January 2000 - openSUSE Security - openSUSE Mailing Lists

Firewall
by als 05 Jan '00

05 Jan '00

Hi, I have suse 6.3 and i tried to istall firewall without success!! After start of Linux and firewall ( there is n't an error message) i use a shell script to conrol the traffc, ( ipcahins, for example ipchains -A output -j ACCEPT -i eth0 -s $INTRANET). With this command i mus have a access in internet, but it dos not work. To better understand my problem i send you "re.firewall". I don't know can you or will you help me or not, anyway i thank you for help. best regards Als

2 1

Re: [suse-security] icmp flood
by Volker Tanner 04 Jan '00

04 Jan '00

Von: N. Aust <aust(a)unileoben.ac.at> Hello N >RK> N. Aust writes: >RK> > Jan 4 11:31:28 hb icmplog: ping from p3E9E066E.dip.t-dialin.net >RK> > Jan 4 11:31:59 hb last message repeated 31 times >RK> > Jan 4 11:33:00 hb last message repeated 60 times >RK> > Jan 4 11:33:49 hb last message repeated 48 times >RK> > how can I block icmp pings of a special host and how can I block any >RK> > incoming ping ? > There is a tool out there on the web which is called hostsentry. It is available for download on http://www.psionic.com/abacus/ Check it out- maybe it's just what you want. Regards Volker -- The main failure in computers is usually between keyboard and chair. Volker Tanner <VolkerTanner(a)kade.de>

1 0

Re: [suse-security] icmp flood
by N. Aust 04 Jan '00

04 Jan '00

Hello Robert, Tuesday, January 04, 2000, 2:33:09 PM, you wrote: RK> N. Aust writes: RK> > Jan 4 11:31:28 hb icmplog: ping from p3E9E066E.dip.t-dialin.net RK> > Jan 4 11:31:59 hb last message repeated 31 times RK> > Jan 4 11:33:00 hb last message repeated 60 times RK> > Jan 4 11:33:49 hb last message repeated 48 times RK> > how can I block icmp pings of a special host and how can I block any RK> > incoming ping ? RK> I don't know how to block the ping, but this looks just like a RK> normal ping to me. The guy just started 'ping host' and let it RK> run awhile. RK> If you had been flooded with pings you'd have gotten at least RK> ten times more pings. RK> regards, Robert that was only a _very short_ extract from my logfile ..... -- Best regards, N. mailto:aust@unileoben.ac.at

1 0

compartment
by marc＠suse.de 03 Jan '00

03 Jan '00

Hi folks, I just wanted to announce, that a small but nice tool is available for testing. It's a program to build secure compartments for running untrsted/insecure programs, and has got the usual uid/gid setting and chrooting abilitity, but the nice thing is the easy access to linux per process capabilities. e.g. running an anon-ftp or webserver software on a priviliged port chrooted: "compartment --chroot /chroot/ftp --cap CAP_NET_BIND_SERVICE anon-ftpd" You can find v0.5 of the compartment utility at http://www.suse.de/~marc Syntax: compartment [options] /full/path/to/program Options: --chroot path chroot to path --user user change uid to this user --group group change gid to this group --init program execute this program/script before doing anything --cap capset set capset name. You can specify several capsets. --verbose be verbose --quiet do no logging (to syslog) I know the following capset names: CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_FSETID CAP_FS_MASK CAP_KILL CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_LINUX_IMMUTABLE CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_ADMIN CAP_NET_RAW CAP_IPC_LOCK CAP_IPC_OWNER CAP_SYS_MODULE CAP_SYS_RAWIO CAP_SYS_CHROOT CAP_SYS_PTRACE CAP_SYS_PACCT CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_NICE CAP_SYS_RESOURCE CAP_SYS_TIME CAP_SYS_TTY_CONFIG Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

1 0

excessive marks
by Chrissy LeMaire 03 Jan '00

03 Jan '00

Anyone have any ideas about this? Perhaps I'm not used to a not-so-active machine..but it seems I have way too many "mark"s in my /var/log/messages file -- 1289 since dec 1 Jan 3 00:00:05 box su: (to nobody) root on none Jan 3 00:16:57 box -- MARK -- Jan 3 00:36:57 box -- MARK -- Jan 3 00:56:57 box -- MARK -- Jan 3 01:16:57 box -- MARK -- Jan 3 01:36:57 box -- MARK -- Jan 3 01:56:57 box -- MARK -- Jan 3 02:16:57 box -- MARK -- Jan 3 02:36:57 box -- MARK -- Jan 3 02:56:57 box -- MARK -- Jan 3 03:16:57 box -- MARK -- Jan 3 03:36:57 box -- MARK -- Jan 3 03:56:57 box -- MARK -- Jan 3 04:16:57 box -- MARK -- etc etc etc

5 6

Re: [suse-security] SuSE 6.2 / Error in firewall-script?
by Dan Am 03 Jan '00

03 Jan '00

Hi Fabe, you wrote: >after the chain "user_fw" is set up within the script >/sbin/init.d/firewall there is one line I can't understand: > $IPCHAINS -A user_fw -s 0/0 -d 0/0 $ACC_FLAG -j ACCEPT >Doesen't this line mean I accept everything from any source and forward >it to any destination? 1) $ACC_FLAG can modify this, I should think. 2) To get to this line the rules before apply. This just a cleanall, for those packets that could get to this point. 3) At least that's what I think. best dan

1 0

SuSE 6.2 / Error in firewall-script?
by Fabian Pehla 02 Jan '00

02 Jan '00

Hi, after the chain "user_fw" is set up within the script /sbin/init.d/firewall there is one line I can't understand: $IPCHAINS -A user_fw -s 0/0 -d 0/0 $ACC_FLAG -j ACCEPT Doesen't this line mean I accept everything from any source and forward it to any destination? Does this rule make sense? Why should I accept everything after just having granted access to only some special hosts/ports? Is there a security hole? Thanks for you help Fabian

1 0

[Fwd: [suse-security] majordomo vulnerability]
by Torsten Behle 02 Jan '00

02 Jan '00

Hi Marc, can you say (or point to an URL), what these vulnerabilities are? Getting root-rights as a normal user? Or just abusing majordomo, getting around moderation etc.? Thanks Torsten Marc Heuse wrote: > Hi, > > the mailinglist software "majordomo" was found having several local > vulnerabilties. However, the licence of the program prohibites us providing > a fix! :-( > You should either remove majordomo or trust your local users until an > official fix from greatcircles is available (which we will distribute for > SuSE customers too then of course). > Sorry guys, thats all we can do at the moment.

2 1