging PROXY="194.134.132.31" PROXY1="194.134.132.32" PROXY2="194.134.132.33" PROXY3="194.134.132.34" PROXY4="194.134.132.35" PROXY5="194.134.0.98" PROXY6="194.134.0.166" PROXY7="194.134.52.178" # get them in var's FTP_DENIED1="194.134.144.26 194.134.32.134 194.134.132.31 194.134.132.32 194.134.132.33 194.134.132.34 194.134.132.35" FTP_DENIED2="194.134.0.98 194.134.0.166 194.134.52.178" # leechers, bo/netbus en portscanners FTP_DENIED3="194.134.144.33 194.134.144.140 194.134.133.42 194.134.140.35 194.134.146.80 194.134.133.168 194.134.130.14" FTP_DENIED4="194.134.146.107 194.134.144.181 194.134.152.34 194.134.144.9 194.134.144.53 194.134.138.31" # no euro chello scan on ftpservers # 195.75.224.71 Chello's own portscanner CHELLO_DENY="195.75.224.71 " echo "Starting Firewalling." # default firewall rules.....attitude open free /sbin/ipchains -P input ACCEPT /sbin/ipchains -P output ACCEPT /sbin/ipchains -P forward DENY # flush previous rules /sbin/ipchains -F input /sbin/ipchains -F output /sbin/ipchains -F forward # denying some hosts every access /sbin/ipchains -A input -p all -j DENY -s $CCS -i eth0 -d $ETH0 /sbin/ipchains -A input -p all -j DENY -s $BSA1 -i eth0 -d $ETH0 /sbin/ipchains -A input -p all -j DENY -s $BSA2 -i eth0 -d $ETH0 # localhost to localhost traffic /sbin/ipchains -A input -j ACCEPT -s 127.0.0.1 -d 127.0.0.1 echo "Setting up ipspoofing." # no seperate ipspoofing rules, kernel can handle these rules if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo "Setting up spoofprotection!!!!" for f in /proc/sys/net/ipv4/conf/*/rp_filter;do echo 1 > $f done fi # icmp calls..only the important ones are permitted /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 0 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 3 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 8 -d $ETH0 /sbin/ipchains -A input -j ACCEPT -i eth0 -p icmp -s $ALL 11 -d $ETH0 /sbin/ipchains -A input -j DENY -i eth0 -p icmp -s $ALL 5 -d $ETH0 # No chello scans on ftp and webports allowed. for i in $CHELLO_DENY;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 www done echo "Accepting mail, ssh logins, auth, apache server" # auth needed by many servers # such as smtpservers /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 ssh /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 smtp /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 www /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 auth # only local subnet permitted to do pop3 # from remote they will need SSH /sbin/ipchains -A input -j ACCEPT -i eth1 -p tcp -s $SUBNET1 -d $ETH1 pop3 echo "Setting up ftp server rules." # all rules access deny ftpserver.... for i in $FTP_DENIED1;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED2;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED3;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done for i in $FTP_DENIED4;do /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $i -d $ETH0 ftp done # rule on ssh, seems to use port 1020-1024 /sbin/ipchains -A input -j ACCEPT -i eth0 -p tcp -s $ALL -d $ETH0 1020:1024 ! -y # log telnet and finger /sbin/ipchains -A input -j DENY -i eth0 -p tcp -l -s $ALL -d $ETH0 23 /sbin/ipchains -A input -j DENY -i eth0 -p tcp -l -s $ALL -d $ETH0 79 # deny lowports accept the ones excepted above # nothing open what we do not want /sbin/ipchains -A input -j DENY -i eth0 -p tcp -s $ALL -d $ETH0 :1024 /sbin/ipchains -A input -j DENY -i eth0 -p udp -s $ALL -d $ETH0 :1024 echo "Masquerading." for i in $USERS;do /sbin/ipchains -A forward -j MASQ -s $i -d $ALL done # put on forwarding, now everything is operating as we want echo "Enable forwarding ( echo 1 >> /proc/sys/net/ipv4ip_forward ).. " echo "1" > /proc/sys/net/ipv4/ip_forward echo "done." <<end of script, working on this for weeks now and it was a hot days>> dv

1 0

Cracker attack using ftp?
by Jan Theofel 05 Aug '99

05 Aug '99

Hello! Here are two lines of my /var/log/messages: Aug 4 21:16:22 www wu.ftpd[25329]: connect from root(a)212.160.104.141 Aug 5 02:49:53 www wu.ftpd[25641]: connect from root(a)212.160.104.141 They seem a little bit strange to me that a root on some box will trying FTP to our server. I tought it might be perhaps and cracker who got root access to another server. (Altough this IP can't be resolved by nslookup, which should indicate that it isn't a server.) But in my /var/log/xferlog, there's no traffic at these times. What does that mean? Bye, Jan BTW: My server identifies as: 220 www.rst-consulting.de FTP server (Version wu-2.4.2-academ[BETA-12](1) Sun +Jan 19 23:05:28 CST 1997) ready. -- +-------------------+--------------------------------------------------------+ | Jan Theofel | rst Unternehmensberatungs- und Handelsgesellschaft mbH | | Webadministrator | Bahnhofstrasse 35, 71272 Renningen | | | Tel.: 07159/800-450 Fax: 07159/800-451 | +-------------------+--------------------------------------------------------+

3 2

Re: [suse-security] sendmail
by gaby dapremont 05 Aug '99

05 Aug '99

Usually, news groups are not to ask how to do something, unless you discover a problem. This is to bring-up problems and solutions. Please people, stop to send so many bullshit mails. TAKE A BOOK ! --- Silvia Nieto <snieto(a)sc.sas.cica.es> wrote: > Hello, > > I'd like to know how can I desinstall sendmail > 8.8.8 ? and how can I > install sendmail 8.9.3 ? > > Thank you > > > -- > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > > _____________________________________________________________ Do You Yahoo!? Free instant messaging and more at http://messenger.yahoo.com

6 5

RE: [suse-security] New users, how?
by Wayne, Steven L SSI-TSEA-353 05 Aug '99

05 Aug '99

>-----Original Message----- >From: Murdo MacKinnon ( Mac ) [mailto:murdo.mackinnon3@virgin.net] >Sent: 08 August 1999 19:36 >To: cognition(a)bigfoot.com; Wayne, Steven L SSI-TSEA-353 >Cc: suse-security(a)suse.com >Subject: RE: [suse-security] New users, how? > > > >Can soone please unsubscribe me from al of this as I have had enough >I tried to unsubscribe 5 times >Still the problem you will no doubt say is my microsoft > >STOP THE MAIL > See this: To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com It's at the bottom of everyones posts. Did you do it? -- If a man stands in the middle of the forest speaking and there is no woman around to hear him....Is he still wrong?

2 1

CFS
by bedau＠hmi.de 05 Aug '99

05 Aug '99

Does anybody know where I can get the cryptographic file system CFS (or another one for which I don't have to modify the kernel) outside the USA? Thanks Daniel -- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Daniel Bedau Tel.: x49 30 8062-3010 Hahn-Meitner-Institut Berlin Fax.: x49 30 8062-2434 Physikalische Chemie / CS E-Mail : bedau(a)hmi.de Glienicker Strasse 100 PGP-key available D-14109 Berlin +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 2

RE: [suse-security] New users, how?
by Kenneth Peiruza 05 Aug '99

05 Aug '99

> > > > > On Mon, 2 Aug 1999, Jan Theofel wrote: > > > > > useradd Nope! It's more fun by hand! Modify: /etc/group /etc/passwd /etc/shadow Create a home directory and copy everything from skeleton ( /etc/skel ) Once you know how to do it by hand, try the easy way. But if you're using SuSE... why don't use yast? In System Administration you can choose "User Administration" or something similar (I use a non English version...) > > > > Thanks to everyone who pointed out this command. (and I thought _Linux in > a NUTSHELL_ had all the answers!) > > Der wille zur macht! I'm Not German.

3 2

PHP in SuSE Apache.rpm
by Stefan Salzer 05 Aug '99

05 Aug '99

Hiya, I'm having problems with the php built into the apache.rpm delivered with suse. It won't call sendmail in a php3-Program I have, and the FAQ of this program says, that the "safe_mode" has to be disabled in php3.ini. My questions now are: 1. Where is this php3.ini? I can't find any in my system :( 2. What exactly is the safe_mode? 3. The FAQ says, that I can also place sendmail in the safe_exec_dir - where is that? could anyone help me? cya, Stefan Salzer -- Qualität ist nicht was man verspricht, sondern was man hält! ======================================================================== = Wollen Sie unseren kostenlosen Newsletter "cinNews" beziehen? = = unter http://news.cin.de können Sie ihn abonnieren! = = -------------------------------------------------------------------- = = Stefan Salzer e-Mail: salt(a)cin.de = = Connect Internetworking Telefon: +49 6106 8498 0 = = Hauptstr. 139 Telefax: +49 6106 8498 299 = = 63110 Rodgau WWW: http://www.cin.de = = Germany = ========================================================================

2 1

sendmail
by Silvia Nieto 05 Aug '99

05 Aug '99

Hello, I'd like to know how can I desinstall sendmail 8.8.8 ? and how can I install sendmail 8.9.3 ? Thank you

1 0

RE: [suse-security] New users, how?
by Wayne, Steven L SSI-TSEA-353 04 Aug '99

04 Aug '99

>-----Original Message----- >From: cogNiTioN [mailto:cognition@bigfoot.com] >Sent: 03 August 1999 20:43 >To: Wayne, Steven L SSI-TSEA-353 >Cc: suse-security(a)suse.com >Subject: RE: [suse-security] New users, how? > > >On Tue, 3 Aug 1999, Wayne, Steven L SSI-TSEA-353 wrote: > >> "Running Linux" has most of the answers, with both you >should be pretty well >> covered. > >Is that any better than combining the Network and the System Admin's >Guides avaliable free online? > No idea, it's hard for me to read on-line on the train into London, so I take a book. Steven. -- If a man stands in the middle of the forest speaking and there is no woman around to hear him....Is he still wrong?

1 0

RE: Re[2]: [suse-security] New users, how?
by Paxton, Michael 04 Aug '99

04 Aug '99

Unix Power Tools can NOT be beaten as a solution-driven approach to getting to know any Unix flavour. It is especially good at pointing out differences between systems and shells and the meanings of some of those historical artifacts that date back to teletype days. All this whilst squeezing every ounce out of shell scripting. It will give you an appreciation of how refined modern Unix's like Linux are and the background to help you step out and conquer the world beyond BASH. And, of course, it is an O'reilly so it was always going to be a winner... _______________________________________________________________ Michael Paxton Email: <mailto:Michael.Paxton@aihw.gov.au> Michael.Paxton(a)aihw.gov.au Data Management Unit Phone: +61 2 6244 1085 Australian Institute of Health & Welfare -----Original Message----- From: Orlando Ortiz [mailto:OOrtiz@LCSI.com] Sent: Wednesday, August 04, 1999 3:00 PM To: suse-security(a)suse.com Subject: Re[2]: [suse-security] New users, how? I'll throw my one cent in this...I think 'Linux: The Complete Reference' sold at CDROM.com is also a great book. They have a 7th addition coming out soon (if it haven't come out already.) (Yeah, I know the saying is 'I'll throw my 2 cents in' but I don't want to up the value of my opinion.) On Tue, Aug 03, 1999 at 05:21:20PM -0700, Mr. M wrote: > > On Tue, 3 Aug 1999, Wayne, Steven L SSI-TSEA-353 wrote: > > > > > "Running Linux" has most of the answers, with both you should > > be pretty well > > > covered. > > > > Is that any better than combining the Network and the System Admin's > > Guides avaliable free online? > > All the books from O'Reilly are good. I wouldn't recommend purchasing > Running Linux unless the new edition (3rd) is finally out. The 2nd edition > is 4 years old! Yes they are. There are a number of other good ones out there too. Sams has some good stuff (SlackWare Unleashed is pretty good for getting into the meat of Linux, I don't know how recent it is anymore though). > > You may also want to pick up a copy of "Essential System Administration" by > AEleen Frisch. It's a bit dated on Linux, however, it does cover Unix > system administration of various Unices - System V and BSD. The book is > more than just a "how-to". The author shares her years of experience as a > Unix sysadmin and the many aspects related to the job. It's one of my > favorites. > I just really felt the need to say that "Essential System Administration" is an incredible book. It took me from being a decent user to knowing enough (and what else to find out about) to be a fully qualified System Admin. Definately high on my favorites list. The vast majority of what she talks about with Linux is still relevant. Also, most of the stuff on the other Unixen is very relevant. -- Jeff -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCS/M/>P d-(pu) s+:- a17>? C++(++++) L+++ UL++(+++)@>++++$ P+ E W++@ N+ o? K- w--- O? M V- PS+ PE(--)@ Y++@ PGP t+ 5 X++@ R++@ !tv@ b++ DI++++ D- G e- h! r++ y? ------END GEEK CODE BLOCK------ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0