January 2001 - openSUSE Security - openSUSE Mailing Lists

RE: Hardening network by setting priorities
by Andreas Achtzehn 26 Jan '01

26 Jan '01

> From: Thomas Schuette [mailto:tgs@schuetteweb.de] > I think I can switch to Deutsch, ist ein wenig einfacher ;) > Meinst Du evtl. die TOS Bits? > > # Optimize your TCP/UDP connections by setting IP Options! > # -t 0x01 0x08 == best throughput > # -t 0x01 0x10 == fastest transmission > # -t 0x01 0x14 == most reliable trasmission > Hallo Thomas! Das ist ja schon die halbe Miete, danke erstmal, aber hast du eine Idee, wo ich eine gute Doku dazu herkriege? Andreas

3 4

pptp and ppp errors
by klg1＠gmx.de 26 Jan '01

26 Jan '01

Hello, I want to set up a VPN to connect from my mobile computer (Win98) via dialup (ISP) to my office (SuSe 6.4, FW). First I tried to set up a FreeSwan tunnel - which is no problem on the Linux Server side - but I could not find a free client for Win98. I downloaded FreePGP 6.51 from Computer Associates but a tunnel can only be established with the commercial versions. Does anybody know of a free client for Win98 which can be used for setting up a "road warrior"? Second thing i tried is to deal with the Linux PPtP Server. I set up things according to the man pages of PPtP (PPtPd is listening to the nic connected to the internet and is aware of incoming calls) but I am not able to finish connecting to the server. /var/log/messages reports my ppp establishing a connection to a serial port ppp0 <-> pts0 instead of eth0 and therefore all LCP pakets are gone. Another problem occurs if I enable Data encryption in /etc/ppp/options: if I enable mschap, mschap-v2, mppe40 or mppe128 pppd reports an error - unknown option - and dies although these options are mentioned in the man pages (pppd version 2.3.11) and in the HowTos. As the SuSE readme shows up those options and the docs (even at the LDP) does not mention about the above problems I don't know whats going wrong. Is there anybody who has a working setup, or knows what I am doing wrong? Thanks a million for any help Klaus -- Sent through GMX FreeMail - http://www.gmx.net -- Sent through GMX FreeMail - http://www.gmx.net

1 0

Why is this mail routed to me?
by Thorsten Marquardt 25 Jan '01

25 Jan '01

Hi, sometimes I get email which is addressed to different people. Here is a header of one of this mails: >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 Return-Path: <receipt(a)toushi-radar.co.jp> Received: from www.text-team.de ([212.6.91.187]) by mail.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with ESMTP \ id f0O8tL330264 for <thom(a)proxy.text-team.de>; Wed, 24 Jan 2001 09:55:21 +0100 X-Authentication-Warning: mail.text-team.de: Host [212.6.91.187] claimed to be \ www.text-team.de Received: from www.amcc.com.cn ([202.102.193.110]) by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP id \ f0O8sWl19488 for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 X-Authentication-Warning: www.text-team.de: Host [202.102.193.110] claimed to \ be www.amcc.com.cn Received: (qmail 11375 invoked by uid 101); 19 Jan 2001 04:55:23 -0000 Received: from unknown (HELO toushi-radar.co.jp) (unknown) by unknown with SMTP; 19 Jan 2001 04:55:23 -0000 Message-ID: <00006e2e3a77$00006cd5$00007aa6(a)toushi-radar.co.jp> To: <admin(a)moreprofitinfo.or.kr> From: receipt(a)toushi-radar.co.jp Subject: Can You Ever Have enough Money? 31398 Date: Thu, 18 Jan 2001 19:32:01 -0800 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Priority: 3 X-MSMail-Priority: Normal and here is the associated part from /var/log/mail Jan 24 09:55:21 mail sendmail[30264]: f0O8tL330264: Authentication-Warning: \ mail.text-team.de: Host [212.6.91.187] claimed to be www.text-team.de Jan 24 09:55:32 mail sendmail[30264]: f0O8tL330264: from=<receipt@toushi-rad\ ar.co.jp>, size=6867, class=0, nrcpts=1, msgid=<00006e2e3a77$00006cd5$00007a\ a6(a)toushi-radar.co.jp>, proto=ESMTP, daemon=MTA, relay=[212.6.91.187] Jan 24 09:55:32 mail sendmail[30265]: f0O8tL330264: to=<thom(a)proxy.text-team.\ de>, delay=00:00:11, xdelay=00:00:00, mailer=local, pri=36020, dsn=2.0.0, \ stat=Sent Needless to say that I don't know neither the sender nor the receipent. Do I have an missconfiguerd sendmail? Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] Export
by Eilert Brinkmann 25 Jan '01

25 Jan '01

Jussi Jääskeläinen wrote: > I just upgrade from Suse 6.2 --> 7.0 > I have exported: > > /home 120.100.100.0/24 (rw,no_root_squash) ^^^ There should be no spaces between the hostname/address and the corresponding options in /etc/exports. > now when NFS-server is updated... Some how machines who mounts that > resource are NOT handeled as ROOT-users anymore... Remove the extraneous space in /etc/exports and execute `rcnfsserver reload` on the NFS server. Probably this will fix your problem. Eilert P.S. I assume you are aware that this configuration can be a security problem ;-) -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eilert Brinkmann -- Universitaet Bremen -- FB 3, Informatik eilert(a)informatik.uni-bremen.de - eilert(a)tzi.org - eilert(a)linuxfreak.com http://www.informatik.uni-bremen.de/~eilert/

1 0

more problems: Masq'ing pptp
by Kevin Creason 25 Jan '01

25 Jan '01

I've patched my suSE 6.4 kernel (2.2.14), recompiled with the settings from the website at bottom. In YaST I've given the ip address of {SERVER-IP} to FW_TRUSTED_NETS, and ports 500, 1723 and 65535 to SERVICES_TRUSTED_TCP & UDP. I added the 65535 port after these errors, but still no go. I'm trying to use Microsoft's VPN (pptp) through my SuSE firewall to the server on the other end. The server on the other end is working for other non protected clients. I don't think I need masq_gre, but it it is going in for some reason. What did I do wrong? How do I enable proto 47? Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {INTERNAL-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-ip}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18380 F=0x0000 T=105 (#142) Jan 24 19:05:38 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18381 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18382 F=0x0000 T=105 (#142) Jan 24 19:05:42 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18383 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18384 F=0x0000 T=105 (#142) Jan 24 19:05:46 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18385 F=0x0000 T=105 (#142) Jan 24 19:05:50 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18386 F=0x0000 T=105 (#142) Jan 24 19:05:51 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18387 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: ip_masq_gre(): {CLIENTHOST-IP} -> {SERVER-IP} CID=C3E7 VER=1 PROTO=880B Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=57 S=0x00 I=18388 F=0x0000 T=105 (#142) Jan 24 19:05:54 {MY-SRVR-HOSTNM} kernel: Packet log: input DENY ppp0 PROTO=47 {SERVER-IP}:65535 {ISP-ASSIGNED-IP}:65535 L=89 S=0x00 I=18389 F=0x0000 T=105 (#142) Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): {ISP-ASSIGNED-IP} -> {SERVER-IP} LEN=16 TY=1 MC=1A2B3C4D CTL=CALL_DISCONNECT_NOTIFY Jan 24 19:05:58 {MY-SRVR-HOSTNM} kernel: ip_masq_pptp_tcp(): CALL_DISCONNECT_NOTIFY, CID=8000 > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/ip_masq_vpn.html > ftp://ftp.rubyriver.com/pub/jhardin/masquerade/VPN-howto/VPN-Masquerade-2.ht > ml > http://members.home.net/ipmasq/ Trim replies as much as needed- natch. Thanks in advance.

1 0

Hardening network by setting priorities
by Andreas Achtzehn 24 Jan '01

24 Jan '01

Hello security-list! I'd like to implement the following: To avoid DDoS-attacks I'd like to set priorities for certain network-services. I once read an article on securityfocus.com about how to for example set up that http-traffic is more important than DNS-traffic. It's possible using the ipchains. But unfortunately I can't find that article anymore where this is explained. So I hope for your assistance with this problem. Does anyone have a good description on how to set priorities? Thanks in advance, A. Achtzehn -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM/IT/P d@ s: !a C++(+) UL++++$ P++ L+++(++++)@ E---- W+++ N+ o? K? w O- M- V- PS PE- Y+ PGP++ t+ 5 X+ R* tv+ b++ DI? D-- G> e@> h!> ------END GEEK CODE BLOCK------ See http://www.ebb.org/ungeek/ on details.

2 1

Re: [suse-security] Update
by r.maurizzi＠gvs.it 24 Jan '01

24 Jan '01

> I have got a old box which was running suse 5.x and has ( last night ) been > upgraded to Suse7 All went very well despite a few silly things. However > something odd is now happening... if I telnet to the box it only asks for a > username at logon rather than username and a password ? > Any ideas ? Only a guess, but I had a similar problem upgrading and old RedHat, enabling shadow passwords in the process. Changing every user passwords by hand solved the problem (since a utility to do so was useful only to obtain a tight CPU loop ;_;). Chech to see if /etc/passwd and /etc/shadows contain "sane" values. Ciao, Roberto.

2 1

dhcpd with iptables
by Fritz Ganter 24 Jan '01

24 Jan '01

Hello! I have the problem that I can not access the dhcp server which is running on the firewall(yes I now). :-) I can send the configuration with email. The dhcp server listen on the internal interface, if I switch of the firewall all works fine. Remember, its iptables, it worked also with the ipchains based SuSEFirewall script. Fritz -- Fritz "der mit dem Linux tanzt" Ganter ganter(a)ganter.at Linux Consulting & Training http://www.linuxexperts.at Graz for you - der Grazer Stadtserver http://www.grazforyou.at A-8010 Graz, Liebiggasse 19/3/14 Tel. +43 (0)699 110 21 621

1 0

Re: [suse-security] Why is this mail routed to me?
by Thorsten Marquardt 24 Jan '01

24 Jan '01

Hi, Peter wrote: > > Thorsten Marquardt: > > Hi, > > sometimes I get email which is addressed to different people. Here is > > a header of one of this mails: > > >From receipt(a)toushi-radar.co.jp Wed Jan 24 09:55:32 2001 > > Received: from www.amcc.com.cn ([202.102.193.110]) > > by www.text-team.de (8.10.2/8.10.2/SuSE Linux 8.10.0-0.3) with SMTP > > id \ f0O8sWl19488 > > for <thom(a)www.text-team.de>; Wed, 24 Jan 2001 09:54:33 +0100 > > Looks like he has you in the BCC-field. Is there a chance to block such mail? There is na need to have me on on a Bcc list. Some of those mails apear to be commercials. > > I guess your account is <thom(a)www.text-team.de>? Upps Sorry. I forgott. That correct. Sendmail is working fine so far but I don't like this noise in my mailbox. Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0

Update
by Paul Carruthers 24 Jan '01

24 Jan '01

I have got a old box which was running suse 5.x and has ( last night ) been upgraded to Suse7 All went very well despite a few silly things. However something odd is now happening... if I telnet to the box it only asks for a username at logon rather than username and a password ? Any ideas ? Paul Carruthers Systems Administrator Avellino Technologies Voice +44 (0) 118 940 7600 Fax +44 (0) 118 940 7699 Http://www.avellino.com/

2 1