November 2000 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement: openssh/ssh (SuSE-SA:2000:47)
by Roman Drahtmueller 24 Nov '00

24 Nov '00

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: openssh/ssh Announcement-ID: SuSE-SA:2000:47 Date: Friday, November 24th, 2000 16:30 MET Affected SuSE versions: 6.4, 7.0 Vulnerability Type: clientside remote vulnerability Severity (1-10): 6 SuSE default package: yes Other affected systems: systems w/ openssh versions before 2.3.0 Content of this advisory: 1) security vulnerability resolved: openssh problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information openssh is an implementation of the secure shell protocol, available under the BSD license, primarily maintained by the OpenBSD Project. Many vulnerabilities have been found in the openssh package, along with a compilation problem in the openssh and ssh packages in the SuSE-7.0 distribution: An openssh client (the ssh program) can accept X11- or ssh-agent forwarding requests even though these forwarding capabilities have not been requested by the client side after successful authentication. Using these weaknesses, an attacker could gain access to the authentication agent which may hold multiple user-owned authentification identities, or to the X-server on the client side as if requested by the user. These problems have been found/reported by Markus Friedl <markus.friedl(a)informatik.uni-erlangen.de> and Jacob Langseth <jwl(a)pobox.com>. A problem in the configure script in both the openssh and ssh package on the SuSE-7.0 distribution caused the sshd programs to not be linked against the tcp-wrapper library. By consequence, access rules for the sshd server-side service as configured in /etc/hosts.allow and /etc/hosts.deny were ignored. This has been reported to us by Lutz Pressler <lp(a)SerNet.DE>. We thank these individuals for their contribution. Sebastian Krahmer <krahmer(a)suse.de> found a small tmp file handling problem in the perl script `make-ssh-known-hosts´. A (local) attacker could trick the perl program to follow symbolic links and thereby overwriting files with the privileges of the user calling make-ssh-known-hosts. The solution for the first three problems (agent+X11-forwarding, missing libwrap support) is an upgrade to a newer package. The tmp file problem can be easily solved by hand. Please see the special install instructions below. Note: Upon public request, we also provide update packages for the SuSE-6.3 Intel distribution, even though the openssh packages was not included in this distribution. special install instructions: ===================================== To find out which package (ssh or openssh) you use, please use the command `rpm -qf /usr/bin/ssh´. __ case openssh: Please follow the instructions below to download and install the update package. Afterwards, restart the sshd daemon: `rcsshd restart´. __ case ssh: before SuSE-7.0 (excluding 7.0): In the file /usr/bin/make-ssh-known-hosts, please change the line (around line 102) $private_ssh_known_hosts = "/tmp/ssh_known_hosts$$"; to read $private_ssh_known_hosts = "~/ssh_known_hosts$$"; and you are done. SuSE-7.0: Please follow the instructions below to download and install the update package. Afterwards, restart the sshd daemon: `rcsshd restart´ Please choose the update package(s) for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-2.3.0p1-0.i386.rpm 3c7b9044ffb64f9f74c904eb2b278eb2 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm aebcda19518208497671e752bbdfaeb8 SuSE-6.4 ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/openssh-2.3.0p1-0.i386.rpm 04c17b0eba99c798ae401fb9aafbc7e4 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 2003ab41cfa32ef39b11b4977ef4cd1f SuSE-6.3 ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/openssh-2.3.0p1-0.i386.rpm 04c17b0eba99c798ae401fb9aafbc7e4 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/openssh-2.3.0p1-0.src.rpm 2003ab41cfa32ef39b11b4977ef4cd1f Sparc Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm 898aaaacee88777429496f1a5658076f source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 97868b04de04a0baafcee69ebbbe6079 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-2.3.0p1-0.alpha.rpm dd12c60b2744455780c976b115b26f27 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 6df5af1a88fda4d8fc1a493e4d10bc01 SuSE-6.4 ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/openssh-2.3.0p1-0.alpha.rpm 99de4bb6f183be1b69a610744f4566bc source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm aa56e311205ba58478c815760452367e PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-2.3.0p1-0.ppc.rpm 72f7c339991e54a476585012423dda62 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 749ccc55396944ad43c1977e55903958 SuSE-6.4 ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/openssh-2.3.0p1-0.ppc.rpm 59727fa055e5d835bc4e455302b1ef49 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 7e42dbad4e50a2ad9156e94cf2a93955 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Clarification: In my message (Subject: "SuSE: miscellaneous"), dated Wed, 15 Nov 2000, concerning the paragraph about runtime linking problems in gs (GhostScript) , I have stated that the problem will be fixed in future versions of the SuSE distribution. This does not touch the fact that we will of course provide fixes for the older distributions. - pine The packages (version 4.30) are on our ftp server and can be downloaded. The SuSE security announcement is pending. - netscape Michal Zalewski <lcamtuf(a)DIONE.IDS.PL> has reported a buffer overflow in Netscape's html parser code. A specially crafted html document may cause the browser to execute arbitrary code as the user calling the netscape program. The packages are available for download on ftp.suse.com. A security announcement is on the way to address the issue. - gs (ghostscript) Two vulnerabilities have been found in the ghostscript package as shipped with SuSE distributions: Insecure temporary file handling and a linker problem that could make gs runtime-link against ./libc.so.6. We're currently working on update packages. In the meanwhile, it is advised to not run gs or applications that call gs from within a world- writeable directory. - jed The text editor jed saves files in /tmp upon emergency termination in an insecure way. This problem was fixed with the release of SuSE-6.3 after a SuSE-internal code audit by Thomas Biege <thomas(a)suse.de>. The information about the existence of this bug was not communicated to the public because the editor was not very widely used at that time. We will provide update packages for the SuSE releases 6.0, 6.1 and 6.2 shortly. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOh6OSney5gA9JdPZAQFsKAf/Rn7V0D4N4nRRhWcYvvtNeIYfYsitOByR 7W/Q1Mbh3WIjDehw+3enCZi9PBB5GnoMVyMRthaUH1+1zY5DT8q/bkpgvhW3pD+F pP/ksNRwJte2mZNdd/7UUu/cS8ditCIRO65JGyttqdU6VhoGLFgXiZPE0YWcfyJj VoCRR4Jv6peCodSZdfOe5DVZUTfZATdp8Fm1A5+0XAVwfgr3n/J/aoJgkRwWJ/Kr szGp7Q9TeIOzKZJOHxwKnQ+c+8ge0F2h02WsI8cq6B8HMhVwYnV4rXU4E7CmYnzm sn6lKj7qTykqajNi1zqPjGpUDNU7gH1L5zMXiiisgkacT9bavwF7lw== =Uskv -----END PGP SIGNATURE-----

4 4

re putty
by webmaster 24 Nov '00

24 Nov '00

Hi Peter, Thanks for the idea, putty indeed works better - without the nagging ads. What I feel at this moment - just downloded it - that it does not save sessions Bye Antal

2 1

tcp syncookie kernel option
by Philipp Snizek 24 Nov '00

24 Nov '00

Hi all Yesterday there was a discussion about kernel options like tcp_syncookies. Exactly to this matter I hope to get an answer to the following: Taken from http://www2.little-idiot.de/firewall/zusammen-49.html I quote: Syn cookies sollte man ausschalten, zumal diese einen Angriff nur dann verhindern, wenn der Angreifer mit LINUX und aktivierten SYN Cookies arbeitet. Ansonsten sind diese fur DoS anfallig. End of quote. Translation: Syn cookies should be disabled. An attack can only be prevented, if the attacker uses with Linux and SYN cookies activated as well. SYN cookies enabled is susceptible on DoS. Please don't hang me because of translation erros. Does anybody have more information (I do not mean www.bb-zone.com - I didn't find much there) about this? Whether it is true and mainly what DoS attacks it does not defend against? Thank you Philipp

2 1

sshd2 start at boot
by webmaster 24 Nov '00

24 Nov '00

Well, after reboot it logged this Nov 23 11:07:55 mand sshd2[117]: Listener created on port 22. Nov 23 11:07:55 mand sshd2[118]: Daemon is running. Nov 23 11:08:05 mand sendmail[138]: starting daemon (8.9.3): SMTP+queueing@00:30:00 Nov 23 11:08:06 mand sshd[144]: error: bind: Address already in use Nov 23 11:08:06 mand sshd[144]: fatal: Bind to port 22 failed: Transport endpoint is not connected. And when connecting from intranet machine of private IP, it logs this: at the 3rd row it seems to be swithing on to sshd, but I do not know where is sshd in inet.d Nov 23 11:08:35 mand sshd2[118]: connection from "192.168.42.2" Nov 23 11:08:36 mand sshd2[172]: DNS lookup failed for "192.168.42.2". Nov 23 11:08:36 mand sshd[172]: log: Generating 768 bit RSA key. Nov 23 11:08:37 mand sshd[172]: log: RSA key generation complete. Nov 23 11:08:37 mand sshd[172]: log: Connection from 192.168.42.2 port 1224 Nov 23 11:08:37 mand sshd[172]: log: Could not reverse map address 192.168.42.2. Nov 23 11:08:43 mand sshd[172]: log: Password authentication for antal accepted. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

2 1

Zip on a fileserver
by gtschakert＠gmx.de 24 Nov '00

24 Nov '00

Hello, I have the following problem. I build a box for fileserving with nfs. No user is allowed to login directly to the computer, but some user wishes to use programs like zip to compress their data. They zip their data on another box which means, the data are transferred to their box which zips the data and then the data are transferred back to the server. This solution is naturally not the optimum, because it cost a lot of time and raises the network traffic. Now my question is: Is it possible to allow the users to zip directly on the server without giving them the possibility to log in. regards Guido

2 1

how to handle attacks by abused systems
by Stiefenhofer, Marek ECOFIS 24 Nov '00

24 Nov '00

Hi security experts, below some Email exchange as reaction to several attacks to our systems. My question: did I go to far? Would you agree In advising vulnarabilities on the attackeres systems. Any further comments? Bye Marek -----Ursprüngliche Nachricht----- Von: Stiefenhofer, Marek ECOFIS Gesendet am: Freitag, 24. November 2000 10:03 An: 'attacker(a)somewhere.com' Betreff: AW: ABUSE: Attacks by one of your hosts Warne, thank you for your kind interest. I am responsible for IT-Security in one of Germanys largest non-public wide area networks. So you received my Email out of standard procedure (we use Intrusion-Detection-Systems and alert most hacking attempts). I'm quite sure that our security is well set up. But you should consider implementing some more security systems and concepts to your site. The biggest problem you have is: your webservers are not protected by any kind of firewall. This offers attackers lots of possibilties. On webservers are usually more services running than just the http-service. As you don't use firewalls, everyone can check for this services and even use it and if someone has access to your server he can install new services such as trojan horses etc. here's an actual check of 123.123.123.123: 21/tcp open ftp -> Microsoft FTP Possibility for Denial-of-Service Attacks 25/tcp open smtp -> Mail, no problem 53/tcp open domain -> DNS, maybe a problem 80/tcp open http -> Your IIS still provides possibilities to remotely write files and execute commands 110/tcp open pop-3 -> POP3, DoS 125/tcp filtered locus-map 134/tcp open ingres-net -> don't know 135/tcp filtered loc-srv 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp filtered netbios-ssn 157/tcp filtered knet-cmp 443/tcp open https -> secure http, no problem 593/tcp filtered http-rpc-epmap 1030/tcp open iad1 -> don't know 5631/tcp open pcanywheredata -> either you use remote administration, or someone installed PC-Anywhere as trojan horse 8080/tcp open http-proxy -> http-proxy 12345/tcp open NetBus -> !!!!!NETBUS!!!!! This is a well-known trojan horse. Seems that someone has broken into your system 65301/tcp open pcanywhere -> see above As you can see your technical staff has closed all netbios ports. These services are used by Windows-Systems for their specific network communication (called SMB). That's good effort but not enough. As I tried to explain I could still attack all running services on your system and even break into. A Firewall would protect your systems by denying all access from the internet except the needed services (http, https, ftp, smtp). But this is still not secure. Now we come to the requested part "passive server check". As explained the firewall leaves the http service open. An attacker would search for bugs in the http-service. Such bugs are caused by the Operating System, by bad implemantations of the http-service or by customers scripts running on your server. Attackers use those bugs to create files on your webserver or remotely execute code. A passive scan is done by freely available tools (such as twwwscan) which check if certain files (usually scripts) exist on your webserver. An active scan checks how this files react to certain requests. Attackers use the found vulnarabilities to break into your systems. So one of the most important security issues is to learn about all known vulnarabilities and exploits and patch your internet-services. To get it clear: it is still possible to execute code on your server via a vulnarability called "newdsn.exe". People can still break into your systems and can still install trojan horses to attack other parts of your network. It is quite sure that you have been compromised and still are abused (NETBUS). Anyway I hope my answers will help you in securing your services. And don't hesitate to ask your technical staff to contact me. Best regards, Marek Stiefenhofer (IT Security) ECOFIS GmbH Tel.: (02 31) 75 45-1 17 FAX : (02 31) 75 45-2 22 e-mail: m.stiefenhofer(a)ecofis.de Besuchen Sie auch unseren neuen Online-Dienst: http://www.alleco.de -----Ursprüngliche Nachricht----- Von: Warne [mailto:attacker@somewhere.com] Gesendet am: Donnerstag, 23. November 2000 22:28 An: Stiefenhofer, Marek ECOFIS Betreff: RE: ABUSE: Attacks by one of your hosts Marek, I have tried to contact you by telephone, but have been unsuccessful. To introduce myself, my name is Warne Boulton, the General Manager and part owner of appHosting.com I was most concerned to receieve your email re the attack on your system via one of our servers. First, I hope that your security was better than ours and that no damage was done to your server or systems. Our technical people are have worked on the issue and tell me that all is ok. I was interested in the 'passive' test that was instigated. Can you provide me details (in laymans terms as I'm not technical) of how to run this test so that I can arrange for it to be re-run against our servers to ensure this doesn't happen again. Thank you and best regards Warne -----Original Message----- From: Stiefenhofer, Marek ECOFIS [mailto:m.stiefenhofer@ecofis.de] Sent: Wednesday, 22 November 2000 1:05 AM To: 'support(a)somewhere.com'; 'webmaster(a)somewhere.com'; 'abuse(a)somewhere.com'; 'postmaster(a)somewhere.com' Subject: ABUSE: Attacks by one of your hosts *** PGP Signature Status: good *** Signer: Marek Stiefenhofer <m.stiefenhofer(a)ecofis.de> *** Signed: 21.11.00 15:08:38 *** Verified: 24.11.00 08:54:16 *** BEGIN PGP VERIFIED MESSAGE *** Ladies and gentleman, according to our logfiles, one of your hosts (attacker.somewhere.com 123.123.123.123]) is the origin of several common attacks on our webservers. For the exact type of attacks and time (GMT+1) see attached log file. We understand such traffic as unauthorized access to our network and internal data and so far as criminal act. We may enforce you to stop those attempts in the future. A passive check of your webserver shows that there are several well-known possibilities for breaking into your system (see below). You should consider this host already being hacked and abused by third parties. We recommend to shut down the server and check for trojan horses etc. At least you should apply all patches provided by Microsoft to secure the IIS-Webserver. Checking: Remote File create,IIS DoS(newdsn.exe) !!! FOUND !!! Checking: Frontpage98 Hole(_vti_inf.html) !!! FOUND !!! Checking: IIS (showcode.asp) Hole !!! FOUND !!! Checking: RDS Securty Hole(msadcs.dll) !!! FOUND !!! Checking: IIS Path Reveal(anything.idq) !!! FOUND !!! Checking: IIS Path Reveal(anything.ida) !!! FOUND !!! Checking: Malformed Hit-Highlighting Argument !!! FOUND !!! Checking: Index Server Security Hole(null.htw) !!! FOUND !!! Checking: FrontPage 2k <=1.1 Path vul !!! FOUND !!! Checking: FrontPage 2k,IIS Multiple (shtml.dll) !!! FOUND !!! Checking: FrontPage MS-DOS Device DoS(shtml.exe) !!! FOUND !!! You are appreciated for calling or mailing me directly to get further information... Please acknowledge the receipt of this message. Kind Regards, Marek Stiefenhofer (IT Security) ECOFIS GmbH Tel.: +49-2 31 75 45-1 17 FAX : +49-2 31 75 45-2 22 e-mail: m.stiefenhofer(a)ecofis.de Besuchen Sie auch unseren neuen Online-Dienst: http://www.alleco.de *** END PGP VERIFIED MESSAGE *** ÿ

2 1

modutils update
by John 24 Nov '00

24 Nov '00

Hi, I'm a little confused about the modutils / modules security upgrade. The announcement from SuSE stated that 6.4/7.0 are affected, as it's only more recent versions of modutils that are vulnerable. However, the announcement on the kernel mailing list stated that modutils versions > 2.1.121 are vulnerable. Checking on my SuSE 6.1 system with /sbin/modprobe -V shows that it's running version 2.2.2-pre6. So - are versions of SuSE prior to 6.4 vulnerable to this problem as well? If so, will suse be producing an upgrade, or do I need to upgrade modutils from source? Thanks, J. | John Patterson / Jarel on Snowplains (telnet to snowplains.org 3456) | | Email: jarel(a)snowplains.org | Web: http://snowplains.org/~jarel/ |

6 7

AW: [suse-security] how to handle attacks by abused systems
by Stiefenhofer, Marek ECOFIS 24 Nov '00

24 Nov '00

Hi Peter, look at the bottom of my Email to Warne: +49-2 31 75 45-1 17

1 0

Re: [suse-security] count traffic
by Martin Peikert 24 Nov '00

24 Nov '00

Martin Peikert <martin.peikert(a)innominate.com> wrote: > > Hi Vlidimir, Sorry for the typo, Vladimir. Martin -- martin.peikert(a)innominate.com system engineer innominate AG clustering & security the linux architects tel: +49-30-308806-0 fax: -77 http://www.innominate.com

1 0

Re: [suse-security] SuSEfirewall www-server inside the DMZ
by Dpto. Tecnico - EDS Asturias S.L. 24 Nov '00

24 Nov '00

Hi, I have the same problem, but cannot solve it. Neither found any "Thomas Hildmann" post.. Can you describe what and how you did it.. thks all.

1 0

Re[2]: [suse-security] count traffic
by vladimir m. bondarev 24 Nov '00

24 Nov '00

Hello, MaD. Friday, November 24, 2000, 10:49:36, you wrote to me: Md> as far as i know, ipchains has a facility to use counters which you Md> could work into a monitoring process... can you explain me how to use ipchains for this? and how to make traffic logs every month? Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru

2 1

AW: [suse-security] count traffic
by Battisti Markus 24 Nov '00

24 Nov '00

there is a package in the suse dist who counts all the traffic it named netacct he writes a logfile the problem is he logs ALL the traffic so you need a script who filter this pay attention to the size of the logfile it grows fast ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards proTask Consulting Battisti Markus ICQ:42524700 http://www.protask.at mailto:markus.battisti@protask.at PGP key available on request This message was sent using 100% recyclable electrons Hello, suse-security. i'm sorry to bother you with this question, but i've spent much time with this problem and haven't solved it yet. so, the situation: eth0 is connected to local network (vlan-29) (10.51.29.x) eth1 is connected to internet eth2 is connected to local network (vlan-30, vlan-31) (10.51.30.x and 10.51.31.x) there is a very big lan and just one server connects it to internet. i need to count traffic for all ips in lan (vlan-29,30,31) that goes from server (10.51.29.50 for vlan-29, 10.51.30.10 for vlans-30,31) to users. i count web traffic with squid, but i also need to count icq (we're using socks for it) and mail (everybody have mailboxes on server) traffic. masq enabled only for chosen users (not so many), so i don't need to count ftp, irc traffic. can anyone help me to solve this problem? thanks in advance. Friday, November 24, 2000 -- vladimir m. bondarev, icq uin: 62393277 paradox team web: http://scene.org.ru --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

OT: Happy Thanksgiving Day
by Ralph De Witt 23 Nov '00

23 Nov '00

Hi: To one and all Happy Thanksgiving Day. May you have as many blessing as I have to be thankful for. May God Bless you my friends one and all. -- Ralph F. De Witt ----------------------------------------------------------------------------- PROUD USER OF SuSE LINUX 7.0 It said uses Windows 98 or better so I installed SuSE 7.0 Register Linux User 168814 ICQ #49993234 "Beer is proof that God loves us and wants us to be happy" -Benjamin Franklin -----------------------------------------------------------------------------

1 0

two questions
by Philipp Snizek 23 Nov '00

23 Nov '00

Hi list-users Please can somebody tell me where to find a bugtraq mailinglist that only deals with linux security bugs? and, according to the ip_always_defrag kernel option question I would like to ask you what other kernel options are recommended to install to have improved security on an ipchains paketfilter box. Thank you all, Philipp

4 3

Re: [suse-security] Kernel Option : IP: always defragment
by christian.burri＠synecta.ch 23 Nov '00

23 Nov '00

I'd be interested in this one too :) greets Chris .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ "Andreas Rittershofer" To: suse-security(a)suse.com <andreas@ritter cc: shofer.de> Subject: Re: [suse-security] Kernel Option : IP: always defragment 23.11.2000 14:54 Please respond to andreas > No, this is a runtime option and must be enabled everytime you boot, > so stick it in a startup script. > > Cheers > > Nix > > At 02:17 PM 23/11/2000 +0100, you wrote: > >Hi, > > > > > echo 1 > /proc/sys/net/ipv4/ip_always_defrag Where can I find a list of all options in /proc/sys/net/ipv4, what to send to them to activate them and what they are doing exactly? mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Kernel Option : IP: always defragment
by dgolesny 23 Nov '00

23 Nov '00

Hi, I want to activate the Option "IP:always defragment" in mein Kernel-Konfiguration to make my Firewall more secure but I didnt find this OPtion in menuconfig or in the file .config Is this Option in a SuSE7 Kernel active or not ? Or where can I activate it ? Or how can I force the kernel to reassemble IP-Fragments before Forwarding ? Thanx Daniel Golesny

6 6

sshd2 start at boot
by webmaster 23 Nov '00

23 Nov '00

I followed steps in Readme Somehow I am not sure of proper connection Log shows this Nov 23 10:00:45 mand sshd[144]: fatal: Bind to port 22 failed: Transport endpoint is not connected. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

1 0

sshd2 start at boot
by webmaster 23 Nov '00

23 Nov '00

Thankx for all the help especially to semat(a)wawa.eahd.or.ug for the script Although it turned out to have a similar boot.startup script among manuals, semat`s version worked also fine I am using ssh from remote as well as from intranet machines to server. On intranet machines the ssh client is an SSH-1.5-PenguiNet windows shareware How can I check that sshd2 is in compatibility with ssh1? Is simple work enough? /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

2 1

Wierd sendmail access file problem
by Nick Zentena 23 Nov '00

23 Nov '00

Hi, If I put this line in my /etc/mail/access file sinamail.com 550 Unknown user I get makemap: /etc/mail/access: line 153: key sinamail.com: put error: Operation not permitted Now I can put anything else in the file and things work like they should but this causes things to choke. Is sinamail.com some sort of code word??? Thanks Nick

3 2

RE: [suse-security] Securid for suse
by Di Lisi, Giancarlo 23 Nov '00

23 Nov '00

hi RSA itself has a "old" ACE Linux Client, but it is very difficult to become... ask your vendor for it. regards ,giancarlo > -----Original Message----- > From: Peter Lange [mailto:peter.lange@antaris.de] > Sent: Mittwoch, 22. November 2000 11:19 > To: suse-security(a)suse.com > Subject: [suse-security] Securid for suse > > > Hello all, > > anyone knows about a ACE-Agent for Securid authentication > available for > SuSe? > > Thanks > -- > Mit freundlichem Gruß > > i.A. Peter Lange > PROFI Engineering Systems AG > Geschäftsbereich Antaris > > Systemtechnik > Moosbürger Str.20 > D-92637 Weiden > Tel. 0 961/89-502 > Fax 0 961/89-579 > eMail: plange(a)antaris.de > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

SuSEfirewall www-server inside the DMZ
by Fuchs Josef 23 Nov '00

23 Nov '00

Thanks all out there! My problem is solved :-) I used the portforward statement which was suggested by Thomas Hildmann and define the DMZ as masquerading.

1 0

strange DHCP entries
by Nikolai Dahlem 22 Nov '00

22 Nov '00

Hello, little OT, but this is weird, on my DHCPserver i get a lot of these log entries: DHCPDISCOVER from 52:41:53:20:20:ea:a8:34:61:54:c0:01:01:00:00:00 via eth1 What kind of a MAC address is this supposed to be ? Any suggestions ? regards N. Dahlem

3 2

SSHD2 start at boot time
by webmaster 22 Nov '00

22 Nov '00

Hi, I am at loss with SuSe6.3 init.d I hope there are some who could give me step by step instructions how to start sshd2 automatically at boot time Manual says: to start sshd2 at boot ...there should be symbolic links to its startup script in /etx/rc.d/init.d directory. In SuSe, add symlinks manually But on my box it is: ls -al /etc/rc.d/init.d lrwxrwxrwx 1 root root 1 May 2000 /etc/rc.d/init.d -> . The sshd2 path is /usr/local/sbin/sshd2 At present sshd is running at boot from /usr/sbin/sshd I am at loss - maybe very simple but ....thanks for tipps. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

3 2

X Windows
by Steffen Beck 22 Nov '00

22 Nov '00

hey all ... i was wondering if any of you people know why my pointer, when in X all of a sudden does strange things and open menues and programs... It also happened when I ran redhat 6.2 ... anybody know what im doing wrong ?? is it something to do with XF86Config ?? thanks in advance... Steffen Beck Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

5 4

SuSEfirewall www-server inside the DMZ
by Fuchs Josef 22 Nov '00

22 Nov '00

Hi, All :) I hope sombody can help me with my configuration. Following scenario: public Internet | | | | | eth0 - only one official Internet Address | which is directly connected | to the internet leased line modem. | <firewall> -- eth2 -- DMZ 192.168.0.0/24 ---------- <www.server 192.168.0.111> | | eth1 -- 192.168.30.0/24, 192.168.31.0/24 ... | | | <internal private networks> I use the <firewall> to allow accessing the Internet from the internal networks. This part is functioning well :) Now I like to configure a www.server with an private IP number which is reachable from public Internet (only http should be allowed). I can Ping the www.server successfully from the firewall pc but i'm not able to get a http: connection with netscape. Also it's not possible to get a connetion from the public internet. My SuSE Firewall Settings are : FW_DEV_WORLD="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.30.0/24 192.168.31.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="no" FW_SERVICES_EXTERNAL_TCP="smtp domain nntp http" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_DMZ_TCP="http" FW_SERVICES_DMZ_UDP="domain" FW_SERVICES_INTERNAL_TCP="smtp domain ftp http nntp" FW_SERVICES_INTERNAL_UDP="domain" FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" FW_SERVICES_TRUSTED_UDP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_MASQ_TCP="0/0,192.168.0.111,80" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" This is the output from tcpdump -i eth2 when trying to connet with netscape to the www.server from the firewall.pc 10:19:21.570488 arp who-has 192.168.0.111 tell firewall.pc (0:10:5a:49:52:7) 10:19:21.570719 arp reply 192.168.0.111 is-at 0:50:fc:22:44:12 (0:10:5a:49:52:7) 10:19:21.570750 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 804153 0,nop,wscale 0> (DF) 10:19:21.571016 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) 10:19:24.563563 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 804453 0,nop,wscale 0> (DF) 10:19:24.563823 192.168.0.111.http > firewall.pc.rkb-oscs: . 1:1(0) ack 1 win 17520 <nop,nop,timestamp 671854 804453> (DF)10:19:24.806624 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,n op,sackOK> (DF) 10:19:30.563561 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 805053 0,nop,wscale 0> (DF) 10:19:30.563822 192.168.0.111.http > firewall.pc.rkb-oscs: . 1:1(0) ack 1 win 17520 <nop,nop,timestamp 671915 805053> (DF) 10:19:31.368814 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF)

3 2

Problems with sendmail & relay
by RoMaN SoFt / LLFB!! 22 Nov '00

22 Nov '00

Hi. I'm running SuSE 6.4 and need to run sendmail (host permanently connected to Internet). By default, SM 8.9.3 comes with relay denied for all. I want to set an acceptable secure sendmail. The scenario is as follows: - the smtp (mta) is aaa.bbbb.com (where aaa & bbbb are ficticious). I want the rely denied by default but also want granted access for users whom From:'s field is: *(a)bbbb.com and *(a)cccc.com (being cccc.com another domain which is NOT local to the machine; bbbb.com is the "local" domain, I mean, there is a MX record pointing to the mta's ip.). The problem is that my users can connect to the smtp machine from *ANY* ip. So the rely-filters only could trust in the "From:" line in header's mail. I know this isn't too much secure, since spammers could send mail spoofing the From: field (which is trivial). But it's more secure than a sendmail running with "promiscuos relay" feature turned on. I'm new to sendmail so I need some help. I've read some docs at www.sendmail.org and have a look to O'Reilly sendmail book. But it still doesn't working. These are the attempts I've made: 1) Using Yast, I created a /etc/sendmail.cf. Then I personalized a little using Yast too and added the domain: bbbb.com and ddd.bbbb.com (which is an alias to aaa.bbbb.com). Afterwards I modified /etc/mail/access and added: cccc.com RELY Finally: # makemap hash /etc/mail/access < /etc/mail/access # /sbin/init.d/sendmail reload (or killall -HUP sendmail) The result is that now I can send to recipients like: user(a)cccc.com. But this isn't the behaviour I want. What I want is that user(a)cccc.com can send (not be sent to) to any other recipient (at whatever domain) using my mta. 2) 2nd attempt: this time I edited /etc/mail/linux.mc and added a line: FEATURE(`relay_local_from') Compiled using: # m4 /etc/mail/linux.mc > /etc/sendmail.cf And reload sendmail: # /sbin/init.d/sendmail reload (Access file kept intact). The result apparently is the same. I cannot send to any arbitrary domain from user(a)cccc.com. I'm quite desperated. What am I missing????? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

10 18

SOLUTION: Chroot ssh/telnet login
by Stiefenhofer, Marek ECOFIS 22 Nov '00

22 Nov '00

How to chroot standard login users: You need a program as login shell, that does the following: 1.) Checks if called as login else exits 2.) checks if UID=0 (big security hole?!) 3.) call CHROOT 4.) sets UID=back to normal 5.) calls a standard shell I've found a little c-program that implements all of this features except 1.) here: http://www.phirate.ethos.co.nz/dev/srsh/ Maybe someone will have a look at this and check if the UID=0 part offers standard users possibilitities to break into a root shell or something similar... Marek Stiefenhofer -----Ursprüngliche Nachricht----- Von: Stiefenhofer, Marek ECOFIS Gesendet am: Montag, 20. November 2000 12:19 An: 'Gerd Bitzer'; 'suse-security(a)suse.com' Betreff: AW: [suse-security] Chroot ssh login I know, but that's not sufficiant. rbash does not prevent from accessing files below your home-directory like: ls ~/../../etc -----Ursprüngliche Nachricht----- Von: Gerd Bitzer [mailto:gerd.bitzer@tesion.de] Gesendet am: Montag, 20. November 2000 12:13 An: Stiefenhofer, Marek ECOFIS Betreff: Re: [suse-security] Chroot ssh login may be there's also another interesting possibility, socalled restricted shells. The user is then limited to its own homedirectory, as far as I know e.g. bash supports this mode with "bash -r". Maybe other shells also have this feature "Stiefenhofer, Marek ECOFIS" wrote: > Hi, > > I want to chroot user logins via telnet/ssh to their home directory. I guess > this is a standard procedure, but I'm sort of stuck. I can't chroot the > login shell of a standard user - only root can chroot. > > Examples would be appreciated... > > Kind regards, > > Marek Stiefenhofer > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] question about logging
by webmaster 22 Nov '00

22 Nov '00

Let me say also: better have /var/log/messages to gather up all from kernel, warn, popper, named, and then have logcheck installed for checking system events. You can have that emailed to root, possibly to another machine. Allow me then to ask the list: the bind8 has user named, and group named - contrary to earlier versions where root was user and group. Which are the files named writes into, so that I should chown and chgrp those files? Besides: Has anyone been ruinning sshd2? /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

3 2

Securid for suse
by Peter Lange 22 Nov '00

22 Nov '00

Hello all, anyone knows about a ACE-Agent for Securid authentication available for SuSe? Thanks -- Mit freundlichem Gruß i.A. Peter Lange PROFI Engineering Systems AG Geschäftsbereich Antaris Systemtechnik Moosbürger Str.20 D-92637 Weiden Tel. 0 961/89-502 Fax 0 961/89-579 eMail: plange(a)antaris.de

1 0

Re: [suse-security] Authenticated routing?
by brandon＠2i.com 22 Nov '00

22 Nov '00

CheckPoint's FW1 is available for Linux, though RedHat is the only flavor supported. I have the full version running on Solaris and plan to give it a test run on SuSE near January. If you are only concerned about web traffic, you can set up Squid in proxy mode with authentication. Unfortunately you cannot use authentication in transparent mode and this only works for http traffic. I, too, wish there were a clean solution that could tap into the stock Linux firewall. At 01:29 PM 11/20/00 +0100, you wrote: >Hi, >I am looking for a solution to authenticate routing. > > IPSEC CLient (Mostly WinXX boxes) connects to firewall. > Firewall untunnels packets (FreeS/WAN) > Firewall authenticates user ???????? > Successful authentication enables routing of the clients Packets into the > internal net. > >Commercial FWs like FW1 have that feature, but I'd rather run it on Linux. > >Thanks for any pointers >afx > >-- >atsec information security GmbH Phone: +49-89-44249830 >Steinstrasse 68 Fax: +49-89-44249831 >D-81667 Muenchen, Germany WWW: www.atsec.com > May the Source be with you! > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > > > -- brandon(a)2i.com

1 0

RE: [suse-security] SuSE-Firewall logging
by Volker Kuhlmann 22 Nov '00

22 Nov '00

> With syslog you get not only the "facility" category (i.e. "kern") but > also the "priority" (or "severity") level. I didn't mention it because it's irrelevant here. Yes you can filter via facility as well as severity. It still doesn't allow you to filter by source (as in what program logged the entry). grep at a later stage is the only way. Volker

1 0

RE: [suse-security] SuSE-Firewall logging
by Volker Kuhlmann 22 Nov '00

22 Nov '00

No it's not possible to log only the firewall messages to a separate file. These log entries come from the "kernel", and the filtering which can be done via syslog is not very extensive. You can basically only filter on what category (called "facility") the log entry is to be recorded as, and choices there are very limited. In this case, it's "kernel". That means that everything logged under "kernel" will always go to the same file. Sorry you can't filter on which program the log entry came from. The default setup when you install the SuSE firewal package is to log all "kernel" entries to /var/log/firewall. The rest stays in /var/log/messages. Alternatively, reduce the log level for your firewall setup. Volker

2 1

NFS over VPN
by mute 21 Nov '00

21 Nov '00

Hi, recently at the place where i work a collegue came up with an idea to use nfs over vpn to sync our webservers. i have not done much work with either, and i have two questions about it. first, is this a practical solution? and second, im a bit stumped about resources on the subject (i do have nfs documentation, but not much of vpn resources, and nothing on how to combine the two). sorry is this question might seem trivial/stupid, any help/opinion is greatly appreciated : )

2 1

Re:Re:[suse-security] NET
by Ron Blanchett 21 Nov '00

21 Nov '00

Dustin, Could you send me your proxy config file so that I can have a better idea of your configuration so that I can possibly find a soltion to your problem Thanks Ron _____________________________________________________________________________________ Get more from the Web. FREE MSN Explorer download : http://explorer.msn.com

1 0

Re:Re:[suse-security] NET
by Ron Blanchett 21 Nov '00

21 Nov '00

Dustin, If you are not running more than one proxy I am not sure what else could be giving you that error message. I there server used for anything else (i.e. email server, web server) I will keep looking into your problem The proxy that I have setup at my work hasn't had this message yet so I am not sure what is causing it. Thank You Ron _____________________________________________________________________________________ Get more from the Web. FREE MSN Explorer download : http://explorer.msn.com

1 0

question about logging
by RENE 21 Nov '00

21 Nov '00

hello there some question about the loggin in /var/log/messages how can i sort the messages by file from var/log/messages. spetially: no firewall loging into messages, now on my system: firewall logging also under messages, but this file becomes very big, and is not easy to read, because i loog all traffic on my system thx Rene

2 1

AW: [suse-security] "Submission" port on sendmail
by Stiefenhofer, Marek ECOFIS 21 Nov '00

21 Nov '00

Hi Roman, did I get something wrong? The sendmail in the example is listening on this port. Marek -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet am: Dienstag, 21. November 2000 15:33 An: RoMaN SoFt / LLFB!! Cc: suse-security(a)suse.com Betreff: Re: [suse-security] "Submission" port on sendmail > > emilio:~ # grep submission /etc/services > submission 587/tcp # Submission > submission 587/udp # Submission > > It permits users send or receive mail. Admin tasks are made through > ssh and some logs are sent via syslog. > > Why is sendmail opening "submission" port??? What is it intended for? > Is it insecure??? Could I close it? How? A port as such is never "insecure" (please don't prove me wrong...). sendmail uses port 587 by pure coincidence. Next time it will be another port. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

6 5

Suse firewall warning.
by Wade Chandler 21 Nov '00

21 Nov '00

Yurri, Does you /etc/syslog.conf file have a line like "kern.* /var/log/firewall" in it. If so then that is the file. If not then add the line and you will be able to have them all stored in one file. Wade Chandler.

1 0

AW: [suse-security] "Submission" port on sendmail
by Stiefenhofer, Marek ECOFIS 21 Nov '00

21 Nov '00

Excerpt from: SENDMAIL RELEASE NOTES $Id: RELEASE_NOTES,v 8.561.2.5.2.80 2000/07/19 20:40:57 gshapiro Exp $ sendmail implements RFC 2476 (Message Submission), e.g., it can now listen on several different ports. Use: O DaemonPortOptions=Name=MSA, Port=587, M=E to run a Message Submission Agent (MSA); this is turned on by default in m4-generated .cf files; it can be turned off with FEATURE(`no_default_msa'). -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet am: Dienstag, 21. November 2000 15:33 An: RoMaN SoFt / LLFB!! Cc: suse-security(a)suse.com Betreff: Re: [suse-security] "Submission" port on sendmail > > emilio:~ # grep submission /etc/services > submission 587/tcp # Submission > submission 587/udp # Submission > > It permits users send or receive mail. Admin tasks are made through > ssh and some logs are sent via syslog. > > Why is sendmail opening "submission" port??? What is it intended for? > Is it insecure??? Could I close it? How?

1 0

"Submission" port on sendmail
by RoMaN SoFt / LLFB!! 21 Nov '00

21 Nov '00

Hi. That's a typical MTA machine: emilio:~ # lsof -i COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME inetd 154 root 4u IPv4 38091 TCP *:pop3 (LISTEN) sshd 181 root 3u IPv4 82 TCP *:ssh (LISTEN) syslogd 14030 root 10u IPv4 27318 UDP *:syslog sendmail 16965 root 4u IPv4 65606 TCP *:smtp (LISTEN) sendmail 16965 root 5u IPv4 65607 TCP *:submission (LISTEN) emilio:~ # grep submission /etc/services submission 587/tcp # Submission submission 587/udp # Submission It permits users send or receive mail. Admin tasks are made through ssh and some logs are sent via syslog. Why is sendmail opening "submission" port??? What is it intended for? Is it insecure??? Could I close it? How? Regards. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re:Re:[suse-security] NET
by Dustin Huptas 21 Nov '00

21 Nov '00

Hello Ron, no I have only one proxy running. My setup is as follows: Internet | | Cisco Router | |---------------------------------------------- | | | Firewall(SuSE 6.2) Webserver(SuSE 6.3) Proxy (SuSE 6.3) Mailserver | | --- internal network HTH, Rgds Dustin

1 0

Re: [suse-security] NET
by Ron Blanchett 20 Nov '00

20 Nov '00

Dustin, Do you have more that one proxy server running. If you do this may be caused by because one of your "Neighbor" proxies is miss configured. Please give more info on you proxy setup if this is not the case Thank You Ron Blanchett MBT Assistant Network Administrator >From: "Dustin Huptas" <dustin2010(a)gmx.de> >To: <suse-security(a)suse.com> >Subject: [suse-security] NET >Date: Fri, 17 Nov 2000 15:50:21 +0100 >MIME-Version: 1.0 >Received: from [202.58.118.3] by hotmail.com (3.2) with ESMTP id >MHotMailBBDE8EE8004DD82197CECA3A760304760; Fri Nov 17 06:42:48 2000 >Received: (qmail 30881 invoked by alias); 17 Nov 2000 14:48:39 -0000 >Received: (qmail 30874 invoked from network); 17 Nov 2000 14:48:39 -0000 >From suse-security-return-3975-rrcb Fri Nov 17 06:43:14 2000 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >list-help: <mailto:suse-security-help@lists.suse.com> >list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> >list-post: <mailto:suse-security@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)lists.suse.com >Message-ID: <EKEHLKGPPAOBEPKLAJPCGEIOCEAA.dustin2010(a)gmx.de> >X-Priority: 3 (Normal) >X-MSMail-Priority: Normal >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) >X-MimeOLE: Produced By Microsoft MimeOLE V5.00.3018.1300 >Importance: Normal > >Good day! > >My proxy wrote about 200 of the below messages into /var/log/messages >during >the last days: > >Nov 15 09:34:08 proxy kernel: NET: 166 messages suppressed. >Nov 15 09:34:08 proxy kernel: neighbour table overflow > >The number of suppressed messages is changing with every line. I am >completely stuck with this. Does this mean, someone is trying to do a >buffer >overflow? > >P.S.: I am using SuSE 6.3 on this machine. > >Thank you very much in advance for your help! > >Rgds Dustin ><< DustinHuptas.vcf >> >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com _____________________________________________________________________________________ Get more from the Web. FREE MSN Explorer download : http://explorer.msn.com

1 0

apache 3.1.14 update
by Thomas Michael Wanka 20 Nov '00

20 Nov '00

Hi, is there a plan to provide an apache 3.1.14 update? The apache group claims it fixes security holes in mod_vhost_alias and mod_rewrite modules. I assume that the version included in SuSE not to be affected with this problems, but customers request an update as the announcement on the apache homepage indicates that it is. thanks mike

2 1

AW: [suse-security] Chroot ssh login
by Stiefenhofer, Marek ECOFIS 20 Nov '00

20 Nov '00

I know, but that's not sufficiant. rbash does not prevent from accessing files below your home-directory like: ls ~/../../etc -----Ursprüngliche Nachricht----- Von: Gerd Bitzer [mailto:gerd.bitzer@tesion.de] Gesendet am: Montag, 20. November 2000 12:13 An: Stiefenhofer, Marek ECOFIS Betreff: Re: [suse-security] Chroot ssh login may be there's also another interesting possibility, socalled restricted shells. The user is then limited to its own homedirectory, as far as I know e.g. bash supports this mode with "bash -r". Maybe other shells also have this feature "Stiefenhofer, Marek ECOFIS" wrote: > Hi, > > I want to chroot user logins via telnet/ssh to their home directory. I guess > this is a standard procedure, but I'm sort of stuck. I can't chroot the > login shell of a standard user - only root can chroot. > > Examples would be appreciated... > > Kind regards, > > Marek Stiefenhofer > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Chroot ssh login
by Stiefenhofer, Marek ECOFIS 20 Nov '00

20 Nov '00

Hi, I want to chroot user logins via telnet/ssh to their home directory. I guess this is a standard procedure, but I'm sort of stuck. I can't chroot the login shell of a standard user - only root can chroot. Examples would be appreciated... Kind regards, Marek Stiefenhofer

1 0

Martian Source detection
by Rainer.Frohne＠t-online.de 20 Nov '00

20 Nov '00

Hello, in the network of my company the firewall based on SuSE 7.0 the following kernel warning appears from time to time: Nov 14 16:03:35 dbwwall kernel: martian source 4796a8c0 for ff64a8c0, dev eth0 Nov 14 16:03:35 dbwwall kernel: ll header: ff ff ff ff ff ff 00 a0 f9 00 d0 57 08 00 I know what matian sources are. My question is, how I can find out the device or intruder, which causes the trouble. Which tool can I use to find the listed mac-address in my Network? Thanks in advance! Rainer Frohne

3 5

Firewall help needed
by Ralph De Witt 19 Nov '00

19 Nov '00

Hi to all I have been trying to install my firewall on a SuSE 7.0 box, I have one Win ME box connected to my network and would like to allow it to connect to the internet trough the Linux box. My linux box connects to the internet through eth1 and a DSL line. I use RPPOE to enable the ethernet card and connect to the internet. I believe I have configured the SuSE firewall correctly to allow me to connect to the internet and masqurade for the remaining win machine but the only thing I have accomplished to block myself from the net. I was hoping someone slightly more knowlegeable and less tired then I could look at my script and help me out. I have enclosed the script below: # Copyright (c) 1999,2000 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999,2000 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into # /usr/share/doc/packages/firewals/EXAMPLES ! # # /etc/rc.config.d/firewall.rc.config # # for use with /sbin/SuSEfirewall version 2.6 # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you must also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team # # ------------------------------------------------------------------------ # # Configuration HELP: # # If you have got any problems configuring this file, take a look at # /usr/share/doc/packages/firewals/EXAMPLES for an example. # # # All types have to set option 1): set START_FW in /etc/rc.config to "yes" ;-) # # If you are a end-user who is NOT connected to two networks you just have to # reconfigure (all other settings are OK): 2), and maybe 9), 11), and 18). # # If this server is a firewall, which should act like a proxy (no direct # routing between both networks), or you are end end-user connected to the # internet and to a internal network, you have to setup your proxys and # reconfigure (all other settings are OK): 2), 3), 9) and maybe 7), 10), 11) # 12), 14) and 18). # # If this server is a firewall, and should do routing/masquerading between # the untrusted and the trusted network, you have to reconfigure (all other # settings are OK): 2), 3), 5), 6), 9), and maybe 7), 10), 11), 12), 15), 18). # # If you want to run a DMZ in either of the above three standard setups, you # just have to config 4), 9), 13) and maybe 19). # # If you know what you are doing, you may also change 8), 16), 17), 18) # and the expert options 20), 21), 22) at the far end, but you should NOT. # # If you use diald or ISDN autodialing, you might want to set 18). # # To get programs like traceroutes to your firewall to work is a bit tricky, # you have to set the following options to "yes" : 11 (UDP only), 19 and 20. # # If you want to load the full firewall rules for an interface even if it's not # available, configure a static IP and netmask (see 2, 3 and 4 for an example). # # Please note that if you use service names, that they exist in /etc/services. # There is no service "dns", it's called "domain", email is called "smtp" etc. # # If you use a modem/ISDN for connections, put "/sbin/SuSEfirewall" in the # 2nd line of "/etc/ppp/ip-up". This is important!! # # *Any* routing between interfaces except masquerading has to set FW_ROUTE to # "yes" and use FW_FORWARD_TCP and/or FW_FORWARD_UDP # # If you just want to do masquerading without filtering, ignore this script # and run this line (exchange "ippp0" with your masquerade/external interface): # ipchains -A forward -j MASQ -i ippp0 # # ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done in /etc/rc.config (START_FW="yes") # # 2.) # Which is the interface that points to the internet? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, seperated by a space # e.g. "eth0", "ippp0 ippp1" # FW_DEV_WORLD="eth1" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_WORLD first! # #FW_DEV_WORLD_ippp0="10.0.0.1 255.255.255.0" # e.g. for exernal interface ippp0 # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_INT="eth0" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_INT first! # #FW_DEV_INT_eth0="192.168.1.1 255.255.255.0" # e.g. for internal interface eth0 # # 4.) # Which is the interface that points to the dmz network? # # Enter all the network devices here which point to the dmz. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/firewals/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD_TCP and FW_FORWARD_UDP to # define the services which should be available to the internet and set # FW_ROUTE to yes. # Very special note: servers/networks in FW_MASQ_NETS may access the DMZ to # the same extent they are allowed to access the internet! No FW_FORWARD_* # needed ... # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_DMZ="" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_DMZ first! # #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # e.g. for dmz interface eth1 # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from /etc/rc.config! # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD_TCP and/or # FW_FORWARD_UDP to define what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Please note this config changed in firewals-2.3: You may either use just # hosts/nets to allow all traffic from them to the internet, or use an extended # syntax, to restrict internet access to certain services! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A protocol and service is appended by a comma to the host/network. # e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with unrestricted access # "10.0.1.0/24,tcp,80 10.0.1.0/24,tcp,21" allows the 10.0.1.0 network to use # www/ftp to the internet. "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # You may NOT set this variable to "0/0" ! # FW_MASQ_NETS="hosts/nets" # # If you want (and you should) you may also set the FW_MASQ_DEV option, to # specify the outgoing interface to masquerade on. (You would normally use # the external interface(s), the FW_DEV_WORLD device(s), e.g. "ippp0") # FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_GLOBAL_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # FW_PROTECT_FROM_INTERNAL="yes" # # 8.) # Do you want to autoprotect all global running services? # # If set to "yes", all network access to services TCP and UDP on this machine # which are not bound to a special IP address will be prevented (except to # those which you explicitly allow, see below: FW_*_SERVICES_*) # Example: "0.0.0.0:23" would be protected, but "10.0.0.1:53" not. # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice # # 9.) # Which services on the firewall should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # FW_SERVICES_EXTERNAL_TCP="SMTP POP" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="" # Common: domain # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="syslog" # Common: domain syslog # FW_SERVICES_INTERNAL_TCP="ssh smtp pop www irc icq news rplayer" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # FW_SERVICES_TRUSTED_TCP="ssh" # Common: ssh FW_SERVICES_TRUSTED_UDP="syslog time ntp" # Common: syslog time ntp # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("dns"). # Note that if you want to use normal (active) ftp, you have to set the TCP # option to ftp-data. If you use passive ftp, you don't need that. # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script. # # Choice: "yes", "no", "dns", portnumber or known portname, defaults to "no" # FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" # Common: "dns" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they won´t work! # # Set services you are running to "yes", all others to "no", defaults to "no" # FW_SERVICE_DNS="no" # if yes, FW_SERVICES_*_TCP needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DHCLIENT="yes" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCPD="no" # set to "yes" if this server is a DHCP server FW_SERVICE_SAMBA="yes" # set to "yes" if this server uses samba as client # or server. As a server, you still have to set # FW_SERVICES_{WORLD,DMZ,INT}_TCP="139" # Everyone may send you udp 137/138 packets if set # to yes! # (note: samba on the firewall is not a good idea!) # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net, 2) destination IP (dmz/intern) # and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_UDP="" # Beware to use this! # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern) and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # FW_FORWARD_MASQ_TCP="" # Beware to use this! FW_FORWARD_MASQ_UDP="" # Beware to use this! # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) original destination port and 4) local port to redirect the traffic to, # seperated by a colon. e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080" # FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_FW_TRACEROUTE="no" # # 21.) # Allow ICMP sourcequench from your ISP? # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Which masquerading modules should be loaded? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # (omit the path or "ip_masq_" prefix as well as the ".o" suffix!) # FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" Thank you for your help and I appologise for the long message length. -- Ralph F. De Witt ----------------------------------------------------------------------------- PROUD USER OF SuSE LINUX 7.0 It said uses Windows 98 or better so I installed SuSE 7.0 Register Linux User 168814 ICQ #49993234 "Beer is proof that God loves us and wants us to be happy" -Benjamin Franklin -----------------------------------------------------------------------------

3 2

DNS and DHCP connection
by suse＠diplan.de 19 Nov '00

19 Nov '00

Hi, Sorry for the beginners question, but how does my DNS server get to know about leased DHCP IP <-> hostname information? If the IP address changes from lease to lease the DNS has to be informed by that. I looked into some manpages and howtos but did not find the information. Thank you very much for a hint and best regards, Rainer

5 4

Re: [suse-security] name resolution by ipchains
by Volker Kuhlmann 19 Nov '00

19 Nov '00

> is it possible to have ipchains resolving internet names? > If yes, how? If you mean that you'd like to be able to specify a nme instead of an IP, yes ipchains will resolve the name. However, unless the name can be resolved with the local /etc/hosts file, the DNS will be queried, and if that happen to be blocked just at that time (either because it's not yet enabled, or you never allow it through), ipchains will wait for a rather long time... Volker

1 0

name resolution by ipchains
by Philipp Snizek 18 Nov '00

18 Nov '00

Hi all is it possible to have ipchains resolving internet names? If yes, how? Thank you Philipp

2 1