January 2001 - openSUSE Security - openSUSE Mailing Lists

Suse firewal
by ceccs＠keysoft.pt 31 Jan '01

31 Jan '01

Hi. Some problems/features/questions: System: SuSEfirewall v2.6, eth0 to the internet (cable modem), eth1 to internal network (192.168.x.x/24). 1. FW_SERVICE_DHCLIENT= yes fw rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 255.255.255.255/32 68 $LAA packets denied from my cable provider: input DENY eth0 PROTO=17 gateway.cable:67 eth0-ip:68 my rule:$IPCHAINS -A input -j "$ACCEPT" -p udp -s 0/0 67 -d 0/0 68 $LAA Is the cable provider sending invalid packets: having my interface ip specified when it should be 255.255.255.255 ? Or should the rule be as I modified? 2. I have dhcpd to the internal network, but not to the internet: FW_SERVICE_DHCPD=no and START_DHCPD=yes If START_DHCPD = yes, dhcp is allowed for BOTH the internal and internet interfaces. There should be a different setting for internal/external dhcpd and START_DHCPD should be ignored. As I have FW_PROTECT_FROM_INTERNAL="no", I removed the test for START_DHCPD 3. Why this rules with ippp0 hard coded ? $IPCHAINS -A forward -j "$DENY" -d 10.0.0.0/8 -i ippp0 $IPCHAINS -A forward -j "$DENY" -d 192.0.0.0/8 -i ippp0 I removed them from from the script, as there is already in place a rule denying packets from the net to 192/8. Carlos ---- Carlos Costa e Silva <ceccs(a)keysoft.pt> Keysoft Lda Lisboa - Portugal

1 0

Help with secumod
by Matthew 31 Jan '01

31 Jan '01

First of all thanks to Mark and MArc for making secumod, looks like a nifty little security module. However, it seems like a powerful little module. Actually, had a few (for me) nasty problems. I was following Marc's secure webserver guide. All was going fine until I installed the secumod module. At first I was able to conitnue administrating, then I noticed weird things happening...First it suddenly closed my ssh session, then pop3 and smtp shutdown. Then actually attached a keyboard and monitor, then tried logging in there. I got a libc data file read error message and then a failure to allocate memory. Login was not possible and ctrl-alt-F10 showed me few "non-essential" service shutting down. I managed to save the day by rescue mode... Anyway, after the docs I am kind of worried about repeating it....What did I do wrong? But I like its features.... With many thanks, Matthew

6 7

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! thank you, that's it! Perhaps this one should be added to the FAQ! bye Christian "now surfing fast" Bohn ----- Original Message ----- From: "Christoph Wegener" <cwe(a)bph.ruhr-uni-bochum.de> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:06 PM Subject: Re: [suse-security] SuSEFirewall slows down connection > Hallo Christian, > ich würde sagen - Du hast den ident (Port113) gesperrt, dann warten Verbindungen > wie SMTP, Telnet, SSH unter Umständen auf einen TimeOut und der liegt im bereich > von einigen (10) Sekunden... > > Christoph > > Christian Bohn wrote: > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > Ruhr-Universitaet Bochum > Lehrstuhl für Biophysik > c/o Christoph Wegener > Gebaeude ND 04/Nord > D-44780 Bochum, GERMANY > > Tel: +49(234)32-25754, Fax: +49(234)32-14626 > > mailto://cwe@bph.ruhr-uni-bochum.de > http://www.bph.ruhr-uni-bochum.de > > __ _ > / / (_)__ __ ____ __ > / /__/ / _ \/ // /\ \/ / . . . t h e c h o i c e o f a > /____/_/_//_/\_,_/ /_/\_\ G N U g e n e r a t i o n . . . > >

2 1

Re: [suse-security] Porn/Xrate-Filter
by Matthias Jaenichen 31 Jan '01

31 Jan '01

At 12:44 31.01.01 +0100, Carsten_Ellermann(a)sskbo.de wrote: >Hi, > > >is there any tool to filter pron and other rated sites and/or contents? We > >want to provide a S.u.S.E-based firewall for a school and think we must at > >least make it difficult to access any rated content. > >we use "squid" as proxy with stopword list's. Our list is about 350 line >long. Yes, that is one solution. could you send your stopword list to my private e-mail? Problem: how to keep that list updated? Any other ideas around? Reg. Matthias Jänichen

4 3

Re: [suse-security] SuSEFirewall slows down connection
by Christian Bohn 31 Jan '01

31 Jan '01

Hi! no, thats not the problem, icmp echo replys are allowed and I can ping myself from another host in the internet. bye CB ----- Original Message ----- From: "Alexander Bien" <abien(a)gmx.net> To: "Christian Bohn" <cbohn(a)uni-mannheim.de> Sent: Wednesday, January 31, 2001 3:10 PM Subject: RE: [suse-security] SuSEFirewall slows down connection > > Are u sure u allow icmp echo replys? > So the other host can ping you ? > Check that please.. then try again .. and maybe it will work faster this > time. > > Many hosts (specilly smtp servers) first ping the other host to see if its > still alive.. > > > -- > > Mit freundlichen Grüßen > > Alexander Bien > > -- > PIRONET NDH > Alexander Bien - Technical Assistant - SBU Services > Josef-Lammerting-Allee 14-18, 50933 Cologne - Germany > Tel.: +49 (0)172 7760569 - Fax: +49 (0)221 770 2815 > mailto:abien@pironet.com - http://www.pironet.com > > > > -----Original Message----- > > From: Christian Bohn [mailto:cbohn@uni-mannheim.de] > > Sent: Wednesday, January 31, 2001 3:04 PM > > To: suse-security(a)suse.de > > Subject: [suse-security] SuSEFirewall slows down connection > > > > > > Hi! > > > > I encountered the following problem with the SuSEfirewall-skript: > > > > First of all, my configuration: > > I've got a Linux Box (SuSE 6.4) running as a DSL-Router (incl. > > Masquerading) > > for an internal Network. > > The firewall-skript (which Version doesn't really matter, I've tried out > > several versions, including the newest form Marc's Website) is > > installed on > > that Linux-Box. > > > > The Problem: > > HTTP & SSH are working well but when I try to connect to a Internet-Server > > via FTP, POP(sometimes) or SMTP it takes a long time (ca. 20sec) > > until data > > is transferred although the connection itself is established immediately. > > I do not think that it is a DNS problem, reverse&forward lookups > > are working > > well. > > Although I think that it has nothing to do with masquerading because if I > > work on the server console, the problem also occurs. > > If I shut down the firewall, everything is working fine! > > > > > > I hope somebody can help me an that this is not a FAQ ;-) > > > > bye > > > > Christian Bohn > > > > > > > > > > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > >

1 0

AW: [suse-security] Porn/Xrate-Filter
by Thomas Lamy 31 Jan '01

31 Jan '01

You should give squidguard (http://www.squidguard.org/) a try. It comes with SuSE Professional since 7.0. They also maintain certain blacklists which can be easily updated via internet. Regards Thomas Lamy > -----Ursprüngliche Nachricht----- > Von: Matthias Jaenichen [mailto:mj@percomp.de] > Gesendet: Mittwoch, 31. Januar 2001 12:37 > An: suse-security(a)suse.de > Betreff: [suse-security] Porn/Xrate-Filter > > > Hi, > > is there any tool to filter pron and other rated sites and/or > contents? We > want to provide a S.u.S.E-based firewall for a school and > think we must at > least make it difficult to access any rated content. > > Reg. > > Matthias Jänichen > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

bind8
by Hans Vokal 31 Jan '01

31 Jan '01

> Hi, > > just a short heads-up: The bind8 packages for the distributions 6.1-7.1 > are being built as I write this email. The packages should be available > two or three hours. > > Roman. Hi Will there be an updated Version for SuSE 6.0 as well? Or some hints, how i get it to work securly? thanks in advance Marco __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! Mail auf Ihrem Handy? - http://mobil.yahoo.de

6 10

(cross-posted) [SLE] my apsfilter environment messed up
by dproc 31 Jan '01

31 Jan '01

I am cross-posting this as printing broke around the time I first ran harden_suse. I can't see permissions or ownerships the harden script could have done which hurt apsfilter (maybe something in /etc/passwd ??), but perhaps wiser minds can direct me towards my error. ("rpm --verify" doesn't suggest anything wrong either) dproc ----------- I can't print anything, because my apsfilter script (Version: S.u.S.E.-1.6) starts choking as soon as it starts. It reports a stream of errors as soon as it is called by the lpd. The first error in its log is always head: command not found (This is the first time a binary is called by the bash script /var/lib/apsfilter .) Errors continue until the filter hands an error code back to lpd without printing anything. Any clues? dproc

2 1

SuSE Security Announcement: bind8 (SuSE-SA:2001:03)
by Roman Drahtmueller 31 Jan '01

31 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: bind8 Announcement-ID: SuSE-SA:2001:03 Date: Tuesday, January 30th, 2000 23:40 MEST Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1 Vulnerability Type: remote root compromise Severity (1-10): 9 SuSE default package: no Other affected systems: all systems using bind, versions before 8.2.3-REL Content of this advisory: 1) security vulnerability resolved: bind8 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information bind-8.x in all versions of the SuSE distributions contain a bug in the transaction signature handling code that can allow to remotely over- flow a buffer and thereby execute arbitrary code as the user running the nameserver (this is user named by default on SuSE systems). In addition to this bug, another problem allows for a remote attacker to collect information about the running bind process (this has been found by Claudio Musmarra <a9605121(a)unet.univie.ac.at>). For more information on these bugs, please visit the CERT webpage at http://www.cert.org/advisories/CA-2001-02.html and the bind bugs webpage at http://www.isc.org/products/BIND/bind-security.html . The problem is existent in the upcoming SuSE distribution 7.1 that will be available by February 10th in the CD/DVD version. There exists no reasonable method to circumvent the problems other than to update the package as described below. Please choose the update package for your distribution from the URLs listed below and download the necessary rpm files. Then, install the package using the command `rpm -Uhv file.rpm´. rpm packages have an internal md5 checksum that protects against file corruption. You can verify this checksum using the command (independently from the md5 signatures below) `rpm --checksig --nogpg file.rpm', The md5 sums under each package are to prove the package authenticity, independently from the md5 checksums in the rpm package format. SPECIAL INSTALL INSTRUCTIONS: ============================== If you run a bind8 nameserver on your system, please update the package immediately. In order for the updated package to become active, the nameserver process "named" needs to be restarted. Do this using the command `rcnamed restart´ as root after performing the rpm command as shown above. Afterwards, check for the running daemon using the ps command as `ps aux´. The named process should show a new starting time. Repeat the `rcnamed restart´ command if the nameserver shut down too slowly to release the socket for the new server. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm e9b354dbd96f6216b9da01f2b3a0a166 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm f77200a6c476b58980f68b5db3fd7c4b SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm 4fdee7483fce85f2a31a1a53d2b01b76 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm e53896d1ddfb405774a492469621af02 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm bb25cb6ba2e54bf929f61c14b3663b3e source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm 1033f0df4b747f1d2758fdae69a5fa17 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm 73fe798d4afb87beecb2546ecf076f64 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm dfe4e452d8d0a0a8ff0994e514353b3f SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm 48b45d14724e852810de130864ab8281 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm 22ca23ed06739effc887370bfef2d83e SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm fc9cd0970c15246599f90ce1f5955f29 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm 6cdf2e5c3a9a25ca98f8916de677cb70 SuSE-6.0 Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on the i386 Intel Platform. AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm 84014e0f19e52a09b90897e18d8eb774 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm 99df556319e0c232d78cdb69d5d28ac0 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm 2e2a8f6c3c6838a7fd49bd7926fc3de3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm 9b0c2e8469f597f43010a125af8f54fe SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm 0194fc4461ef902c46b75f28fa8f2ef6 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm dffa2d911f6dae9092301bd8ad4f026f SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm ebd233233829eef3d73db7d0a828c35a source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm 582e7985719d3f7da86a77349aa1611d PPC Power PC Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm b9354106b0b89edf8f1883b2ea50e656 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm 534d84e900c6edf3fa8f2ef546d08c0a SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm 5c3a00ebd3ddb0388e460673bfec88d0 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm 418ae09b44885199f4a4403748b6ab2b Sparc Platform: Due to build bottlenecks, the update package for the sparc platform (SuSE-7.0 distribution) is delayed. ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: SuSE distributions contain the bind nameserver in Version 4 as well. bind-4.x in the currently used version has security-related bugs, some of which are similar to the ones in the 8.x versions. We will provide update packages as well as an announcement for the bind (not bind8) package shortly, along with an own announcement. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Roman Drahtmüller. - - -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOndmjXey5gA9JdPZAQGwCwf/U0uWMe9nA8sQmu9C2scFsK5MYpNT0rgu uEUnChBznoc7FzeeWt2I1sube0DiVx5qcZDY4M7u0/BK4VJCacZIHFgWpye1GseP RU8bKhsUiujoplyiWb0Fm39AoKa5HGvAAdRFDNuMC7vt8FtKZic6JGm76MOlqVoD a0hXd6E0Jr55juGxZ5eQqpKWPAR+EjUjEE+R79LQMG8K5FWKHqfwgO2tMNUASaj9 VDkdSTkZS2DX8JIoII6s4g9ksYS0gJds1zivfFdj0fVYcHzwPEvn/ZUv/Mukf2/b MMDFIaTSGM/G751wRD7sYUhcJ5hxJ8qulsdMvLO8nBorh7IjMZSJrw== =zKPn -----END PGP SIGNATURE-----

1 0

Re: [suse-security] CERT Advisory CA-2001-02 Multiple Vulnerabilities in BIND (fwd)
by Volker Kuhlmann 31 Jan '01

31 Jan '01

> use bind 9 with --disable-threads. Design decisions of the ext2 > filesystem prohibit the use of Linux on systems that need some level > of integrity. Hm. Could you elaborate please? > Some time ago a couple of lawyers I would call friends put together > a 200 page document about the BSD vs. GPL vs. DJB licences, > probably I could dig it out. Yes please!! Volker

2 1