July 2000 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] webserver behind firewall with ingoing and outgoing ftp ?
by Jeremy Buchmann 28 Jul '00

28 Jul '00

It sounds like you may want to use a redirector. This is a program which accepts a connection on one interface and redirects it to another. For example, if you had a web server inside a network that was masqueraded/firewalled, you'd install the redirector on the firewall and tell it to redirect any connections from the Internet on port 80 to the Web server. We have been using the program 'redir' for this for several months with no problems. -- Jeremy Buchmann System Admin/Database Programmer Wells Gaming Research ---------- >From: Tobias Gasser <gasser(a)aicomm.de> >To: SuSE Security <suse-security(a)suse.com> >Subject: [suse-security] webserver behind firewall with ingoing and outgoing ftp ? >Date: Wed, Jul 26, 2000, 11:01 AM > > Hello, > > i need to set up a webserver behind a ipchains packet-filter. > In the firewals config-file eth0 is the external- and eth1 the > dmz-device. > There have to be ingoing _and_ outgoing ftp-connections to the > webserver. > > So the first problem: How can I handle it to not simply forward > all high ports to the Webserver ? I tried it with fwproxy, but > it hangs after entering the login name (just like having not allowed > ftp connections via hosts.deny - but then I wouldn't even get > a login prompt). > > The second problem: outgoing ftp-connections work fine if i enable > masquerading for the webserver - evident - , but then I can't get any > connections to the webserver, cause the replies are being masqueraded > - evident too. > > So, is there a simple way to get this to work ? > > Thank you in advance! > Tobias > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

Re: [suse-security] redirect
by Max Gribov 28 Jul '00

28 Jul '00

i was playing around with ipchains and ipmasqadm to forward all traffic coming on my port 80 to www.yahoo.com port 80... i did what is specified below > #!/bin/bash > LS=your.external.firewall.ip > HTTPD=your.rfc1918.internal.ip > ipmasqadm portfw -a -P tcp -L $LS http -R $HTTPD http > ipchains -I forward -p tcp -s $HTTPD http -j MASQ but it didnt work. if i tried to connect to my machine's ip addr, i still ended up on my machine's httpd. what could i be doing wrong? On Fri, 28 Jul 2000, Chris Drauch wrote: > ksemat(a)wawa.eahd.or.ug wrote: > > > > Hi all, > > I would like to http requests on port 80 to my firewall machine running > > ipchains to another machine on my local network with rfc1918 ip and for > > that machine to be able to respond and send replies back to where they > > came from. I am running SuSE linux 6.4 kernel 2.2.14 with ipchains and > > ipmasqadm. > > #!/bin/bash > LS=your.external.firewall.ip > HTTPD=your.rfc1918.internal.ip > ipmasqadm portfw -a -P tcp -L $LS http -R $HTTPD http > ipchains -I forward -p tcp -s $HTTPD http -j MASQ > > -- > cdr > - > To unsubscribe from this list: send the line "unsubscribe linux-net" in > the body of a message to majordomo(a)vger.rutgers.edu

2 1

Re: [suse-security] redirect
by ksemat＠wawa.eahd.or.ug 28 Jul '00

28 Jul '00

Will try this out. thanks, Noah On Fri, 28 Jul 2000, Chris Drauch wrote: > Date: Fri, 28 Jul 2000 14:56:32 +0100 > From: Chris Drauch <cdr(a)jeka.com> > To: ksemat(a)wawa.eahd.or.ug > Cc: linux-net(a)vger.rutgers.edu, linux-admin(a)vger.rutgers.edu, > suse-security(a)suse.com > Subject: Re: [suse-security] redirect > > ksemat(a)wawa.eahd.or.ug wrote: > > > > Hi all, > > I would like to http requests on port 80 to my firewall machine running > > ipchains to another machine on my local network with rfc1918 ip and for > > that machine to be able to respond and send replies back to where they > > came from. I am running SuSE linux 6.4 kernel 2.2.14 with ipchains and > > ipmasqadm. > > #!/bin/bash > LS=your.external.firewall.ip > HTTPD=your.rfc1918.internal.ip > ipmasqadm portfw -a -P tcp -L $LS http -R $HTTPD http > ipchains -I forward -p tcp -s $HTTPD http -j MASQ > > -- > cdr > -====---====---====---====---====---====---====---====---====---====---====- > to unsubscribe email "unsubscribe linux-admin" to majordomo(a)vger.rutgers.edu > See the linux-admin FAQ: http://www.kalug.lug.net/linux-admin-FAQ/ > Noah ksemat(a)eahd.or.ug

1 0

Re: IPCHAINS and dynamic IP addresses
by Charles Price 28 Jul '00

28 Jul '00

Thanks Nick.... I'll try that.... if I come up with a "cleaner" solution, I'll post it here. Once again, thanks for your help. Kind Regards Charles P.W. Price ------------------------------ charlie(a)iago.org.uk www.iago.org.uk

1 0

redirect
by ksemat＠wawa.eahd.or.ug 28 Jul '00

28 Jul '00

Hi all, I would like to http requests on port 80 to my firewall machine running ipchains to another machine on my local network with rfc1918 ip and for that machine to be able to respond and send replies back to where they came from. I am running SuSE linux 6.4 kernel 2.2.14 with ipchains and ipmasqadm. Noah ksemat(a)eahd.or.ug

1 0

Re: [suse-security] ZDNet: Scientists spot Achilles' heel of the Internet!
by Kurt Seifried 28 Jul '00

28 Jul '00

Super denial of service attack found! By simply buying a glock 13 and some soft point rounds it is possible to effectively restrist administrators from accessing their servers by shooting them in the head repeatedly. After a 17 months study it was concluded that killing administrators had a negative effect on theirt job performance. SuSE is expected to release a patch next week in the form of "kevlar-ballhat-0.1-1.human.armor". > Simple. First, Net security issues ARE SuSE issues. Second, it gives > everyone a chance to say, "Duh!! It took how much money for that study, > when so many already KNOW the danger?!" Uh, yeah, thanks. Please refrain in future. Risks would be an appropriate place to post this. SuSE security, nope. I'm seeing people post to linux-audit list questions like "how do I store credit card numbers". It's OFFTOPIC. just like this was. > Fred -Kurt

4 3

ipchains or nessus bug ?
by Harald Scharf 28 Jul '00

28 Jul '00

Hello, to all ! I have the following problem : I defined the following ipchains rules on a firewall system : ipchains -I input -j DENY -p UDP -s 0.0.0.0/0 -d xxx.xxx.xxx.xxx/xxx 161 -l ipchains -I input -j DENY -p UDP -s 0.0.0.0/0 -d xxx.xxx.xxx.xxx/xxx 162 -l I think that this two commands should block any SNMP querys from world. I tested these rules from a remote host with mrtg. The output was input DENY eth1 PROTO=17 [remote ip]:[remote port] [destination ip]:161 L=141 S=0x00 I=25246 F=0x0000 T=53 (#7) Thats ok, but when i start a security scan with nessus (Version 1.0.1), the final report tells about a security hole at SNMP and SNMP-TRAP ports. The access is seems to be read, write, public..... I do not think, that this is a correct predication Next problem: Nessus reports, that Sendmail (Version 8.9.3) is susceptible against a redirection attack : rcpt to : recipient@hostname1@localhostname I think that sendmail is immun against such attacks (relaying, redirecting) since version 8.9.X. Sendmail is configured as Mail Relay. It forwards external mails to an internal Mail Server (NAT Network). HELP please. Is the system not correctly configured ....? Harald Scharf Softpoint electronic Netzwerksysteme / Firewalls Windows NT/Windows 2000/Linux/Netware/Unix mailto:h.scharf@softpoint.at www.softpoint.at www.simplex.at

2 1

IPCHAINS and dynamic IP addresses
by Charles Price 28 Jul '00

28 Jul '00

At the moment I just have a masquerading firewall but I'm hoping to add a shell script containing ipchains rules onto it soon. At the moment the script defines variables at the beginning and uses them later. ie. #!/bin/sh EXTERNAL_INTERFACE="eth0" IP_ADDR="192.168.1.20" ipchains -A input $EXTERNAL_INTERFACE -s $IP_ADDR etc.etc. Although there is a problem. I've got a dynamically assigned IP address, so in theory I'd have to re-configure the script every time PPP was started. Is there and environment variable in BASH to do the job $IP_ADDR or something like that, but then how does it know which? eth0 or ppp0? I feel I'm going to have to write a more cunning piece of script for this one. Any ideas? Kind Regards Charles P.W. Price ------------------------------ charlie(a)iago.org.uk www.iago.org.uk

3 2

ZDNet: Scientists spot Achilles' heel of the Internet!
by Fred A. Miller 27 Jul '00

27 Jul '00

http://www.zdnet.com/zdnn/stories/news/0,4586,2607716,00.html

3 3

webserver behind firewall with ingoing and outgoing ftp ?
by Tobias Gasser 26 Jul '00

26 Jul '00

Hello, i need to set up a webserver behind a ipchains packet-filter. In the firewals config-file eth0 is the external- and eth1 the dmz-device. There have to be ingoing _and_ outgoing ftp-connections to the webserver. So the first problem: How can I handle it to not simply forward all high ports to the Webserver ? I tried it with fwproxy, but it hangs after entering the login name (just like having not allowed ftp connections via hosts.deny - but then I wouldn't even get a login prompt). The second problem: outgoing ftp-connections work fine if i enable masquerading for the webserver - evident - , but then I can't get any connections to the webserver, cause the replies are being masqueraded - evident too. So, is there a simple way to get this to work ? Thank you in advance! Tobias

1 0