January 2001 - openSUSE Security - openSUSE Mailing Lists

Socks on SuSE 7.0
by Rainer.Frohne＠t-online.de 14 Jan '01

14 Jan '01

Hello, does anyone know a HowTo to set up socks on SuSE 7.0? I do not find any dokumentation on the socks webpages and in the packages! Is there a Book which anyone of you can recommend? Thanks in advance! Rainer

1 0

Re: [suse-security] ICQ File Transfers
by Widmann Thomas 14 Jan '01

14 Jan '01

Hi * Dan Ball wrote: > > Try using the icq_masq kernel modul. > > > I searched throughout all the documentation I could find, including the > website and came up with pretty much the same modules I already had. If > these are the ones you are referring to, these are the ones that are loaded. > I did not see one for ICQ. Get this module from http://members.tripod.com/~djsf/masq-icq/ ciao Thomas

2 1

Firewall
by Markus Schwaiger 13 Jan '01

13 Jan '01

Hi, I've got/want to build the following environment: Firewall: 14 ext. IP's bound to eth0:0...eth0:13 1 internal IP 192.168.1.199 (of course...) on eth1 Masquerading of the internal network Acting as public DNS Acting as proxy (squid) for the local network Mail- and Web-Server in internal network (192.168.1.200) I want to: * local PC's should more or less be allowed to get access to the usual services * foreign PC's should only be allowed to get dns, www and smtp/pop access * foreign PC's requesting www or smtp/pop services should be forwarded/masqueraded to 192.168.1.200 * ssh should be allowed for the firewall and eventually also be forwarded/masqueraded (on another port?!?) to 192.168.1.200 * everything else should be forbidden Since I couldn't manage to get SuSEfirewall 4.2 to work (everything works fine apart from the forwarding/masquerading of www/smtp/pop to the internal machine 192.168.1.200): does anybody please have an ipchains (rc.firewall) script that does more or less what I described? It's especially difficult to find an ipchains sample that does aliasing on the external interface AND port forwarding or masquerading to an internal machine. Is there something else I have to to on the firewall? Routing etc. to the outer world looks fine, ifconfig looks fine. Everything works perfect as long as the Web- and Mail-Server reside on the firewall - but that's what I need to avoid. Thanks a lot in advance!

2 1

Re: SuSEfirewall und kernel 2.4 (iptables)
by marc＠suse.de 13 Jan '01

13 Jan '01

Hi folks, > Wahrschneinlich fragen dich das viele.... > Aber wann erscheint eine SuSEfirewall auf iprtables basis ?? to answer this often asked question in public: SuSEfirewall does not support iptables or ipfwadm, only ipchains. SuSEfirewall2 1.0 will support iptables (but not ipchains or ipfwadm). As I'll be on a long holiday soon, SuSEfirewall2's first release will be end of february/begin of march. btw. selective trusted hosts/nets definitions will be in SuSEfirewall 4.3 as well as in SuSEfirewall2 1.0 - SuSEfirewall 4.3 will be released at the same time. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Re: [suse-security] ipchains-log
by Max Lindner 12 Jan '01

12 Jan '01

>> >> I've a Nameserver behind my ipchains-firewall and the log says >> something about incoming connections to port 53 from port 53. What >> kind of Nameserver-service is that? I've searched, but found nothing >> concerning this connections. > >It could just be a nameserver querying your nameserver while the source >port to use has been configured to 53. This isn't usually the case, but >some admin just might have thought that it is a good idea. I wouldn't do >it because it obfuscates the logs. O.K., if I'm on the right trip, udp requests are not bad and its no real hole if i allow them. >If it's tcp and not udp, then someone might have tried to get zone files >from you. Then it is interesting, _who_ did that, with which reason. > whats so bad about other people can accessing my zone files? I thought the should do this in order to resolve the Hostname... Or is there only a risk when you have 'internal' zone files on this NS (that's not the case...)? Thanks for help. Max

3 2

RE: [suse-security] SSH whereis and installing
by Timothy E Bogue 12 Jan '01

12 Jan '01

Thanks for the reply. All you comments were helpful. Notes: ftp://ftp.suse.de/pub/suse/i386/7.0/sec1/ssh.rpm It is the version on the CDs that wasn't packed on the US-Version. The original compiles out-of-the box. We include a later, stable version because of licensing issues. Again Thanks. Tim

1 0

Re: [suse-security] Martian source
by Corvin Russell 12 Jan '01

12 Jan '01

This is a FAQ. I asked the same question back in July, and this was the best answer I got: http://archives.neohapsis.com/archives/linux/suse/2000-q3/0161.html In general, such messages indicate misconfiguration or, potentially, monkey business. Any given case requires investigation and interpretation to decide what the specific cause is. Since I am not an expert, I won't venture any guidelines here. The relevant documentation is RFC1812, wherefrom the following: 5.3.7 Martian Address Filtering An IP source address is invalid if it is a special IP address, as defined in 4.2.2.11 or 5.3.7, or is not a unicast address. An IP destination address is invalid if it is among those defined as illegal destinations in 4.2.3.1, or is a Class E address (except 255.255.255.255). A router SHOULD NOT forward any packet that has an invalid IP source address or a source address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a source address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. A router SHOULD NOT forward any packet that has an invalid IP destination address or a destination address on network 0. A router SHOULD NOT forward, except over a loopback interface, any packet that has a destination address on network 127. A router MAY have a switch that allows the network manager to disable these checks. If such a switch is provided, it MUST default to performing the checks. If a router discards a packet because of these rules, it SHOULD log at least the IP source address, the IP destination address, and, if Baker Standards Track [Page 96] RFC 1812 Requirements for IP Version 4 Routers June 1995 the problem was with the source address, the physical interface on which the packet was received and the Link Layer address of the host or router from which the packet was received. 5.3.8 Source Address Validation A router SHOULD IMPLEMENT the ability to filter traffic based on a comparison of the source address of a packet and the forwarding table for a logical interface on which the packet was received. If this filtering is enabled, the router MUST silently discard a packet if the interface on which the packet was received is not the interface on which a packet would be forwarded to reach the address contained in the source address. In simpler terms, if a router wouldn't route a packet containing this address through a particular interface, it shouldn't believe the address if it appears as a source address in a packet read from this interface. If this feature is implemented, it MUST be disabled by default. DISCUSSION This feature can provide useful security improvements in some situations, but can erroneously discard valid packets in situations where paths are asymmetric. -- Corvin Russell <corvinr(a)sympatico.ca>

1 0

intrusion attempt?
by Marko Saha 12 Jan '01

12 Jan '01

Hi all! Today I found that i couldn't connect to my SuSe 7.0 Linux box through ssh and the console were dead. After switching the power and looking through logfiles I found this: ----- Jan 12 05:25:29 webhost kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:30587 255.255.255.255:30591 L=28 S=0x00 I=12830 F=0x0000 T=1 (#40) Jan 12 05:25:29 webhost kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:30587 255.255.255.255:30591 L=28 S=0x00 I=12878 F=0x0000 T=1 (#40) Jan 12 05:25:29 webhost PAM-unix2[1378]: bad username [ ] Jan 12 05:25:29 webhost login[1378]: FAILED LOGIN 1 FROM /dev/tty1 FOR UNKNOWN, User not known to the underlying authentication module ----- After that last entry there was nothing in /var/log/messages until after I've reseted the box. The box is at home so there are no other than I who have console access. I'm running custom made ipchains rules that blocks all but ssh, ntp and http. Do you people on the list have any ideas what could have happend? Thanks, Marko marko.saha(a)telia.com

1 0

ipchains-log
by Max Lindner 12 Jan '01

12 Jan '01

Hi all! I've a Nameserver behind my ipchains-firewall and the log says something about incoming connections to port 53 from port 53. What kind of Nameserver-service is that? I've searched, but found nothing concerning this connections. Thanks for help. Max

2 1

SSH whereis and installing
by Timothy E Bogue 12 Jan '01

12 Jan '01

Hi, I'm in the process of setting up a email reference server in the Documents Department in the University Library at UIC at Chicago. I have set up the server, but I will need to be using SSH for remote logins, etc. Where can I find SSH? I've looked in the SuSE Linux 7.0 professional's CD's and at SuSE's ftp site. Will the SSH at ftp://ftp.ssh.com/pub/ssh/ install without any trouble? I'm (really) new to Linux and the Unix way of doing things. Any help finding SSH and the easiest way to install it would be appreciated. Thanks. Tim

4 3