January 2001 - openSUSE Security - openSUSE Mailing Lists

Getting mail via POP from DMZ server
by suse＠diplan.de 07 Jan '01

07 Jan '01

Hi. Preparing a new DMZ server I wonder how Email from external, which arrives at the DMZ server is to be treated most secure. Is there a secure possibility to transfer the whole mail to my internal server (fetchmail?) where staff could get it by POP or is POP from internal to DMZ secure enough? Clients run on WinNT. Any advice appreciated, Rainer --

6 7

ICQ and firewals
by Corvin Russell 07 Jan '01

07 Jan '01

I am using the firewall package that came with 6.4. Neither kicq nor ICQJava can establish a connection. Both work fine when the firewall is stopped. What do I need to allow? I don't have a sniffer running, and there's no documentation about the ports that ICQ listens on. I have noticed 1067, 1069 so far. The ICQ server is at 205.188.153.100 - 205.188.153.110 (looks like) and connects on port 4000. TIA Corvin -- Corvin Russell <corvinr(a)sympatico.ca>

3 3

Masq'ing pptp
by Kevin Creason 07 Jan '01

07 Jan '01

I've got 6.4 (kernel v 2.2.14) running on my masq box, and wish to run a pptp VPN through the masq/fw to someone on the farside of the i'net. My masq successfully works with everything else so far. I've been reading at ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade-2.ht ml http://members.home.net/ipmasq/ but I'm not sure of the SuSE kernel status. Do I need to apply the patches they recommend, or does perhaps SuSE have those in? Could I get/make the module and insmod it? TIA Kevin

2 1

And oh, btw..
by Nix 06 Jan '01

06 Jan '01

*grin* Here goes nothing... Lets see how SuSE 7 like a 2.4 series kernel... -Nix Date: Thu, 4 Jan 2001 16:01:22 -0800 (PST) From: Linus Torvalds torvalds(a)transmeta.com To: Kernel Mailing List linux-kernel(a)vger.kernel.org Subject: And oh, btw.. In a move unanimously hailed by the trade press and industry analysts as being a sure sign of incipient braindamage, Linus Torvalds (also known as the "father of Linux" or, more commonly, as "mush-for-brains") decided that enough is enough, and that things don't get better from having the same people test it over and over again. In short, 2.4.0 is out there. Anxiously awaited for the last too many months, 2.4.0 brings to the table many improvements, none of which come to mind to the exhausted release manager right now. "It's better", was the only printable quote. Pressed for details, Linus bared his teeth and hissed at reporters, most of which suddenly remembered that they'd rather cover "Home and Gardening" than the IT industry anyway. Anyway, have fun. And don't bother reporting any bugs for the next few days. I won't care anyway. Linus --- Nix - SuSE-Security FAQ Maintainer http://www.cotse.com/nix/suse-security-faq/

3 2

system()/exec() within a PHP script
by abarguia＠mail.belgavillage.be 06 Jan '01

06 Jan '01

I need to execute the imagemagick /usr/X11R6/bin/convert program within a php script. The command line: /Absolute-path-to/convert -geometry 150x150 /Absolute-path-to/PHP_image.gif /path-to/PHP_scaledimage.gif works fine from the shell. Within a php script the following line does nothing: system ("/Absolute-path-to/convert -geometry 150x150 /Absolute-path-to/PHP_image.gif /path-to/PHP_scaledimage.gif") I think it's related to some security parameters to not execute some commands from the Web. Directory/files set to 777 and scripts set to 755 SuSE 7.0 PPc Edition PHP 3.03pl1 thanks a lot for you help.

2 3

Opening up ports in firewall
by Waldack, Jesse (CAP, CARD) 05 Jan '01

05 Jan '01

I am trying to open up a few ports in my firewall (several TCP and one UDP port) for gaming purposes. I've had people offer suggestions on how it should work, but I've never been able to get it working. Can I have someone who has done this, and is working, let me know how they got it working with some examples? :) I am using SuSE 6.4 as a Masq server to my cable modem. The other PCs on the LAN has 192.168.x.x IPs. Thanks in advance for your help. -Jesse

1 0

Re: [slug] Re: ftp/firewall security
by MaD dUCK 05 Jan '01

05 Jan '01

also sprach gabriel rosenkoetter (on Thu, 04 Jan 2001 03:16:04PM -0500): > You can't. Passive ftp and firewalls don't mix, and never have. Any > intelligent ftp client (ncftp included, last I checked) will attempt > to use passive, and fall back to active if it can't get through. well, as far as i can tell the problem is beyond ftp. it's about stateless firewalls. because if i ssh into allspice for instance, my ssh client talks to port 22 on allspice which then spawns into a dialogue between some port x on allspice and a port above 1024 on my machine. so in a stateless firewall, that just has to be open. the port 1024+ aspect i mean... > > 99% of all ftp traffic nowadays is passive, so the data transfer > > happens from port 21 of the server to port x {x | x >= 1024} of the > > client. > > Um... where'd you come up with that figure? no idea. i thought i read that somewhere... > > more important in this situation, it is very possible that some client > > program tries to establish a connection to a server with the backward > > connect (server -> client) being something like x -> 5021. > > ... or 6xxx (X). except that ports 6000/6001 could be enabled specifically if i wanted X. the same applies to port 4000 (icq). the point is that X and icq have specific ports but the client connections to common spawn-services use the next available port... > > (i DENY packets rather than to REJECT them). > > Why? Short of a signature suggesting a DoS, it's common courtesy to > reject. Oh, wait, you lack state. Ne'mind. Get a real (stateful) > firewall, then. ;^> i am insulted. the reason is: there are windoze clients on the networks that i am in and what i found is that if you REJECT, windoze generates a whole lot more traffic than if you simply DENY and let it poll every 15 seconds. it's weird, i know, but that's what tcpdump and my switch LEDs indicate... > > so while it is perfectly understandable to me how and why and what > > ports under 1024 i have to block and open to secure the machine, the > > ports above 1024 are a mystery. a lot of networks i have worked > > in/with/for had firewall policies that allowed anything above 1024, > > but as philip pointed out, this is asking for trojans. > > No, no, no. This is painfully wrong-headed. You're only asking for > trojans if there's a way to break security on ports where you > actually run servers. If not, then having these ports open does you > no harm. If so, then a cracker will find a way to trojan you with > the ports you have open anyway. (Trust me, it's not hard to write a > daemon that behaves like an sshd except with certain input, when it > gives you a root shell instead, and substitute that for your > currently-running sshd.) yes, you have a point. to be honest, until i started that discussion on suse-security, i did not think that having ports 1024+ open would be a problem if the rest of the system was secure... > Every workable (note I don't say *good*) ipchains setup I've ever > seen just allowed ports over 1024. If you want to keep rpc or X > traffic inside, you're going to have to randomly decided to block > a swath of those, or trust that blocking the ports the server > daemons actually run on will be enough. that's what i am doing now... > Or install yourself lots of proxies (no kind of fun). woohoo. > > and do you guys know of free, open-source statefull firewalls for > > linux? > > I'm pretty sure BSD ipf/ipnat will build on Linux (it does on > Solaris). Not that I've tried. does ipf do stateful in a good way? because the newer ipchains do it to (context based), but it's still simple... martin [greetings from the heart of the sun]# echo madduck@!#:1:s@\@@@.net -- heisenberg may have been here.

2 1

Enlighten/AgentMon_V3.4.0 on darkstar: software alarm (fwd)
by Michael Chletsos 05 Jan '01

05 Jan '01

Does anyone know what this stuff means? Subject: software inventory changed on darkstar missing: k2'%($)'(2C\m\c$\[`kfi]fiB>fc[ilee\i missing: e\2'%+%($)'.2:fe]`^li\Oj\im\im`[\fdf[\j\kk`e^j thanks michael

1 0

RE: [suse-security] Skitter.ORG
by Raffy 05 Jan '01

05 Jan '01

> This could be not as good idea since RFC1122 says that every host connected > to the Internet must answer to icmp echo requests. Help me on this: [extract from rfc 1122]: | | | | |S| | | | | | |H| |F | | | | |O|M|o | | |S| |U|U|o | | |H| |L|S|t | |M|O| |D|T|n | |U|U|M| | |o | |S|L|A|N|N|t | |T|D|Y|O|O|t FEATURE |SECTION | | | |T|T|e ICMP Echo Request or Reply: | | | | | | | Echo server and Echo client |3.2.2.6 |x| | | | | Echo client |3.2.2.6 | |x| | | | Discard Echo Request to broadcast address |3.2.2.6 | | |x| | | Discard Echo Request to multicast address |3.2.2.6 | | |x| | | Use specific-dest addr as Echo Reply src |3.2.2.6 |x| | | | | Send same data in Echo Reply |3.2.2.6 |x| | | | | Pass Echo Reply to higher layer |3.2.2.6 |x| | | | | Reflect Record Route, Time Stamp options |3.2.2.6 | |x| | | | Reverse and reflect Source Route option |3.2.2.6 |x| | | | | What is echo server and echo client? Pass Echo Reply to higher layer? Meaning in the IP stack, right? So in short, every host and gateway should implement PING? Even firewalled hosts? So why is there this big discussions about what ICMP a firewall should allow? This document tells you which ones? I am lost... Thanks Raffy

3 2

WG: [suse-security] ICQ and firewals
by Philipp Snizek 05 Jan '01

05 Jan '01

> -----Ursprungliche Nachricht----- > Von: Corvin Russell [mailto:corvinr@sympatico.ca] > Gesendet: Freitag, 5. Januar 2001 15:50 > An: suse-security(a)suse.com > Betreff: [suse-security] ICQ and firewals > > > > I am using the firewall package that came with 6.4. Neither kicq nor > ICQJava can establish a connection. Both work fine when the firewall > is stopped. What do I need to allow? I don't have a sniffer running, Yes, you have. Try tcpdump or iptraf. I think you do better with iptraf. If it's not installed on your linux box, install it from the n(etwork) section. > and there's no documentation about the ports that ICQ listens on. I > have noticed 1067, 1069 so far. The ICQ server is at 205.188.153.100 - > 205.188.153.110 (looks like) and connects on port 4000. So icq is doing the following: Request to icq server: You ------> icq server 1024: ------> 4000 Answer from icq server: You <------ icq server 1024: <------ 4000 And this is how you have to open your firewall. ipchains wise it would sound like this: ipchains -A output -p tcp -s [ip.of.your.machine] 1024: -d [ip.of.icq.server] 4000 -i [ext-eth] -j ACCEPT # with this rule the packets are leaving your firewall box on ext-eth to icq server ipchains -A input -p tcp -s [ip.of.icq.server] 4000 -d [ip.of.your.machine] 1024: -i [ext-eth] -j ACCEPT # and this is icq server's answer on ext eth on your firewall box. The only thing you have now to do is to define both forward and input rules and then you'll be fine. You can also adapt this to SuSE firewall which, as much as I've heard about it, does not have a real good reputation. HTH Philipp > TIA > > Corvin > > -- > Corvin Russell <corvinr(a)sympatico.ca> > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0