November 2000 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall www-server inside the DMZ
by Fuchs Josef 23 Nov '00

23 Nov '00

Thanks all out there! My problem is solved :-) I used the portforward statement which was suggested by Thomas Hildmann and define the DMZ as masquerading.

1 0

strange DHCP entries
by Nikolai Dahlem 22 Nov '00

22 Nov '00

Hello, little OT, but this is weird, on my DHCPserver i get a lot of these log entries: DHCPDISCOVER from 52:41:53:20:20:ea:a8:34:61:54:c0:01:01:00:00:00 via eth1 What kind of a MAC address is this supposed to be ? Any suggestions ? regards N. Dahlem

3 2

SSHD2 start at boot time
by webmaster 22 Nov '00

22 Nov '00

Hi, I am at loss with SuSe6.3 init.d I hope there are some who could give me step by step instructions how to start sshd2 automatically at boot time Manual says: to start sshd2 at boot ...there should be symbolic links to its startup script in /etx/rc.d/init.d directory. In SuSe, add symlinks manually But on my box it is: ls -al /etc/rc.d/init.d lrwxrwxrwx 1 root root 1 May 2000 /etc/rc.d/init.d -> . The sshd2 path is /usr/local/sbin/sshd2 At present sshd is running at boot from /usr/sbin/sshd I am at loss - maybe very simple but ....thanks for tipps. /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

3 2

X Windows
by Steffen Beck 22 Nov '00

22 Nov '00

hey all ... i was wondering if any of you people know why my pointer, when in X all of a sudden does strange things and open menues and programs... It also happened when I ran redhat 6.2 ... anybody know what im doing wrong ?? is it something to do with XF86Config ?? thanks in advance... Steffen Beck Sign up for your "FREE E-MAIL" @ MADMAIL http://www.madmail.com

5 4

SuSEfirewall www-server inside the DMZ
by Fuchs Josef 22 Nov '00

22 Nov '00

Hi, All :) I hope sombody can help me with my configuration. Following scenario: public Internet | | | | | eth0 - only one official Internet Address | which is directly connected | to the internet leased line modem. | <firewall> -- eth2 -- DMZ 192.168.0.0/24 ---------- <www.server 192.168.0.111> | | eth1 -- 192.168.30.0/24, 192.168.31.0/24 ... | | | <internal private networks> I use the <firewall> to allow accessing the Internet from the internal networks. This part is functioning well :) Now I like to configure a www.server with an private IP number which is reachable from public Internet (only http should be allowed). I can Ping the www.server successfully from the firewall pc but i'm not able to get a http: connection with netscape. Also it's not possible to get a connetion from the public internet. My SuSE Firewall Settings are : FW_DEV_WORLD="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.30.0/24 192.168.31.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="no" FW_SERVICES_EXTERNAL_TCP="smtp domain nntp http" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_DMZ_TCP="http" FW_SERVICES_DMZ_UDP="domain" FW_SERVICES_INTERNAL_TCP="smtp domain ftp http nntp" FW_SERVICES_INTERNAL_UDP="domain" FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" FW_SERVICES_TRUSTED_UDP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_MASQ_TCP="0/0,192.168.0.111,80" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" This is the output from tcpdump -i eth2 when trying to connet with netscape to the www.server from the firewall.pc 10:19:21.570488 arp who-has 192.168.0.111 tell firewall.pc (0:10:5a:49:52:7) 10:19:21.570719 arp reply 192.168.0.111 is-at 0:50:fc:22:44:12 (0:10:5a:49:52:7) 10:19:21.570750 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 804153 0,nop,wscale 0> (DF) 10:19:21.571016 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF) 10:19:24.563563 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 804453 0,nop,wscale 0> (DF) 10:19:24.563823 192.168.0.111.http > firewall.pc.rkb-oscs: . 1:1(0) ack 1 win 17520 <nop,nop,timestamp 671854 804453> (DF)10:19:24.806624 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,n op,sackOK> (DF) 10:19:30.563561 firewall.pc.rkb-oscs > 192.168.0.111.http: S 3675399427:3675399427(0) win 32120 <mss 1460,sackOK,timestamp 805053 0,nop,wscale 0> (DF) 10:19:30.563822 192.168.0.111.http > firewall.pc.rkb-oscs: . 1:1(0) ack 1 win 17520 <nop,nop,timestamp 671915 805053> (DF) 10:19:31.368814 192.168.0.111.http > firewall.pc.rkb-oscs: S 3200249163:3200249163(0) ack 3675399428 win 17520 <mss 1460,nop,wscale 0,nop,nop,timestamp 0 0,nop,nop,sackOK> (DF)

3 2

Problems with sendmail & relay
by RoMaN SoFt / LLFB!! 22 Nov '00

22 Nov '00

Hi. I'm running SuSE 6.4 and need to run sendmail (host permanently connected to Internet). By default, SM 8.9.3 comes with relay denied for all. I want to set an acceptable secure sendmail. The scenario is as follows: - the smtp (mta) is aaa.bbbb.com (where aaa & bbbb are ficticious). I want the rely denied by default but also want granted access for users whom From:'s field is: *(a)bbbb.com and *(a)cccc.com (being cccc.com another domain which is NOT local to the machine; bbbb.com is the "local" domain, I mean, there is a MX record pointing to the mta's ip.). The problem is that my users can connect to the smtp machine from *ANY* ip. So the rely-filters only could trust in the "From:" line in header's mail. I know this isn't too much secure, since spammers could send mail spoofing the From: field (which is trivial). But it's more secure than a sendmail running with "promiscuos relay" feature turned on. I'm new to sendmail so I need some help. I've read some docs at www.sendmail.org and have a look to O'Reilly sendmail book. But it still doesn't working. These are the attempts I've made: 1) Using Yast, I created a /etc/sendmail.cf. Then I personalized a little using Yast too and added the domain: bbbb.com and ddd.bbbb.com (which is an alias to aaa.bbbb.com). Afterwards I modified /etc/mail/access and added: cccc.com RELY Finally: # makemap hash /etc/mail/access < /etc/mail/access # /sbin/init.d/sendmail reload (or killall -HUP sendmail) The result is that now I can send to recipients like: user(a)cccc.com. But this isn't the behaviour I want. What I want is that user(a)cccc.com can send (not be sent to) to any other recipient (at whatever domain) using my mta. 2) 2nd attempt: this time I edited /etc/mail/linux.mc and added a line: FEATURE(`relay_local_from') Compiled using: # m4 /etc/mail/linux.mc > /etc/sendmail.cf And reload sendmail: # /sbin/init.d/sendmail reload (Access file kept intact). The result apparently is the same. I cannot send to any arbitrary domain from user(a)cccc.com. I'm quite desperated. What am I missing????? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

10 18

SOLUTION: Chroot ssh/telnet login
by Stiefenhofer, Marek ECOFIS 22 Nov '00

22 Nov '00

How to chroot standard login users: You need a program as login shell, that does the following: 1.) Checks if called as login else exits 2.) checks if UID=0 (big security hole?!) 3.) call CHROOT 4.) sets UID=back to normal 5.) calls a standard shell I've found a little c-program that implements all of this features except 1.) here: http://www.phirate.ethos.co.nz/dev/srsh/ Maybe someone will have a look at this and check if the UID=0 part offers standard users possibilitities to break into a root shell or something similar... Marek Stiefenhofer -----Ursprüngliche Nachricht----- Von: Stiefenhofer, Marek ECOFIS Gesendet am: Montag, 20. November 2000 12:19 An: 'Gerd Bitzer'; 'suse-security(a)suse.com' Betreff: AW: [suse-security] Chroot ssh login I know, but that's not sufficiant. rbash does not prevent from accessing files below your home-directory like: ls ~/../../etc -----Ursprüngliche Nachricht----- Von: Gerd Bitzer [mailto:gerd.bitzer@tesion.de] Gesendet am: Montag, 20. November 2000 12:13 An: Stiefenhofer, Marek ECOFIS Betreff: Re: [suse-security] Chroot ssh login may be there's also another interesting possibility, socalled restricted shells. The user is then limited to its own homedirectory, as far as I know e.g. bash supports this mode with "bash -r". Maybe other shells also have this feature "Stiefenhofer, Marek ECOFIS" wrote: > Hi, > > I want to chroot user logins via telnet/ssh to their home directory. I guess > this is a standard procedure, but I'm sort of stuck. I can't chroot the > login shell of a standard user - only root can chroot. > > Examples would be appreciated... > > Kind regards, > > Marek Stiefenhofer > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] question about logging
by webmaster 22 Nov '00

22 Nov '00

Let me say also: better have /var/log/messages to gather up all from kernel, warn, popper, named, and then have logcheck installed for checking system events. You can have that emailed to root, possibly to another machine. Allow me then to ask the list: the bind8 has user named, and group named - contrary to earlier versions where root was user and group. Which are the files named writes into, so that I should chown and chgrp those files? Besides: Has anyone been ruinning sshd2? /-------------------------/ Antal Leisen webmaster(a)kreorg.hu Kreorg Educational Center Budapest, Hungary

3 2

Securid for suse
by Peter Lange 22 Nov '00

22 Nov '00

Hello all, anyone knows about a ACE-Agent for Securid authentication available for SuSe? Thanks -- Mit freundlichem Gruß i.A. Peter Lange PROFI Engineering Systems AG Geschäftsbereich Antaris Systemtechnik Moosbürger Str.20 D-92637 Weiden Tel. 0 961/89-502 Fax 0 961/89-579 eMail: plange(a)antaris.de

1 0

Re: [suse-security] Authenticated routing?
by brandon＠2i.com 22 Nov '00

22 Nov '00

CheckPoint's FW1 is available for Linux, though RedHat is the only flavor supported. I have the full version running on Solaris and plan to give it a test run on SuSE near January. If you are only concerned about web traffic, you can set up Squid in proxy mode with authentication. Unfortunately you cannot use authentication in transparent mode and this only works for http traffic. I, too, wish there were a clean solution that could tap into the stock Linux firewall. At 01:29 PM 11/20/00 +0100, you wrote: >Hi, >I am looking for a solution to authenticate routing. > > IPSEC CLient (Mostly WinXX boxes) connects to firewall. > Firewall untunnels packets (FreeS/WAN) > Firewall authenticates user ???????? > Successful authentication enables routing of the clients Packets into the > internal net. > >Commercial FWs like FW1 have that feature, but I'd rather run it on Linux. > >Thanks for any pointers >afx > >-- >atsec information security GmbH Phone: +49-89-44249830 >Steinstrasse 68 Fax: +49-89-44249831 >D-81667 Muenchen, Germany WWW: www.atsec.com > May the Source be with you! > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > > > -- brandon(a)2i.com

1 0