October 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] ssh idle?
by Marios Marti 20 Oct '01

20 Oct '01

I have disabled all the green funcions but that doesnt seem to be making much difference since i still get the same problem. So i was thinking whether unistalling the apmd package would help or another alternative is to give the network card a task to keep itself busy so that it wont shutdown. Thanks. >From: "Kurt Seifried" <listuser(a)seifried.org> >Reply-To: "Kurt Seifried" <listuser(a)seifried.org> >To: "dove" <dove(a)freemail.absa.co.za>, <suse-security(a)suse.com> >Subject: Re: [suse-security] ssh idle? >Date: Thu, 18 Oct 2001 13:55:52 -0600 > > > just a thought, > > have you looked at the cmos setup for "green" functions ? > >Good suggestion, if the board is set to go to sleep, but wake on lan >activity that could do it (and since it takes the bvox time to wake up the >first few would fail and then it would work). Other issues, there seem to >be >a lot of collisions (472). There shouldn't be collisions. You might want to >look at why so many collisions are occuring. > > > hope this helps, > > > > dove > >Kurt Seifried, kurt(a)seifried.org >A15B BEE5 B391 B9AD B0EF >AEB0 AD63 0B4E AD56 E574 >http://www.seifried.org/security/ > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

2 1

Arslan
by xcomb xcomb 20 Oct '01

20 Oct '01

Hi everyone! Is there IPTABLES Book i can find and buy? There is Linux Firewall but it's writen for ipchains this is not what i use on my box. Thanks

3 2

Re: [suse-security] changes ipchains - iptables
by Hoehne_Peter＠t-online.de 19 Oct '01

19 Oct '01

'tschuldigung, ich vergass: eth0 = linke Netz = 192.168.100.0/24 eth1 = TDSL = DoD = Internet eth2 = rechte Netz = 192.168.200.0/24 sorry, I've forgotten: eth0 = left net = 192.168.100.0/24 eth1 = TDSL = DoD = Internet eth2 = right net = 192.168.200.0/24 > Hello Liste! > Erst in Deutsch... than follows my rough english )-) > Ich habe ein kleines Skript fuer mein Linux 7.1/7.2 fuer ipchains > gehabt. > Linux als Zugangsserver (ueber ISDN, DoD) fuer mehrere PC in mehreren > Subnetzen. > ==> bischen Routing und Forwarding - viel Maskierung und Filterung. > Das mit dem Port oeffnen und schliessen hab ich nun schon auf iptables > umgestellt (ich hoffe auch richtig). > Ich komme auch von den entfernten PC auf Linux - Linux waehlt auch > raus (jetzt TDSL)... aber es fehlt noch das Maskieren - denn auf dem > PC kommt nichts an! Linux selber kann Internetten.. > Wie ist die richtige Syntax, um mit iptables das Maskieren > einzustellen (siehe ###im alten Skript)? > Ich habs schon mit diversen Tips aus Listen und SMB/netfilter > versucht: > z. B. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > ...aber funzt irgendwie nicht. > Oder wer kann mir "eine" Zeile sagen, mit der ich ohne die weiteren > Filter mit den Subnetzen ins Internet komme? > ...oder moeglichereise das alte Script uebersetzen? > mein altes Skript steht am Ende... > Danke im Voraus!!! > ******************* > For the ENGLISCH > My script under Linux 7.1/7.2 with ipchains was good. > My Linux was server for internet access with ISDN and dial on demand. > ==> I have to do filtering - routing - forwarding and masquerading. > To open or close a port with iptables is changed and good (I hope). > My net find Linux - Linux is dialing (now TDSL) an get connected. > But... nothing from the internet reaches my home-net - I must have > masquerading. The Linux-Machine itself can go out to the internet. > What's the syntax for iptables and masquerading (see the old script > ###). > I've tried many tips out of lists... but nothing is right. > e.g. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE > ... but nothing happend. > Or could you tell me "one" line to go with my net without filtering to > the internet? > ... proberly you can completely change my script from ipchains to > iptables? > Thanks! > now the Script: > ***snip*** > #! /bin/bash > . /etc/rc.config > ipchains -F > ipchains -X > case "$1" in > start) > echo -n "Starting Masquerading:" > echo "1" > /proc/sys/net/ipv4/ip_forward > modprobe ip_masq_user > modprobe ip_masq_ftp > ipchains -A input -d 0/0 1025:65535 -p tcp -j ACCEPT > ipchains -A input -d 0/0 1025:65535 -p udp -j ACCEPT > ipchains -A input -d 0/0 http -p tcp -j ACCEPT > ipchains -A input -d 0/0 http -p udp -j ACCEPT > ipchains -A input -d 0/0 https -p tcp -j ACCEPT > ipchains -A input -d 0/0 https -p udp -j ACCEPT > ipchains -A input -d 0/0 smtp -p tcp -j ACCEPT > ipchains -A input -d 0/0 smtp -p udp -j ACCEPT > ipchains -A input -d 0/0 pop3 -p tcp -j ACCEPT > ipchains -A input -d 0/0 pop3 -p udp -j ACCEPT > ipchains -A input -d 0/0 domain -p tcp -j ACCEPT > ipchains -A input -d 0/0 domain -p udp -j ACCEPT > ipchains -A input -d 0/0 ftp-data -p tcp -j ACCEPT > ipchains -A input -d 0/0 ftp-data -p udp -j ACCEPT > ipchains -A input -d 0/0 ftp -p tcp -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ns -p tcp > -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ns -p udp > -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-dgm -p > tcp -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-dgm -p > udp -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ssn -p > tcp -j ACCEPT > ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ssn -p > udp -j ACCEPT > ipchains -A input -d 0/0 -p tcp -j REJECT > ipchains -A input -d 0/0 -p udp -j REJECT > ### ipchains -A forward -s 192.168.66.0/24 -d 0/0 -i ippp0 -j MASQ > echo -e "$rc_done"; > ;; > stop) > echo -n "Stopping Masquerading:" > rmmod ip_masq_user > rmmod ip_masq_ftp > echo "0" > /proc/sys/net/ipv4/ip_forward > echo -e "$rc_done"; > ;; > restart) > /sbin/init.d/masquerading stop > /sbin/init.d/masquerading start > ;; > *) > echo "Usage: masquerading {start|stop}" > exit 1 > ;; > esac > ***end snip*** > - - - - - - - - - - - - - - - - > PHICUS - Peter Hoehne > Informationssysteme URL: http://www.phicus.de > Computer und Software Geschaeft: 0171/4929507 > Steinkamp 48 Fax: 05303/6973 > 38179 Schwuelper Privat: 05303/6852 > Germany E-Mail: <Hoehne_Peter(a)t-online.de> > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com - - - - - - - - - - - - - - - - PHICUS - Peter Hoehne Informationssysteme URL: http://www.phicus.de Computer und Software Geschaeft: 0171/4929507 Steinkamp 48 Fax: 05303/6973 38179 Schwuelper Privat: 05303/6852 Germany E-Mail: <Hoehne_Peter(a)t-online.de>

1 0

changes ipchains - iptables
by Hoehne_Peter＠t-online.de 19 Oct '01

19 Oct '01

Hello Liste! Erst in Deutsch... than follows my rough english )-) Ich habe ein kleines Skript fuer mein Linux 7.1/7.2 fuer ipchains gehabt. Linux als Zugangsserver (ueber ISDN, DoD) fuer mehrere PC in mehreren Subnetzen. ==> bischen Routing und Forwarding - viel Maskierung und Filterung. Das mit dem Port oeffnen und schliessen hab ich nun schon auf iptables umgestellt (ich hoffe auch richtig). Ich komme auch von den entfernten PC auf Linux - Linux waehlt auch raus (jetzt TDSL)... aber es fehlt noch das Maskieren - denn auf dem PC kommt nichts an! Linux selber kann Internetten.. Wie ist die richtige Syntax, um mit iptables das Maskieren einzustellen (siehe ###im alten Skript)? Ich habs schon mit diversen Tips aus Listen und SMB/netfilter versucht: z. B. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE ...aber funzt irgendwie nicht. Oder wer kann mir "eine" Zeile sagen, mit der ich ohne die weiteren Filter mit den Subnetzen ins Internet komme? ...oder moeglichereise das alte Script uebersetzen? mein altes Skript steht am Ende... Danke im Voraus!!! ******************* For the ENGLISCH My script under Linux 7.1/7.2 with ipchains was good. My Linux was server for internet access with ISDN and dial on demand. ==> I have to do filtering - routing - forwarding and masquerading. To open or close a port with iptables is changed and good (I hope). My net find Linux - Linux is dialing (now TDSL) an get connected. But... nothing from the internet reaches my home-net - I must have masquerading. The Linux-Machine itself can go out to the internet. What's the syntax for iptables and masquerading (see the old script ###). I've tried many tips out of lists... but nothing is right. e.g. iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE ... but nothing happend. Or could you tell me "one" line to go with my net without filtering to the internet? ... proberly you can completely change my script from ipchains to iptables? Thanks! now the Script: ***snip*** #! /bin/bash . /etc/rc.config ipchains -F ipchains -X case "$1" in start) echo -n "Starting Masquerading:" echo "1" > /proc/sys/net/ipv4/ip_forward modprobe ip_masq_user modprobe ip_masq_ftp ipchains -A input -d 0/0 1025:65535 -p tcp -j ACCEPT ipchains -A input -d 0/0 1025:65535 -p udp -j ACCEPT ipchains -A input -d 0/0 http -p tcp -j ACCEPT ipchains -A input -d 0/0 http -p udp -j ACCEPT ipchains -A input -d 0/0 https -p tcp -j ACCEPT ipchains -A input -d 0/0 https -p udp -j ACCEPT ipchains -A input -d 0/0 smtp -p tcp -j ACCEPT ipchains -A input -d 0/0 smtp -p udp -j ACCEPT ipchains -A input -d 0/0 pop3 -p tcp -j ACCEPT ipchains -A input -d 0/0 pop3 -p udp -j ACCEPT ipchains -A input -d 0/0 domain -p tcp -j ACCEPT ipchains -A input -d 0/0 domain -p udp -j ACCEPT ipchains -A input -d 0/0 ftp-data -p tcp -j ACCEPT ipchains -A input -d 0/0 ftp-data -p udp -j ACCEPT ipchains -A input -d 0/0 ftp -p tcp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ns -p tcp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ns -p udp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-dgm -p tcp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-dgm -p udp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ssn -p tcp -j ACCEPT ipchains -A input -s 192.168.0.0/24 -d 0/0 netbios-ssn -p udp -j ACCEPT ipchains -A input -d 0/0 -p tcp -j REJECT ipchains -A input -d 0/0 -p udp -j REJECT ### ipchains -A forward -s 192.168.66.0/24 -d 0/0 -i ippp0 -j MASQ echo -e "$rc_done"; ;; stop) echo -n "Stopping Masquerading:" rmmod ip_masq_user rmmod ip_masq_ftp echo "0" > /proc/sys/net/ipv4/ip_forward echo -e "$rc_done"; ;; restart) /sbin/init.d/masquerading stop /sbin/init.d/masquerading start ;; *) echo "Usage: masquerading {start|stop}" exit 1 ;; esac ***end snip*** - - - - - - - - - - - - - - - - PHICUS - Peter Hoehne Informationssysteme URL: http://www.phicus.de Computer und Software Geschaeft: 0171/4929507 Steinkamp 48 Fax: 05303/6973 38179 Schwuelper Privat: 05303/6852 Germany E-Mail: <Hoehne_Peter(a)t-online.de>

1 0

SuSEfirewall2 questions
by Philip Warner 19 Oct '01

19 Oct '01

I am trying to understand SuSEfirewall2, and am a little confused by the rules it has generated. In the sample below, eth0 is internal an has address 203.8.195.164, eth1 is external and has address 61.62.63.64. Confusion #1: ------------- My understanding of the INPUT queue is that only packets routed locally will pass through the queue. So why why base decisions on the target IP address? Why not replace: iptables -A INPUT -j input_ext -i eth1 -d 61.62.63.64 iptables -A INPUT -j input_int -i eth0 -d 203.8.195.164 with iptables -A INPUT -j input_ext -i eth1 iptables -A INPUT -j input_int -i eth0 Confusion #2: ------------- Since a local network packet addressed to either eth0 or eth1 will route to the firewall machine, is this line sufficient to prevent access? iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-ACCESS_DENIED_FOR_INT -i eth0 -d 61.62.63.64 iptables -A INPUT -i eth0 -d 61.62.63.64 -j DROP I would have expected a matching '-i eth0 -d 203.8.195.164' to cover all possible target addresses of the server. Any clarifications would be appreciated.... Thanks, Philip Warner. ------------ debug output ----------- iptables -A INPUT -j ACCEPT -i lo iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED -p udp --sport 67 -d 255.255.255.255/32 --dport 68 iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-DROP-ANTI-SPOOFING -s 127.0.0.0/8 iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-DROP-ANTI-SPOOFING -d 127.0.0.0/8 iptables -A INPUT -j DROP -s 127.0.0.0/8 iptables -A INPUT -j DROP -d 127.0.0.0/8 iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-DROP-ANTI-SPOOFING -s 203.8.195.164 iptables -A INPUT -j DROP -s 203.8.195.164 iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-DROP-ANTI-SPOOFING -s 61.62.63.64 iptables -A INPUT -j DROP -s 61.62.63.64 <Confusing1> iptables -A INPUT -j input_ext -i eth1 -d 61.62.63.64 iptables -A INPUT -j input_int -i eth0 -d 203.8.195.164 </Confusing1> iptables -A INPUT -j DROP -i eth1 -d 61.62.63.255 iptables -A INPUT -j DROP -i eth1 -d 255.255.255.255 iptables -A INPUT -j DROP -i eth0 -d 203.8.195.255 iptables -A INPUT -j DROP -i eth0 -d 255.255.255.255 <Confusing2> iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-ACCESS_DENIED_FOR_INT -i eth0 -d 61.62.63.64 iptables -A INPUT -i eth0 -d 61.62.63.64 -j DROP <Confusing2> iptables -A INPUT -j LOG --log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW-UNALLOWED-TARGET iptables -A INPUT -j DROP ---------------------------------------------------------------- Philip Warner | __---_____ Albatross Consulting Pty. Ltd. |----/ - \ (A.B.N. 75 008 659 498) | /(@) ______---_ Tel: (+61) 0500 83 82 81 | _________ \ Fax: (+61) 0500 83 82 82 | ___________ | Http://www.rhyme.com.au | / \| | --________-- PGP key available upon request, | / and from pgp5.ai.mit.edu:11371 |/

1 0

Security on telnet
by Fiorenza Meini 19 Oct '01

19 Oct '01

Hi there, I installed Linux 7.2 on a machine where I want to have running only sendmail and telnet (I configured inetd). I have a network card with a public IP address, but for security reason I'd like to configure another network card with a local address on which I want telnetd listen to. So, what I'd like to to is this: - sendmail listening on the network card with public IP address - telnet listening on the network card with local IP addess. Is this possible? Any suggestion on how can I configure the system? Thanks Fiorenza

3 4

Re: Re: [suse-security] bind hack ?
by Gero Lindenblatt 19 Oct '01

19 Oct '01

Dear Roman, thanks a lot for your response. I was so worried when i read the other reply on my question. I use bind 9.1.2. I restarted the service once and the port number changed. The next 2 times (within 10 sec)the number did not change. is this normal too ? another question: i thought i might be hacked because i get emails from sex sites with To-adresses like EROTICA(a)[my.server.de] (<- replaced) is this normal ? greets from Gero who can sleep a bit better since yesterday ;) > > I noticed that my name server is listening to a port that i have not expected (like port 80,25,21,110 etc..). > > > > udp 0 0 127.0.0.1:53 0.0.0.0:* 475/named > > udp 0 0 0.0.0:52810 0.0.0.0:* 31475/named > > udp 0 :::53 :::* 31475/named > > > > what is port 52810 ? > > yesterday is was another number like 46xxx... > > > > Am i hacked ? > > Negative. It looks like your bind8 has been restarted since yesterday. > named binds to a port which will be the source port number for the queries > it sends to other nameservers. This port can be configured in > /etc/named.conf (like query-source address 213.68.230.226 port *;), but it > isn't bound to a specific value by default. Each time you restart bind8, > it will use another port. > > Use "tcpdump -nvv udp and port 53" to see these requests with the source > port that you see with "netstat -anp". > _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

Re: [suse-security] Security on telnet
by mario libraro 19 Oct '01

19 Oct '01

Fiorenza Meini wrote: > > Hi there, > I installed Linux 7.2 on a machine where I want to have running only > sendmail and telnet (I configured inetd). > I have a network card with a public IP address, but for security reason I'd > like to configure another network card with a local address on which I want > telnetd listen to. > So, what I'd like to to is this: > - sendmail listening on the network card with public IP address > - telnet listening on the network card with local IP addess. > > Is this possible? > Any suggestion on how can I configure the system? There's the setup you need: 1) In /etc/hosts.allow you define all service you want to access system: for example.. in.telnetd:192.168.0. means that telnetd accepts connections from 192.168.0.1, 192.168.0.2 .. (note the . at the end of address) and, sendmail:ALL means that sendmail daemon accepts connections from all IPs. You can find the daemons names in inetd.conf (in.ftpd, in.pop3d, etc.) 2) In /etc/hosts.deny you define all services you DON'T want to access system. So to exclude ALL that does not match hosts.allow you must put ALL:ALL so a connection from a public address (for examples 195.30...) to telnetd will not match any of the lines in hosts.allow and will be blocked by ALL:ALL in hosts.deny (inetd daemon reads first hosts.allow and after hosts.deny). IMHO you should not use telnetd that is a potentially insecure protocol (all is sent in clear, even passwords!). A packet sniffer in any place of network can log all you send and receive from server. I use sshd (which is NOT a inetd service but a standalone service invoked from /etc/rc.d/sshd) that use a public key crypto communication. There are many commercial or shareware sshd clients for win. I use a freeware one that is very nice: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html -- Mario Libraro Web Applications Developer Fulltrading S.p.A. 00148 Roma - Via Di Affogalasino, 105 tel. +39 06 65 73 170 fax +39 06 65 73 529 mob. +39 347 5205 752 email: m.libraro(a)fulltrading.it m.libraro(a)tiresia.it web: www.fulltrading.it

1 0

SuSEFirewall 2 Installation
by staffgje 19 Oct '01

19 Oct '01

Dear List, I have just installed SuSEFirewall2 on to my SuSe7.2 Pro box, which will be my NAT, Squid and Squidguard filter. I have also set FW2 to yes in the configuration files and set FW to no. However, now when the machine starts up I get a modprobe error regarding a module called 'binfmt-0000'. Being a newbie and running before walking I have no idea what this module is - and why is has happened with Firewall2. If I go back to original firewall it works fine and no error appears. Any help? Either here to to me personally. Many thanks Gareth Edmondson ICT teacher Ysgol Gyfun Gwyr

1 0

Finger Port
by Glenn Hancock 19 Oct '01

19 Oct '01

I am trying to learn Linux and am new to the OS. I have installed with default installation and am now trying to figure a few things out. I want to use the finger server port 79 in order to test some things and then would like to disable it again. I have added necessary information to services, and to inetd.conf related to the man tables. I have rebooted. I can run finger locally but not from another computer on the network directed to my Linux box. I also try to look at processes running and I don't see inetd running. Is there something I have to do in order to get finger and telnet to operate because I haven't been able to find anything in your help files. Thanks, Glenn Hancock

2 1