October 2001 - openSUSE Security - openSUSE Mailing Lists

Portforwarding Problem
by Freddy 15 Oct '01

15 Oct '01

Hi everybody, i am using SuSE 7.2 with SuSEFirewall2 with a DSL-Connection. On a box behind the firewall-box there runs a service. With the following script i want to forward the packets. I start the script after the SuSEFirewall2.final , because the service is none permanent, so i want to start/stop it when i need it without starting/stopping the SuSEWall. ---------------------------------------------------------------------------- ---------------------- #!/bin/sh DEV=ppp0 FW_DEV_EXT=aaa.aaa.aaa.aaa CLIENT_IP=192.168.1.1 #ppppp & qqqqq the ports to forward iptables -t nat -I PREROUTING -d $FW_DEV_EXT -p udp -i $DEV --dport 10000:10010 -j DNAT --to $CLIENT_IP # iptables -t nat -I PREROUTING -p udp -i $DEV --dport 10000:10010 -j DNAT --to $CLIENT_IP (don't work too) # iptables -t nat -A PREROUTING -p udp -i $DEV --dport 10000:10010 -j DNAT --to $CLIENT_IP (don't work too) ---------------------------------------------------------------------------- ---------------------- The packets seem to be forwarded , tcpdump says: ---------------------------------------------------------------------------- ---------------------- 22:59:28.930835 EXTERN_IP.ppppp > FW_DEV_EXT.qqqqq: udp 21 22:59:28.930835 FW_DEV_EXT > EXTERN_IP: icmp: FW_DEV_EXT udp port 10000 unreachable (DF) [tos 0xc0] ---------------------------------------------------------------------------- ---------------------- (EXTERN_IP is the IP form the Client from the internet) An this where i wonder. Is the FW_DEV_EXT ok ? Must this not the CLIENT_IP ? i got no entry in the /var/log/messages that the packets are dropped. This is wat i have in the firewall2.rc.config : FW_PROTECT_FROM_INTERNAL="yes" #(all allowed ports can be reached) FW_AUTOPROTECT_SERVICES="yes" # FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" #(ok , not good , only for testing) # FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" #(ok , not good , only for testing) # FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="www FW_SERVICES_EXT_IP="" # FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # FW_SERVICES_INT_TCP="22 25 53 3128" FW_SERVICES_INT_UDP="22 53" FW_SERVICES_INT_IP="" # FW_KERNEL_SECURITY="yes" Did i forgot a module or some settings ? Do you need more info (logs/settings)? Let me know. Thx for help and infos kind regards freddy

1 0

pam_smb
by Ian Simmons 15 Oct '01

15 Oct '01

I'm trying to set up pam_smb to get several SuSE 6.4 and 7.0 Linux machines to authenticate passwords to a single SuSE 6.4 box. I configured the /etc/pam_smb.conf file with the NT domain and server name which I wish to authenticate to, as follows: REHAB CRTSUN I then went into the /etc/pam.d/login file and added the line: auth required /lib/security/pam_smb_auth.so nolocal I made sure that the /lib/security/pam_smb_auth.so file does exist, however, I'm still unable to authenticate to either the SuSE machine or an NT machine. Any suggestions? Is there something that needs to be changed on the host machine to allow authentication against itself? All help is appreciated. Thanks! Ian Simmons Computer Services Specialist II Center for Assistive Technologies and Environmental Access Georgia Institute of Technology 404.385.2613

1 0

problems with ssh port forwarding
by stefan.wurz 15 Oct '01

15 Oct '01

hi list ! i have a problem with port forwarding ! i have a lan with ip range 10.1.1.xxx and a suse firewall who connect the lan to the internet with masquarading in the lan there is a host with a oracle db ! and my problem is wenn i connect with ssh to the firewall and forward the port 1521 to the database-host i get no response from the database ! but wenn i connect me from the internal lan to the external port of the firewall and forward the 1521 port i get this response ! i think the probelem is the multiple ports of the database ! i see an the firewall log the database will connect to the firewall. can you help me please ! thx stefan

1 0

Doubts about "SuSE-FW-on-CD"
by Jacobo González Simón 15 Oct '01

15 Oct '01

Hi: I'm reading the (poor) documentation about this (excelent) idea called "SuSE FireWall on CD" but before my company buy it i need to resolv some doubts: - With a single (or central) FAS can i configure rulesets for a lot of firewalls? (I hope to install it over a lot of clients) - Security are based on ipchains or iptables? - Can firewall has three (or more) networks cards? - Are there any HTML or PDF files with full explanation of the software? Where? I hope that you understand that prior to pay "1150 Eur" i need to solve this doubts. Thanks in advance.

2 3

Switching FW-Configs
by Freddy 15 Oct '01

15 Oct '01

Hi everybody, first of all i am new here ( and new 2 iptables ) , so greetings to all. ( and sorry for my bad english ) I am using SuSE 7.2 with SuSEFirewall2. All seems working well. WWW in/out , FTP in/out , masquarading etc.. Is there any kind of switching the firewall-configuration without editing the firewall2.rc.config ? I mean something like that firewall.sh www [start|stop] firewall.sh www ftp [start|stop] firewall.sh www ftp_behind_fw [start|stop] Under kernel 2.2.x with ipchains and ipmasqadm i have used scripts like that server.sh [start|stop] clientip to forward packets to a box behind the firewall. I changend the scripts to work with iptables, the box behind the firewall can be reached from the outside, but the firewall seems to bolck the answerpackets. tcpdump says something like (sorry , at the moment i don't have any logs, erased them :-( ) remoteip > localip (behind the fw) localip > remoteip : port can't be reached Here is templatescript where i can open/close ports with portforwarding : #!/bin/bash IPT="/usr/sbin/iptables" CLIENT=$2 DEV=ppp0 if [ $# -lt 2 ]; then echo "Client IP missing" exit 1 fi case $1 in start) # Some-Server $IPT -t nat -A PREROUTING -p udp -i $DEV --dport aaaaa:bbbbb -j DNAT --to $CLIENT ;; stop) $IPT -t nat -D PREROUTING -p udp -i $DEV --dport aaaa:bbbb -j DNAT --to $CLIENT ;; esac exit 0 the ipchains-script with ipmasqadm portfw/autofw under kernel 2.2.x is working. Ok , here some infos from the firewall2.rc.config FW_PROTECT_FROM_INTERNAL="yes" (all allowed ports can be reached) FW_AUTOPROTECT_SERVICES="yes" # FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" (ok , not good , only for testing) # FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" (ok , not good , only for testing) # FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="www FW_SERVICES_EXT_IP="" # FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # FW_SERVICES_INT_TCP="22 25 53 3128" FW_SERVICES_INT_UDP="22 53" FW_SERVICES_INT_IP="" # FW_KERNEL_SECURITY="yes" Thx for any hints and infos Greetings freddy

1 0

problems with trusted net on suse firewall 2 v1.7
by Battisti Markus 15 Oct '01

15 Oct '01

hi i have a suse 7.2 with firewall 2 v1.7 and freeswan on it 2 network interfaces one is a privat net the other internet i want a samba on the firewall who is only accessable from the privat net (duuh) ok so on ipsec tunnels between 10.1.0.0/16 (office) and 10.5.0.0/16 (remote office 3 user) trusted net is 10.1.0.0/16 i get always this message without firewall all works perfect ... but without firewall! 10.1.10.23 is an w2k who wants to 10.5.9.104 who ist the samba on firewall Oct 15 13:58:19 salzburgtunnel kernel: SuSE-FW-UNALLOWED-TARGETIN=ipsec0 OUT= MA C=00:02:b3:1a:63:df:00:02:b3:2c:6c:16:08:00 SRC=10.1.10.23 DST=10.5.9.104 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=25021 PROTO=TCP SPT=1523 DPT=445 WINDOW=16384 RES =0x00 SYN URGP=0 OPT (020405B401010402) Oct 15 13:58:25 salzburgtunnel kernel: SuSE-FW-UNALLOWED-TARGETIN=ipsec0 OUT= MA C=00:02:b3:1a:63:df:00:02:b3:2c:6c:16:08:00 SRC=10.1.10.23 DST=10.5.9.104 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=25023 PROTO=TCP SPT=1524 DPT=139 WINDOW=16384 RES =0x00 SYN URGP=0 OPT (020405B401010402) Oct 15 13:58:25 salzburgtunnel kernel: SuSE-FW-UNALLOWED-TARGETIN=ipsec0 OUT= MA C=00:02:b3:1a:63:df:00:02:b3:2c:6c:16:08:00 SRC=10.1.10.23 DST=10.5.9.104 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=25024 PROTO=TCP SPT=1523 DPT=445 WINDOW=16384 RES =0x00 SYN URGP=0 OPT (020405B401010402) FW_DEV_EXT="eth1 ipsec0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth1" FW_MASQ_NETS="10.5.0.0/16" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="22 500 123" FW_SERVICES_EXT_UDP="22 500 123" FW_SERVICES_EXT_IP="50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="1:65535" FW_SERVICES_INT_UDP="1:65535" FW_SERVICES_INT_IP="50 51" FW_TRUSTED_NETS="10.1.0.0/16" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="10.5.0.0/16,10.1.0.0/16 10.1.0.0/16,10.5.0.0/16" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" /"\ ,,, \ / ASCII Ribbon Campain /'^'\ X Against HTML Mail ( o o ) / \ oOOO--(_)--OOOo---------------------- Very funny Scotty. And now beam down my clothes. Mit Freundlichen Grüssen/Best Regards proTask Consulting mailto:markus.battisti@protask.cc

1 0

email wierdness.
by elfed lewis 15 Oct '01

15 Oct '01

I got this message today (names have been changed to protect the innocent!). Is it saying i'm blacklisted, or the host i'm emailing to is blacklisted? ----------email------------------- from localhost ----- The following addresses had permanent fatal errors ----- (email i'm mailing to) (expanded from: (their local alias name)) ----- Transcript of session follows ----- ... while talking to mail-in.pol.net.uk.:(email i'm mailing to) >>> RCPT To: <<< 550- <<< 550 mail from (my emailer ip address) rejected: administrative prohibition (host is blacklisted) 550 (email i'm mailing to)... User unknown ----------email-------------------

7 7

NIMDA
by abaesche＠worklab.de 15 Oct '01

15 Oct '01

Hi all! I have a Problem with the Iptabels Firewall. The Nimda-Worm has infected our NT Servers and I tried to block the Worm with our iptables Firewall. IPTABLES -I INPUT -p tcp --dport 80 -m string --string cmd.exe -m state --state ESTABLISHED -j REJECT --reject-with tcp-reset But I get this message: Couldn´t load match string:/usr/lib/iptables/libipt_string.so What could I do? Armin

1 0

Strange logs
by spiekey 15 Oct '01

15 Oct '01

Hello! I keep getting that entry in my /var/log/messages su: (to nobody) root on none and PAM-unix2[9816]: session finished for user nobody, service su What does it stand for, do i have to worry about it? Thanks Spiekey

2 1

Still dealing with Nimda
by Michelangelo van Dam 15 Oct '01

15 Oct '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear people, We're almost a whole month later and I still get this annoying Nimda stuff in my webserver-logs. They all come from within the usernetwork of my ISP, but after mailing this instance a couple of times for complaining about this, I received their Users Licence Agreement stating that's not allowed to run any servers at all. But since I'm developing webbased tools for a personal project I need to have this webserver up and running for the outside world to visit, even people from within my ISP's usernetwork. Is there a way to block this incoming traffic at my firewall (without putting these IP addresses on a BlackList since they only last for about 36 hours)? Or are there any other solutions (like the Apache::CodeRed module but then for Nimda)??? I'm not willing to pay full licences at my ISP before this project reaches it's productive launch. I'm using S.u.S.E. Linux 2.7 with kernel 2.2.19, Apache Webserver 1.3.22 with mod_perl only (No PHP) on a P-75 580MB HDD and 80MB RAM. Yours sincerely, Michelangelo van Dam - -- Devoted is he, who configures sendmail without the book (unknown) -- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1e-SuSE (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE7yiv9cExHpthAaugRAmxzAJ9DkNrf3hWnzk6XDHkaNujLfYxiRgCgsx7B kgwviIImeFuJvVV0OHm+JR8= =bveg -----END PGP SIGNATURE-----

2 1