openSUSE Security March 2000

security@lists.opensuse.org

93 participants
70 discussions

proxy for firewall
by Rupert Koenig 29 Mar '00

29 Mar '00

hi! i'm searching for proxies for a application-level firewall - unfortunatly suse released only the ftp-proxy, the TIS toolkit isn't free for commercial use. anybody out there who knows a http-proxy to be used for firewalls? AFIK squid only does caching while proxies on a firewall should do quite more. ciao Rupert

4 4

adding users
by Jae 28 Mar '00

28 Mar '00

hey all - i appologize b/c this probably isn't the best place to post this message, but it does have a little to do w/ security. :) i need to write an application to create users on a system. basically their info is stored in a mysql database and their username, etc is generated based on a letter and their ip address (i work for a web hosting company and we assign usernames based on the last two octets of the ip they get) i was planning on running this as a daemon that accepted the domain name to be created. so - basically i was looking for info on what would be the securest way to do this and where i could find information about using functions, etc that have laready been provided to do this. thanks -Jae ** "I'm very drunk and I intend on getting drunker before it's over." -Clark Gable, Gone with the Wind

1 0

Antwort: Re: [suse-security] firewall-script doesn't start
by kai.krebber＠syseca.de 28 Mar '00

28 Mar '00

>>Does the SuSE-fw need a modular kernel? >Yes, you may want to rebuild your kernel >to load the appropriate modules, unless >you want to modify the firewall script in init.d. O.K. - Then I will completely renounce the SuSE-firewall-script. The literature says that it's not a good idea, having a module-enabled kernel on a firewall and this attitude makes sense to me. Thank you anyway, Kai

2 2

NFS on SuSE6.3
by Der Meister!! 27 Mar '00

27 Mar '00

I know it is a bit off the topic of this list but I simply don't know where to ask. I'm trying to use my linux-machine as a YP and NFS server. With SuSE 6.2 it was no problem to make my users mount the /home share on their workstations and to use YP. Now I tried to install a new server (got a new, stronger machine :-))))) using SuSE 6.3. YP works fine but when I mount the /home share I get all of the users directories, but they are empty. I simply don`t know what to do as it worked the same way on SuSE 6.2. Has anything changed in SuSE 6.3 or is it a bug? A desperate admin searching for help P.S.: At the moment I only got one entry in my exports file it is /home (works with 6.2)

3 2

../dev/gpmctl
by Ertan Sekmen 27 Mar '00

27 Mar '00

my server has no mouse, so i didn'T install gpm, in addition i have disabled them in /etc/rc.conf. But my logs still complain about /dev/gpmctl connection. Is this a critical failure that i don't know, or can be ignored?

2 1

Re: DNS Concept for DMZ
by Michael Hamm 25 Mar '00

25 Mar '00

>>>why don't you use two (ore three) DNS-servers on your application gateway: >>>the (primary and secondary) DNS-server of your Provider for internet adresses >>>and your internal DNS-server for the internal adresses? I think that should solve the problem. >>>If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. >> >>But how did the gateway know, that for example MY-PC-NAME is an >>internal Name, and it has to be resolved by the internal DNS-Server. >> >>If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME ><by the Provider. Yet I see no way to told the Gateway: >>"For this name try the Internal- for an other name try the Provider- DNS-Server" >> >>Michael >> >> >Ok, I see. >Your application gateway should use the internal name server(s) first; if that one doesn't know the answer it has to be configured in that >way that it will ask the nameserver of the provider (the nameservers of your internal nameserver should be the ones of your provider). >If your internal server(s) are down, then the application gateway can still resolve external names - using the second or third configured >nameserver. Okay, so I try this: 1. The Gateway try to resolve every Name by the Internal DNS-Server. 2. Internal names will be found. 3. If nothing is found, the Internal DNS-Server will forward the question to a DNS-Server running on the Gateway. 4. The DNS-Server running on the Gateway forward every question to the Providers DNS-Server. It seems to be a long way. What about the performance??? Michael

2 1

Re: Re: DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

> >why don't you use two (ore three) DNS-servers on your application gateway: >the (primary and secondary) DNS-server of your Provider for internet adresses >and your internal DNS-server for the internal adresses? I think that should solve the problem. >If you're using SuSE Linux, you can change the nameservers using yast or you can edit /etc/resolve. But how did the gateway know, that for example MY-PC-NAME is an internal Name, and it has to be resolved by the internal DNS-Server. If I resolve Names by my Provider, the Gateway try to resolve MY-PC-NAME by the Provider. Yet I see no way to told the Gateway: "For this name try the Internal- for an other name try the Provider- DNS-Server" Michael

3 2

DNS Concept for DMZ
by Michael Hamm 24 Mar '00

24 Mar '00

If you use an Interneal Router, an Applikation-Gateway and an External Router to build up a DMZ. What is the best way to resolve IP-Names for the Applikation-Gateway. If you resolve Names by using the Providers DNS-Server, the Gateway can not resolve Internal Adresses. If you use the Internal DNS-Server, the Gateway can not resolve Internet Adresses. Thanx Michael

1 0

Understanding IP-Forwarding with ipfwadm
by Jens Leilich 23 Mar '00

23 Mar '00

Hi, I want to forbid single Computers connection to internet. Therefore I did the following: Computer E00, wegerich www-proxy E01... 192.168.8.240--+ 192.168.8.241--+---192.168.8.8<-->192.168.254.1----192.168.254.2<-->Internet ... We use internal IP-Adresses 192.168.x.y; Router wegerich is necessary, because 2 other schools are connect via this router. www-proxy is NOT administered by us. squid is running on www-proxy, masquerading is activated on all ports, so that surfing is possible withot proxy. Now I want to disable Internet-Connection via http for a single computer by using forwarding-rules on wegerich. # disable proxy, works! /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 192.168.251.2 81 # enable web-server, works /sbin/ipfwadm -F -a accept -S e00 -D 192.168.251.2 # disable rest of the world, doesn't work /sbin/ipfwadm -F -a reject -P tcp -S e00 -D 0.0.0.0 why does the last rule not work and connection (http) is possible via masquerading? Jens Leilich --- jens.leilich(a)bbst1.lu.rp.schule.de, http://bbst1.lu.rp.schule.de BBS Technik I Ludwigshafen, Franz-Zang-Str. 3-7, 67059 Ludwigshafen Telefon +49 621 504-4110 (Anrufbeantworter) (Answering Machine) +49 621 504-4101 (Sekretariat) Telefax +49 621 504-3789

1 1

firewall-script doesn't start
by kai.krebber＠syseca.de 22 Mar '00

22 Mar '00

Howdy! I just installed the Suse-firewall-pakage from german 6.3 on my PC. Unfortunately it doesn't start during boot, although I set the START_FW in /etc/rc.config to YES. A look in my /etc/rc.d/rc2.d and /etc/rc.d/rc3.d - directories revealed that there are K??firewall - links to ../firewall but none with S??firewall. >From where is the script usually started? Or should there be S?? - scripts for the fw and my installation just went wrong? One more question: It is usually recomendet to build a monolithic kernel for a firewall, which I did. Booting with this, I get a logfileentry: " No module symbols loaded - kernel modules not enabled", when I try to start the firewall manually. Does the SuSE-fw need a modular kernel? Greetings, Kai

3 3

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

openSUSE Security March 2000