October 2000 - openSUSE Security - openSUSE Mailing Lists

legal possibilities of attack reaction
by Michael Weiser 24 Oct '00

24 Oct '00

Hello, I'm administering some Linux machines permanently connected to the internet which I'm trying to protect reasonably. Therefore I disable unneeded services, keep software up-to-date, run a packet filtering firewall and use a intrusion detection and protection tool (snort). But the number of ping-, version- and portscans increases every day, which makes me want to react more actively. Of course it'd be stupid to attack the attacker myself but I'd like to at least notify the administrators of the malicious users/customers of what's going on so that they (can) stop it. No problem so far but unfortunately a lot of sysadmins don't seem to feel responsible until someone sues them. Therefore I'd like to send out a carefully researched mail filled with some paragraphs to make 'em think. But since I'm a complete idiot at legal issues I don't want to do it myself and prefer some already better done work of someone who knows what she is speaking about. :) So my (frequently asked, I fear) question is: Can someone help me out with such a text, some facts or a starting point for a search? I'd especially be interested in German and American law since I and the machines in question are situated in Germany and most attacks come from American networks. Thanks for your help and sorry if it's really an FAQ and already answered elsewhere. -- bye, Michael Elephants don't play chess!

8 10

PPP + SuSE Firewall
by Phillip Beal 23 Oct '00

23 Oct '00

Hey, I have a friend who has a ppp connection from his SuSE box. However, he's also running a firewall on this box, but he has to restart the firewall when he logs on to the internet via the ppp connection. I've once seen somewhere that you don't have to restart the firewall every time you connect via ppp. Is this true, and if so where is the option located at so I can reconfigure this for him. Thanks, -- Phillip Beal Evil Genius In Training Electrical and Computer Engineering "God, Root, what is difference?" S+LUG Vice-President -Userfriendly.org

2 1

Firewall and FTP
by Matthias Lenhardt 23 Oct '00

23 Oct '00

Hi list, I'm currently wondering about the problem with firewalling FTP traffic. I thought I knew about the way a FTP transfer goes on, so I created the following ipchains rules to enable FTP connections from inside to outside: ipchains -A input -p TCP -s 0.0.0.0/0 21 -d <MyServerIP> ! 0:1023 ! -y -i eth1 -j ACCEPT ipchains -A input -p TCP -s 0.0.0.0/0 20 -d <MyServerIP> ! 0:1023 -i eth1 -j ACCEPT That works properly untill I recognized, that some FTP connections use only ports over 1023 as source and destination in both directions as well for control as data. As it seems to be random ports, the only way I saw, to enable FTP through my firewall, was to add the following rule: ipchains -A input -p TCP -s 0.0.0.0/0 ! 0:1023 -d <MyServerIP> ! 0:1023 ! -y -i eth1 -j ACCEPT Because I really don't like that kind of very unspecific rule, my question to you is: Is this really the only way to control FTP transfer with ipchains firewall and if not what's the alternative, which is more secure? Thanks in advance, best regards and sorry for my poor english, Matthias Lenhardt -- <<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>> Matthias Lenhardt - Software Ingenieur mail:mlenhardt@inonet.com InoNet Computer GmbH http://www.inonet.com/ Computers are like air conditioners: They stop working properly if you open windows. <<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>

2 1

KILL connection
by Sridhar 23 Oct '00

23 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi from what little i know of tcp, it seems if u are root on a linux comp, then u can produce a tcp packet of desired requirements. Also, u can produce an RST packet, and as long as there is no need for a tcp handshake ( there is no connection) then it is perfectly logically ok to spoof the ip address of the source sending the packet. Then supposing i write a program that keeps sending RST packets to a specified port of a target with spoofed source ip addresses from 0.0.0.0 to 255.255.255.255, then is it possible to DOS it ? How do u prevent this from happening ? regards cheedu - -- ********* Perhaps it is better to be un-sane and happy, than sane and un-happy. But it is best of all to be sane and happy. --Arthur Clarke, "3001:The Final Odyssey" ********* -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.2 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE57enarHJM2EAbaXwRAgOjAKDb3ShgEmBCX58v2KEzvjxKWC8R2ACbBuna AMMs+tPMVNG5Y7SFXbOwcZ4= =DyxS -----END PGP SIGNATURE-----

3 2

PPP Dial-in Server Authentication
by Steven Thompson 23 Oct '00

23 Oct '00

Hi All I'm looking to set-up a Linux Dial-in server for any type of client. What is the most secure method of Authentication (eg Radius, PAP, CHAP). Thanks in advance Steven

2 1

Free HTTP proxy similar to SuSE FTP Proxy
by Steven Thompson 23 Oct '00

23 Oct '00

Hi All I'm looking to set-up email access via http, does any one know of a http proxy App that works the same, as the SuSE FTP Proxy which allows you access internal network http servers. Thanks in advance Steven

2 1

Re: [suse-security] Application Level Gateways
by Kis-Szabo Andras 23 Oct '00

23 Oct '00

Hi, http://www.balabit.hu/products/zorp/ http://www.balabit.hu/products/zorp/summary.en.phtml (Under dev.) Regards, kisza -- Kis-Szabo Andras Budapest University of Technology and Economics ---------------------------/ Schonherz Dormitory kisza(a)sch.bme.hu /---------------------------------33O-->>>>.Info

1 0

Application Level Gateways
by davidscholz 23 Oct '00

23 Oct '00

Hi List, I'm searching for free Firewall software for linux. Easy to install and to use. Don't know if it's the right list,but I don't know a better. Thanks

2 1

sharing user ids and passwords
by Dan Sveen Olsen 23 Oct '00

23 Oct '00

Hi, I don't know if this has been asked before, but I'll try anyway. And please ignore this if you think it's not related to the topic of this list. :) I am going to do some testing with two computer (just for fun), both with SuSE 7.0, and a firewall between them (OpenBSD 2.7). The first computer will be accessed normally by users while the other one will be a NFS server to the first one (ie. the users homes will be automounted from the NFS server). - Is it possible to filter the NFS trafic well? - Do I need similar passwd/group/shadow/gshadow files on both computers? - Is it possible to have the NFS computer as master password storage for the first one? - Can RADIUS be used to this (I know a PAM exist for RADIUS, but will it fit my needs?)? - Other alternatives? NIS? NIS+? Transfer the files by SSH on a regular basis? The main question would be: what alternatives exist if you want to share user ids and passwords between two or more computers... and in a hopefully secure way (ie. if you get root on one computer, you won't be able to get the whole password list from the master). Have a nice day! Dan Sveen Olsen

2 1

Re: [suse-security] Group-Password
by Eilert Brinkmann 21 Oct '00

21 Oct '00

On Tue, 17 Oct 2000 at 14:14 +0200, Matthias Krawen wrote: > Do I have to enter a password for a group or add * manually to each > entry for pw ? Or is it save to leave it spare ? Where are > grouppasswords used ? Usually you have a "x" in the password field in /etc/group and a "*" or "!" (i.e., no valid password) in the password field in /etc/gshadow. In this case a non-privileged user can not become a member of a group if it's not his initial group and he is not listed as a member in /etc/group or /etc/gshadow. If a valid password is set for a group (in /etc/gshadow), every user who knows this password can switch to this group with the newgrp command. Therefore the password field should never be empty. Eilert -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0