March 2000 - openSUSE Security - openSUSE Mailing Lists

proxy for firewall
by Rupert Koenig 29 Mar '00

29 Mar '00

hi! i'm searching for proxies for a application-level firewall - unfortunatly suse released only the ftp-proxy, the TIS toolkit isn't free for commercial use. anybody out there who knows a http-proxy to be used for firewalls? AFIK squid only does caching while proxies on a firewall should do quite more. ciao Rupert

4 4

adding users
by Jae 28 Mar '00

28 Mar '00

hey all - i appologize b/c this probably isn't the best place to post this message, but it does have a little to do w/ security. :) i need to write an application to create users on a system. basically their info is stored in a mysql database and their username, etc is generated based on a letter and their ip address (i work for a web hosting company and we assign usernames based on the last two octets of the ip they get) i was planning on running this as a daemon that accepted the domain name to be created. so - basically i was looking for info on what would be the securest way to do this and where i could find information about using functions, etc that have laready been provided to do this. thanks -Jae ** "I'm very drunk and I intend on getting drunker before it's over." -Clark Gable, Gone with the Wind

1 0

Antwort: Re: [suse-security] firewall-script doesn't start
by kai.krebber＠syseca.de 28 Mar '00

28 Mar '00

>>Does the SuSE-fw need a modular kernel? >Yes, you may want to rebuild your kernel >to load the appropriate modules, unless >you want to modify the firewall script in init.d. O.K. - Then I will completely renounce the SuSE-firewall-script. The literature says that it's not a good idea, having a module-enabled kernel on a firewall and this attitude makes sense to me. Thank you anyway, Kai

2 2

NFS on SuSE6.3
by Der Meister!! 27 Mar '00

27 Mar '00

I know it is a bit off the topic of this list but I simply don't know where to ask. I'm trying to use my linux-machine as a YP and NFS server. With SuSE 6.2 it was no problem to make my users mount the /home share on their workstations and to use YP. Now I tried to install a new server (got a new, stronger machine :-))))) using SuSE 6.3. YP works fine but when I mount the /home share I get all of the users directories, but they are empty. I simply don`t know what to do as it worked the same way on SuSE 6.2. Has anything changed in SuSE 6.3 or is it a bug? A desperate admin searching for help P.S.: At the moment I only got one entry in my exports file it is /home (works with 6.2)

3 2

../dev/gpmctl
by Ertan Sekmen 27 Mar '00

27 Mar '00

my server has no mouse, so i didn'T install gpm, in addition i have disabled them in /etc/rc.conf. But my logs still complain about /dev/gpmctl connection. Is this a critical failure that i don't know, or can be ignored?

2 1

Re: DNS Concept for DMZ
by Michael Hamm 25 Mar '00

25 Mar '00

>>>why don't you use two (ore three) DNS-servers on your application gateway: >>>the (primary and secondary) DNS-server of your Provider for internet adresses >>>and your internal DNS-server for the internal adresses? I think that should solve the problem. >>>If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. >> >>But how did the gateway know, that for example MY-PC-NAME is an >>internal Name, and it has to be resolved by the internal DNS-Server. >> >>If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME ><by the Provider. Yet I see no way to told the Gateway: >>"For this name try the Internal- for an other name try the Provider- DNS-Server" >> >>Michael >> >> >Ok, I see. >Your application gateway should use the internal name server(s) first; if that one doesn't know the answer it has to be configured in that >way that it will ask the nameserver of the provider (the nameservers of your internal nameserver should be the ones of your provider). >If your internal server(s) are down, then the application gateway can still resolve external names - using the second or third configured >nameserver. Okay, so I try this: 1. The Gateway try to resolve every Name by the Internal DNS-Server. 2. Internal names will be found. 3. If nothing is found, the Internal DNS-Server will forward the question to a DNS-Server running on the Gateway. 4. The DNS-Server running on the Gateway forward every question to the Providers DNS-Server. It seems to be a long way. What about the performance??? Michael

2 1

Re: Re: DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

> >why don't you use two (ore three) DNS-servers on your application gateway: >the (primary and secondary) DNS-server of your Provider for internet adresses >and your internal DNS-server for the internal adresses? I think that should solve the problem. >If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. But how did the gateway know, that for example MY-PC-NAME is an internal Name, and it has to be resolved by the internal DNS-Server. If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME by the Provider. Yet I see no way to told the Gateway: "For this name try the Internal- for an other name try the Provider- DNS-Server" Michael

3 2

DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

If you use an Interneal Router, an Applikation-Gateway and an External Router to build up a DMZ. What is the best way to resolve IP-Names for the Applikation-Gateway. If you resolve Names by using the Providers DNS-Server, the Gateway can not resolve Internal Adresses. If you use the Internal DNS-Server, the Gateway can not resolve Internet Adresses. Thanx Michael

1 0

Understanding IP-Forwarding with ipfwadm
by Jens Leilich 23 Mar '00

23 Mar '00

Hi, I want to forbid single Computers connection to internet. Therefore I did the following: Computer E00, wegerich www-proxy E01... 192.168.8.240--+ 192.168.8.241--+---192.168.8.8<-->192.168.254.1----192.168.254.2<-->Internet ... We use internal IP-Adresses 192.168.x.y; Router wegerich is necessary, because 2 other schools are connect via this router. www-proxy is NOT administered by us. squid is running on www-proxy, masquerading is activated on all ports, so that surfing is possible withot proxy. Now I want to disable Internet-Connection via http for a single computer by using forwarding-rules on wegerich. # disable proxy, works! /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 192.168.251.2 81 # enable web-server, works /sbin/ipfwadm -F -a accept -S e00 -D 192.168.251.2 # disable rest of the world, doesn't work /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 0.0.0.0 why does the last rule not work and connection (http) is possible via masquerading? Jens Leilich --- jens.leilich(a)bbst1.lu.rp.schule.de, http://bbst1.lu.rp.schule.de BBS Technik I Ludwigshafen, Franz-Zang-Str. 3-7, 67059 Ludwigshafen Telefon +49 621 504-4110 (Anrufbeantworter) (Answering Machine) +49 621 504-4101 (Sekretariat) Telefax +49 621 504-3789

1 1

firewall-script doesn't start
by kai.krebber＠syseca.de 22 Mar '00

22 Mar '00

Howdy! I just installed the Suse-firewall-pakage from german 6.3 on my PC. Unfortunately it doesn't start during boot, although I set the START_FW in /etc/rc.config to YES. A look in my /etc/rc.d/rc2.d and /etc/rc.d/rc3.d - directories revealed that there are K??firewall - links to ../firewall but none with S??firewall. >From where is the script usually started? Or should there be S?? - scripts for the fw and my installation just went wrong? One more question: It is usually recomendet to build a monolithic kernel for a firewall, which I did. Booting with this, I get a logfileentry: " No module symbols loaded - kernel modules not enabled", when I try to start the firewall manually. Does the SuSE-fw need a modular kernel? Greetings, Kai

3 3