November 2000 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] same ip for two interfaces
by Bauer, Juergen 02 Nov '00

02 Nov '00

>> hi folks, >> >> can somebody see a (security) problem in assigning the external and the dmz >> interface the same IP-Address ? >> all the ipchains rules are using the interface switch (-i). > >Why on earth would you do that? That is so f**ked up. Use an "internal" IP on >the internal interface, like 10.0.0.1, as long as the machines in the dmz/etc >know how to get to it (which they will) everything is fine. the INTERNAL interface has a private ip address (192.168.x.x). i am talking about the EXTERNAL and the DMZ interface !! i want to do that, because they've got only 8 public ip-addresse (so 6 actually) >> thanx, >> >> jb > >-Kurt > jb

3 2

Re: [suse-security] Security Crash course
by Scott_Smith＠mastercard.com 02 Nov '00

02 Nov '00

Hello World, Thanks for all the great input. Here is a compilation of the answers I received. The question was, where to find information in order to come up to speed fast on UNIX/LINUX security issues. It should be noted that no brain cells were injured in making this compilation, all insights and comments belong to other members of this list. I received several recommendations multiple times (prayer seemed to be a popular recommendation?) but obviously only listed them once. I have also cannibalized several of the e-mails to make them fit the format below. Once again, thanks for all the help! Scott ** BOOKS ** "Web Security & Commerce": By Simson Garfinkel with Gene Spafford "Secrets and Lies : Digital Security in a Networked World" by Bruce Schneier "Applied Cryptography" by Bruce Schneier "Computer Security Basics" By Deborah Russell & G.T. Gangemi, Sr. -- snip -- "Computer Security Basics" really covers historical ground so I would not recommend it if you are in a hurry, "Web Security & Commerce" is a little dated but is still relevant, "Applied Cryptography" is a must read if one is going to implement cryptographic protocols such as SSH or SSL and "Secrets and Lies" is a must read. So if you get just one read "Secrets and Lies"". Try "Linux System Security" for in depth coverage of security features & software on Linux. Well written and goes into good detail on algorithms (the SSH chapter is very useful if you're trying to visualize the protocol) and recommendations. http://www.phptr.com/ptrbooks/ptr_0130158070.html Practical UNIX & Internet Security, 2nd Edition Classic O'Reilly guide to security on a UNIX system http://www.oreilly.com/catalog/puis/ ** NET ** http://www.linuxsecurity.com/ is a nice starting point. If you're looking for Documentation, go to http://www.linuxdoc.org/ . http://www.suse.de/~marc/ Of particular interest are the harden_suse and seccheck scripts. Once you understand everything they do and why you'll know more about security than most admins. Linux Administrator's Security Guide (LASG) now Linux Security Knowledge Base (LSKB) (Thanks Kurt!) Read it end to end. http://securityportal.com/lskb/ ** LISTS ** One good place to keep up on current security problems is the bugtraq listserve. ... snip ... Go to http://www.securityfocus.com/ for a link to the Bugtraq archives and FAQs, which include subscription info.

1 0

gss-sample problem
by Michael Kehm 02 Nov '00

02 Nov '00

Hi all, I am trying to do a demo to show the Interoperability between Windows <-> Linux using Kerberos. Has anyone run successfully the gss-server <-> gss-client scenario between these 2 boxes? I successfully ran the scenario: Linux (client) -> Linux (server) using Linux KDC Linux (client) -> Linux (server) using Windows KDC On the following scenarios the client simply hang: Win (client) -> Linux (server) using Linux KDC Win (client) -> Linux (server) using Windows KDC Has anyone an idea or hint what I have done wrong? I am pretty new in the kerberos stuff so any help is welcome!! Thanks Michael

1 0

mail relaying, SuSE 7.0
by Volker Kuhlmann 02 Nov '00

02 Nov '00

Hello all, I have a problem with mail relaying. Testing my machine (at home) with the test at http://www.abuse.net/relay.html, I found that it was indeed relaying. That was a surprise, because I thought I had a default configuration and that the default would not allow relaying. I selected "host with permanent net connection" in yast. In order to get things going, I had to set FROM_HEADER="elec.canterbury.ac.nz" in rc.config, which leads to a DMelec.canterbury.ac.nz line in sendmail.cf. Without this, email to kuhlmav(a)elec.canterbury.ac.nz leaves my host (as /var/log/mail shows), but never arrives - presumably because the university's mail gateway cantva.canterbury.ac.nz trashes it. I remember having had problems before if the sending host's (mine) FQN doesn't resolve (although it seemed I can put anything I want, as long as it resolves). How can I configure things to make email work, but block relaying? Thanks for any help, Volker

10 11

Re: [suse-security] same ip for two interfaces
by Richard Voss 02 Nov '00

02 Nov '00

<delurk> hi all, Minder slecht betekent niet goed, het betekent alleen maar beter. >>> Robert Casties <robert.casties(a)philo.unibe.ch> 11/02/00 01:51PM >Not automatically I think. How would you setup routing for two same IPs >anyway? If I'm not mistaken, this is easily accomplished on Sun Enterprise-class servers. For some reason Sun binds a NIC to a processor, so one processor handles all interrupts for networktraffic. This can cause a situation where (on a multiprocessor machine) one processor shows a load of 100%, while all other processors are idle. This leads to intermittant network hiccups, when this one processor can't handle these interupts fast enough. Adding another network adapter, and assigning this the same ip-adress can solve this problem. I'd have to check how routing etc work but afaik it's a fairly standard solution. richard <lurk>

1 0

login shell
by Peter Hinse 02 Nov '00

02 Nov '00

Hi, I do have the following problem: I want users to have access to their homedir via FTP, but without shell-access (telnet, shh) - however, I (as root) want to be able to su to the useraccount and execute programs. Which login shell do I have to use in /etc/passwd? Best regards, Peter Hinse hinse(a)gmx.de

7 6

AW: [suse-security] same ip for two interfaces
by Bauer, Juergen 02 Nov '00

02 Nov '00

aaahhhh, finally somebody's understanding my question. the reason i am asking this: the watchguard firewall is linux based. they have a configuration which is called "drop-in". all three interfaces get the same ip plus one or more virtuell ips. the ipchains programmer is paid by watchguard (see howto). i dont think that they use ipchains for there rules, but i asked my self if this is possible with ipchains on a standard distro. i dont like these "all-in-one" solutions, they are not very flexible. but i like the idea of saving some ips. by, jb -----Ursprüngliche Nachricht----- Von: Roman Drahtmueller [mailto:draht@suse.de] Gesendet: Donnerstag, 2. November 2000 12:09 An: Kurt Seifried Cc: suse-security(a)suse.com Betreff: Re: [suse-security] same ip for two interfaces The whole thing is interesting from the academic standpoint. What would happen with two interfaces of the same IP? Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

upgrading apache
by Mourik JanC. Heupink 02 Nov '00

02 Nov '00

Hello. I want to upgrade apache to the latest version. I'm running SuSE 6.2. (i know: rather old, but this is what the situation is like) Anyway: how to proceed? Should I download the latest apache from the SuSE 7.0 version, and just install this, or will it break things? (dunno: library versions and stuff?) An alternative could be to download the apache-elf version from www.apache.org, and install that. But will it work? (since it is a generic linux version, not SuSE specific) Don't want to just try out, because we are running a webserver on the machine, and I don't want to mess that up... Thanks very much, Mourik Jan

1 1

Re: Re: [suse-security] same ip for two interfaces
by emm＠eggler.ch 02 Nov '00

02 Nov '00

> > the INTERNAL interface has a private ip address (192.168.x.x). > > i am talking about the EXTERNAL and the DMZ interface !! > > > > i want to do that, because they've got only 8 public ip-addresse (so 6 > > actually) > > So use 10.0.0.1 on the DMZ interface. as long as no-one on the INTERNET needs to > talk directly to that interface it'll work fine. I.e. a traceroute would show > > 1.2.3.4 (your isp's router) > 5.6.7.8 (external ip on your firewall) > * * * (can't talk to him....) > 5.6.7.9 (IP of your server on the DMZ). > > See? > > -Kurt > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com If you do not have enough IP numbers consider port forwarding. E. g., everything that comes in on your firewalls external ip address on port 80 is forwarded to the http-server/proxy in the dmz. In such a setup, the dmz host can have a private address and reside in a private network. With such a setup you can provide a complete internet service (web, email, dns etc.) on just one IP number (if you do not have several hosts for the same service - e. g. http/80 on host1 and host2). --emmerich

1 0

Building a firewall box
by Togan Muftuoglu 02 Nov '00

02 Nov '00

Hi everyone, I feel a little bit confused on which direction I should be going, hence I need some advice, pointers and clarification on establishing a firewall. I am setting up a LAN of 10 PC's. The LAN will have access to the internet via cable modem. This is what I thought of doing. A) Setting up a 486/Pentium MMX as the firewall / router. B) Use either of the following 1) Phoenix adaptive firewall ( I could only found it for SuSE 6.3 which probably will not work with SuSE 7.0) 2) Sinus firewall 3) T.REx Open Source proxy firewall 1) What could be my concerns regarding security, if I am running a stock SuSE pre compiled Kernel. What specific things I should be looking to enable / disable ? As far as I understand, if using a pre compiled stock SuSE kernel ,my option of using SINUS firewall is out of the choices. Hence I thought of using T.Rex if using stock kernel. 2) I thought of recompiling the kernel with the SuSE default config options, so I can get Sinus back into choices for proxy firewalls ( yet by doing this most probably Suse Installation support will not be very helping since I am not using the SUSE pre compiled kernel. Result questionable SuSE support availability) 3) Recompiling the after patching it with openwall security patch ( The question is SuSE kernel is pre 2.2.17 so which patch I use; 2.2.16 or 2.2.17) and then make the choice for the proxy firewall. Could some one please kindly help me with a road to choose and if possible pros and cons of the my choices and/or proxy firewalls I have found (any other suggestion is more than welcomed) Thanks in advance -- Togan Muftuoglu toganm(a)turk.net 100% MS FREE Absolutely no component of Microsoft was used in the generation or posting of this e-mail. So it is virus free

2 4