February 2000 - openSUSE Security - openSUSE Mailing Lists

Rules for IPchains between M$-Networks
by TZinner＠t-online.de 06 Feb '00

06 Feb '00

Hi I have to install a Firewall between two private Networks. The "big" net is a Win NT4.0-Domain ( Netbios over TCP/IP)for the administration of a company, with a gateway to an Internet provider. The "little" one is a own Win NT4.0-Domain, running a medicine net (Netbios over TCP-IP). Today these nets are physikaly separated. We want to connect both nets via a firewall. There should be a possibility for the users of the med-net, to use the internet-gateway (only http and ftp) with a proxy. (That´s not the problem!) On the other side, there is a MS-Exchange-Server in the "big" net , on which the Members of the medicine-net should paticipate (MS-Mail!). We don´t want to buy another exchange server. There should be no possibility connections from the outer net to the med-net. The domains will remain separated. I want to realize it with ipchains. But: What are the port-numbers which MS-Mail is using? Is MS-Mail only using net-bios? (Another idea is to install a sendmail-server and to change the mails with the exchange server with internet-mail protocoll, but this is not the plan of the bosses... :-( ) Who realized such a firewall? Who can give me some hints? Thanks a lot for your help Thomas Zinner

1 0

AW: [suse-security] Application Firewall. (fwd)
by Stephan Gerling 06 Feb '00

06 Feb '00

Hi Volker, The TIS FWTK is not longer for free use, i think. The SuSE Proxy-Suite is a good Proxy Suite. If it is supporting Virus Scanner for SMTP and FTP it would be a good solution.When you thinking about an Proxy for HTTP, whats about User Timeline restrictions and Time based URL restriction for the HTTP use. I am now using Squid. The best way, i think is, all from one hand wich is easylier to configure and monitoring the activity on the web. One thing i am missing in the Proxys is, that logging is not avaible on an SQL Database like Oracle, MS-SQL or MY-SQL directly. Or i dont know how to set it up. Collecting the data from the different logfile and make an report (even if it is done automaticly by scripts) is an boring work. Has someone an idea about an solution ???? Did some one use the little brother program from kansmen (www.kansmen.com)???? This progie makes super reports for outgoing traffic. Such reports you can create with the OLAP Service of MS-SQL 7.0 if there is an way to import the data from the logfiles. Are there any aditional tools for monitoring the incomming/outgoing Traffic with bandwidth use and reading the logs made by ipchains and the proxysuite for easy reports creating????? Iptraf, tcpdump...... are good tools, but i am looking for an all in one (eierlegendewollmilchsau) solution. I think thats enough for today. best regards Stephan Gerling -----Ursprüngliche Nachricht----- Von: Volker Wiegand [SMTP:wiegand@suse.de] Gesendet am: Dienstag, 1. Februar 2000 15:44 An: suse-security(a)suse.com Cc: Maik Aussendorf Betreff: Re: [suse-security] Application Firewall. (fwd) Hi all, sorry, I was not able to follow this list for a few days. The TIS FWTK is a good starting point, but I see one difficulty: you are not allowed to provide support for it (we went through it with NAI before) which is the reason why I wrote the FTP-Proxy. Apart from that, the FWTK lacks some concepts I wanted to have: LDAP-config, RegEx for FTP-Cmds, GNU AutoConf, and several others. Anyone can use the FWTK, but they have to do all changes on their own. The SuSE Proxy-Suite is an ongoing project with new components right now being worked on. Next to release are a Virus-Scanner for SMTP and FTP, plus proxies for Telnet (incl. S/Key), SSH, LDAP, and a Generic-Proxy (a la Plug-GW). All of those are nearly finished. If I only had more time to spend on it, there would be way more components available by now. I am also thinking about an HTTP proxy with a config interface (LDAP) what to allow/forbid, based upon URL+Client+Protocol (like JavaScript, ActiveX, ...). Dunno if this would be regarded as useful? I am wide open for suggestions what to do additionally (best would be more contributors of course :-) or any changes in priority. Just let me know. Please include my address directly, as I might not always be reading each and every posting on the list [Sorry]. Maik Außendorf <Maik.Aussendorf(a)suse.de> is our expert for virus scanners. If not done already, anybody interested in the topic might want to contact him. Volker -- Volker Wiegand Phone: +49 (0) 6196 / 50951-24 SuSE Rhein/Main AG Fax: +49 (0) 6196 / 40 96 07 Mergenthalerallee 45-47 Mobile: +49 (0) 179 / 292 66 76 D-65760 Eschborn E-Mail: Volker.Wiegand(a)suse.de ++ Only users lose drugs. Or was it the other way round? ++ ---------- Forwarded message ---------- Date: Mon, 10 Jan 2000 11:15:18 +0100 From: Rainer Link <link(a)foo.fh-furtwangen.de> To: suse-security(a)suse.com Subject: Re: [suse-security] Application Firewall. Stephan Gerling wrote: Hi! > Is the SuSE Proxy Suite it too ???? Well, the SuSE Proxy Suite contains yet only an FTP Proxy, see http://proxy-suite.suse.de > What is about NNTP, SMTP, Netmeeting, Telnet.... Are there Proxy´s too ???? Hmm, what about the TIS FWTK (www.fwtk.org) or the Juniper Firewall from Obtuse (www.obtuse.com/open_source/) Imho there's a lack of (good) Application Gateways for Linux - but maybe this changes with the SuSE Proxy Suite?! :-) > What´s about Virus/Trojan or ActiveX and Script Scanning on an Firewall Gateway under Linux. > Are there any tools avaible for free or only commercial Produkts ??? Commercial: Trend Micro's InterScan VirusWall (www.antivirus.com) but it does not work with SuSE 6.2 (I have reports, that it does not work with 6.3, too), because it was developed for RedHat 6.x (I hate it, if software does only run with a specific Linux distro). Well, limited to eMail Gateway, either AMaViS (GPL), IspMailGate, Scan4Virus (GPL) or H+B EDV AvGuard (commercial, imho). AMaViS can be found at http://amavis.org - but please have a look at http://www.ce.is.fh-furtwangen.de/~link/security/amavis-patch.php3 and especially http://www.unixzone.com/virus/ IspMailGate is a Perl Module, see (your local) CPAN-Archive. Scan4Virus (works only with qmail), see http://www.geocities.com/jhaar/scan4virus/ AvGate is still beta (currently 0.7, IIRC), see ftp.antivir.de/linux/ I would recommend AMaViS, but, well, I'm biased :-) You may also have a look at: http://www.ce.is.fh-furtwangen.de/~link/security/av-linux.php3 http://www.ce.is.fh-furtwangen.de/~link/security/hotlist.php3#Linux HTH best regards, Rainer Link Maintainer Mini-FAQ "Antivirus software for Linux" Member of the AMaViS Development Group -- Rainer Link, eMail: linkra(a)fh-furtwangen.de, WWW: http://rainer.w3.to/ Student of Communication Engineering/Computer Networking, University of Applied Sciences,Furtwangen,Germany,http://www.ce.is.fh-furtwangen.de/ --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

/etc/profile security question
by Mark B Withers 04 Feb '00

04 Feb '00

Fellow S.u.S.E. users: I remember reading somewhere that it was poor or not a good practice to have the current directory '.' in the $PATH environment variable. In /etc/profile, it has the following statement that adds it in: test "$UID" = 0 || PATH="$PATH:." *unless you're 'root' Is this wise or should I keep it there so as not to disturb the surrounding code? Mark

4 4

AW: [suse-security] POP3 with Outlook SSL
by F. Spitzer, GEOSYSTEMS 04 Feb '00

04 Feb '00

Thanks for your help. I am using SSLWRAP now. It's working fine and it's also very easy to configure (read README.SuSE in /usr/doc/packages). Bye Fritz -----Ursprüngliche Nachricht----- Von: Holger Woehle [mailto:Holger.Woehle@ITELLIUM.com] Gesendet am: Montag, 31. Januar 2000 12:37 An: f.spitzer(a)geosystems.de Betreff: AW: [suse-security] POP3 with Outlook SSL -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hallo Fritz, you can use SSLWRAP. It comes to you with SUSE-Linux since 6.1. It belongs to the sec (security) Packages. After installing it, you have to create a key/certificate pair and modify your /etc/inetd.conf & /etc/services (see below) and kill -HUP inetd ... Pretty simple, isn't it ? btw. Don't be confused about my inetd.conf. I am using qmail & qmail-pop3d. You only have to insert the pop3s line. cu Holgi inetd.conf : pop3 stream tcp nowait root /var/qmail/bin/qmail-popup qmail-popup itmail.itellium.nvag.de /bin/checkpassword /var/qmail/bin/qmail-pop3d Maildir pop3s stream tcp nowait root /usr/sbin/tcpd /usr/sbin/sslwrap -cert /usr/ssl/certs/annina.pem -port 110 services : # # Secure Ports: smtps 465/tcp # smtp protocol over TLS/SSL nntps 563/tcp # nntp protocol over TLS/SSL imaps 993/tcp # imap4 protocol over TLS/SSL pop3s 995/tcp # POP3 protocol over TLS/SSL ftps-data 989/tcp # ftp protocol (data) over TLS/SSL ftps 990/tcp # ftp protocol (control) over TLS/SSL - -----Ursprüngliche Nachricht----- Von: F. Spitzer, GEOSYSTEMS [mailto:f.spitzer@geosystems.de] Gesendet: Montag, 31. Januar 2000 10:19 An: suse-security(a)suse.com Betreff: [suse-security] POP3 with Outlook SSL Hi, I am wondering if anyone has an idea how to implement a POP3-concention over SSL from Microsoft (Outlook 98, Outlook-Express) on a Linux mailserver -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.5.3i for non-commercial use <http://www.pgpi.com> iQA/AwUBOJVlyKwDHGNKekZYEQINgQCgpMCsb7+TMBi7ufPM1USF2Yt/5pQAoKRg nYIghUiA6cEv4f26q/z0lJ8q =OUkg -----END PGP SIGNATURE-----

7 11

Re: [suse-security] SuSE firewall script + UDP ports (fwd)
by Thomas Biege 04 Feb '00

04 Feb '00

---------- Forwarded message ---------- Date: Wed, 2 Feb 2000 21:40:16 +0100 (MET) From: Marc Heuse <marc(a)suse.de> To: Thomas Biege <thomas(a)suse.de> Subject: Re: [suse-security] SuSE firewall script + UDP ports (fwd) Hi, > I would like to set up a firewall using the firewals 1.4-6 > packet on a 2.2.14 kernel. > My problem is, that I want to use nameserver services from > the (insecure) internet and time server services. For the > time servers, I have to have an open UDP port 1026 for > incoming UDP connections. > If I set FW_UDP_ALLOW_INCOMING_HIGHPPORTS = "dns 1026" I > get error messages, which are caused by a special handling > of the string 'dns' in the script. Up to now, the only > solution I have found is to set that variable to 'yes', but > that opens all my high UDP ports, and would really prefer > to have only those ports open, which I really need. > Is there a better solution available? you really don´t gain much security, if you restrict access to the udp highports to a special sourceport. however, if you want to do this: "53 1026" will help - however, 1026 is allocated dynmacally. so when it uses another port when it´s started, you are toasted. my tip: "yes" is okay > btw., it would have been nice, if the article in SuSE's > support data base would mention, that the firewall script > has to be restarted each time a new dial up connection has > been made :-)) thats mentioned in rc.firewall I think - I don´t know for 1.4 but 2.0-pre does for sure :-) Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C

2 1

firewalling by ethernet MAC address
by Peter Folk 04 Feb '00

04 Feb '00

Is there any way to restrict access to the outside network by ethernet hardware (MAC) address? Pete

1 0

FW-Meldung in messages auswerten
by Roman Blöth 03 Feb '00

03 Feb '00

Hallo Liste, ich hoffe meine Anfänger-Frage ist hier nicht völlig OT: In unserem als Router arbeitenden Linux-Server (SuSE 5.3) namens 'mutter' habe ich ständig Meldungen wie die folgende in /var/log/messages: Feb 3 14:55:33 mutter kernel: IP fw-in deny eth0 TCP 212.46.108.129:22990 212.xxx.xx.xxx:113 L=44 S=0x00 I=18080 F=0x0000 T=54 Die ausge-x-te Adresse ist die von eth0, welches mit unserem HUB verbunden ist, der uns mit dem Internet verbindet. Da ich mich um die Sicherheit unseres Netzes sorge, frage ich mich, was o.g. Zeile denn überhaupt bedeuten könnte. Versucht da jemand unser Netz zu hacken? Gruß, Roman. gosub communications GbR | Fredersdorferstr. 10 | 10243 Berlin Tel: (030) 29 66 88 81 | Fax: (030) 29 66 88 84 | http://www.gosub.de PGP-Key: E-Mail mit subject: "get pgp key"

3 2

Re: [suse-security] FW-Meldung in messages auswerten
by Roman Blöth 03 Feb '00

03 Feb '00

Dear list, I want to apologize for my german posting some minutes ago - I was quite confused here, because our network is doing crazy things and thought it might be a hack and so started to try to understand /var/log/messages. I didn't think of writing in english which wasn't meant to offend anybody. Anyway I got the answer to my question immediatly, saying the message posted doesn't really matter. Thanks a lot and sorry, Roman Blöth.

1 0

AW: [suse-security] Standalone PC with firewall rules
by Stephan Gerling 03 Feb '00

03 Feb '00

See also the very good German Howto at http://www.little-idiot.de/firewall There is all you need with examples MFG Stephan Gerling -----Ursprüngliche Nachricht----- Von: Conny Kreyßel [SMTP:conny.kreyssel@inter-forum.de] Gesendet am: Donnerstag, 3. Februar 2000 12:26 An: suse-security(a)suse.com Betreff: [suse-security] Standalone PC with firewall rules I would secure a standalone PC. PC from the internet shall only connect to a specify port, but internal i want connect per localhost to a port eq. 1234. How can i set ipchains-rules to enable this. C. Kreyßel INTER-FORUM GmbH Leipziger Str. 62-70 04439 Leipzig/Engelsdorf Germany eMail: conny.kreyssel(a)inter-forum.de WWW : http://www.inter-forum.de Tel .: (+49)341/259200 Fax .: (+49)341/2592020 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Standalone PC with firewall rules
by Conny Kreyßel 03 Feb '00

03 Feb '00

I would secure a standalone PC. PC from the internet shall only connect to a specify port, but internal i want connect per localhost to a port eq. 1234. How can i set ipchains-rules to enable this. C. Kreyßel INTER-FORUM GmbH Leipziger Str. 62-70 04439 Leipzig/Engelsdorf Germany eMail: conny.kreyssel(a)inter-forum.de WWW : http://www.inter-forum.de Tel .: (+49)341/259200 Fax .: (+49)341/2592020

2 1