October 2001 - openSUSE Security - openSUSE Mailing Lists

What is it? Intrussion?
by Luis José Fabbiani B. (SOPORTE) 02 Oct '01

02 Oct '01

Hi All, in my log file i found the following message: Oct 2 09:30:21 myserver sendmail[1577]: f929TAA01562: Truncated MIME Content-Type header due to field size (possible attack) Is that a possible intrussion or attack? What mean that? Thanks advanced. LJ

2 1

RE: RV: [suse-security] my configuration - ftp is not working
by Roger Rossell 02 Oct '01

02 Oct '01

oh sorry... i just forgot to load a module ip_nat_ftp or something like that.. -----Mensaje original----- De: Steffen Dettmer [mailto:steffen@dett.de] Enviado el: lunes, 01 de octubre de 2001 12:20 Para: Roger Rossell Asunto: Re: RV: [suse-security] my configuration - ftp is not working * Roger Rossell wrote on Mon, Oct 01, 2001 at 10:45 +0200: > > i'm surprised noone has answered my question... > well i've found it myselve... I'm surprised that you hasn't answered the question, too, or is the solution a secret :) ? If you sent such a mail back to the list, you should at least give a hint about the solution I think... oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

1 0

RE: [suse-security] restricting user commands
by José Luis Ledesma 02 Oct '01

02 Oct '01

in rbash try: echo `</etc/passwd` :) -----Original Message----- From: Steffen Dettmer [mailto:steffen@dett.de] Sent: martes 2 de octubre de 2001 13:07 To: suse-security(a)suse.com Subject: Re: [suse-security] restricting user commands * Kurt Seifried wrote on Mon, Oct 01, 2001 at 04:12 -0600: > you can chgrp binaries and remove a user's permission to run > them. Of course they can install their own binaries. This can be prevented by disallowing write access to the $PATH and protecting $PATH via rbash (same as bash --restricted) > Mounting /home noexec won't work either. at least as long as the dyna linker is runnable :) > You can try something like restricted shell, just make sure the > user can't chsh to something else. As for bash and --restricted > that's kind of useless (as someone mentioned you just need to > spawn another bash). No, this can be prevented. The rbash is designed to work, those people are not such silly :) But it's non-trivial to set up. If the user is not allowed to launch /bin/bash, then take of that path of the $PATH. Use /home/bin or so. Of course drop rbash to /home/bin only. Be really carefull with the tools. Do not allow any complex thing (no ftp and so). Only cat and such things. No perl, no awk and so on. Well, finally you must ask if there are tools left to work with :) * Ray Dillinger wrote on Mon, Oct 01, 2001 at 11:01 -0700: > That works, but it only stops honest users. A dishonest user > will just put equivalent commands in his/her own /bin directory See bash man page. The user cannot launch own binaries: steffen@dx:~ > rbash steffen@dx:~ > ./x.pl rbash: ./x.pl: restricted: cannot specify `/' in command names steffen@dx:~ > export PATH=. rbash: PATH: readonly variable steffen@dx:~ > cd .. rbash: cd: restricted But of course, you have to set up it correctly like all other things. I set up such an environment, but users cannot do much useful things... :) > and ignore the fact that s/he is denied access to the ones > everyone else uses. But not with rbash :) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] IPSEC - WIN2000
by Denis Gassilloud 02 Oct '01

02 Oct '01

"Reckhard, Tobias" wrote: > > > > The only IPSec implementation that we tested on W2K was its native IPSec > > > support. Which, basically, didn't work. W2K professional doesn't support > > > tunnel mode > > -snip- > be a patch to FreeS/WAN to make it ignore that bit), since the use of W2K > Server on the road warriors was out of the question. > Hello, we have done some tests running SSH Sentinel 1.2 on a W2K road warrior, it works pretty _good_ with freeSwan 1.9 from SuSE 7.2, including X.509 certs from openssh. BUT freeSwan is broken on 7.2, and you need to install the patch from http://www.suse.de/~garloff/linux/FreeSWAN/ or recompile ipsec by yourself. AND the Sentinel docs need some updates for freeSwan. You might have given a look at the freeSwan mailing list too. Cheers, -- Denis.

1 0

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

RE: [suse-security] IPSEC - WIN2000
by Reckhard, Tobias 01 Oct '01

01 Oct '01

> > The only IPSec implementation that we tested on W2K was its native IPSec > > support. Which, basically, didn't work. W2K professional doesn't support > > tunnel mode > > Are you really sure about that? I know that the configuration > with that MMC console is pretty mad [there are people who need a > GUI - but I think that GUI is too confusing]. I made a simple > interop. test with W2K/freeswan (W2K as road warrior connecting > to secured networks behind a VPN gw) which worked. > Yes, I am sure. A W2K *Professional* road warrior connecting to a FreeS/WAN gateway wouldn't work. The MMC has a panel in which you can specify that the respective connection is to a tunnel endpoint and define that tunnel endpoint, though. However, if you use this panel you effectively silence the interface completely. With W2K Server, this was not the case, but we ran into the problem with the commit bit. We didn't stick around to try to correct that (there appears to be a patch to FreeS/WAN to make it ignore that bit), since the use of W2K Server on the road warriors was out of the question. Cheers Tobias

1 0

RE: [suse-security] IPSEC - WIN2000
by Reckhard, Tobias 01 Oct '01

01 Oct '01

This is a late reply, but it may be interesting to some people nevertheless. > We are using IPSEC (on SuSE 7.0) already for a VPN to another location of > our company. I would like to setup the IPSEC gateway also to handle road > warriors which are using Win2000 machines. > > I read that > - PGPnet is not available for Win2000 > - version 1.4 of IPSEC (which is on the 7.0 distribution) should be > patched > to work with PGPnet. > Are both statements correct? > PGPnet is available for W2K. There appear to have been bugs in previous versions, but PGP 7.1 is reported to be fixed. We're using it to connect to FreeS/WAN on SuSE 7.2 in our lab successfully (at least partially). I don't know about FreeS/WAN 1.4, though. > Does anyone have experiences with other ipsec clients than PGPnet for > Win2000? > Which are available for Win2000? > Which are recommended for Win2000? > The only IPSec implementation that we tested on W2K was its native IPSec support. Which, basically, didn't work. W2K professional doesn't support tunnel mode and W2K IPSec insists on setting the commit bit in part of the IKE negotiation. It may work without IKE and there's a patch for FreeS/WAN to ignore the commit bit instead of refusing to continue, but we needed tunnel mode and the W2K professional release, so we dumped native W2K IPSec and continued with PGPNet. Cheers Tobias

2 1

RV: [suse-security] my configuration - ftp is not working
by Roger Rossell 01 Oct '01

01 Oct '01

i'm surprised noone has answered my question... well i've found it myselve... see'ya -----Mensaje original----- De: Roger Rossell [mailto:roger@grupids.com] Enviado el: jueves, 27 de septiembre de 2001 18:19 Para: suse-security(a)suse.com Asunto: [suse-security] my configuration - ftp is not working Here is my configuration script. Ftp clients from my lan (specified in table "ids") can not retreive file lists from ftp servers can you help me please??? # FIREWALL DE IDS # echo "***** Ejecutando Firewall... ********************" # CARGA DE MODULOS modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptable_nat # variables LAN_IDS="172.16.0.0/255.255.0.0" LAN_DMZ="192.168.0.0/255.255.255.0" ANYIP="0/0" IP_LAN="172.16.100.100" IP_PUB="217.149.0.xx0" IP_DMZ="192.168.0.1" INT_LAN="eth0" INT_PUB="eth1" INT_DMZ="eth2" UNPRIVPORTS="1024:65535" #ortografia: DMZWEB_num-servidor_num-ip-virtual DMZWEB_0_0="192.168.0.100" DMZWEB_0_1="192.168.0.101" DMZWEB_1_0="192.168.0.200" PUBLIC_DMZWEB_0_0="217.149.0.xx1" PUBLIC_DMZWEB_0_1="217.149.0.xx2" PUBLIC_DMZWEB_1_0="217.149.0.xx5" DNS1="217.149.0.10" DNS2="217.149.0.11" # Añadir ip's publicas virtuales ip address add $PUBLIC_DMZWEB_0_0 dev $INT_PUB ip address add $PUBLIC_DMZWEB_0_1 dev $INT_PUB ip address add $PUBLIC_DMZWEB_1_0 dev $INT_PUB # CLEAR IPTABLES iptables -F iptables -X iptables -Z iptables -t nat -F # aciva el proxy arp para la dmz y para la lan #echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp #echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp # activa el forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # proteccion anti spoofing for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done #*/# #proteccion TCP SYN Cookie echo 1 > /proc/sys/net/ipv4/tcp_syncookies #activa el always defrag #echo 1 > /proc/sys/net/ipv4/ip_always_defrag #proteccion echo broadcast #echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_bogus_error_broadcasts #desactiva aceptacion de redireccon icmp for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done #*/# #deshabilita los paquetes SRP (Source Route) for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done #*/# #registra los spoofed packets, source routed packets, redirect packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done #*/# # Politica por defecto echo "Configurando políticas por defecto" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Crear nuevas tablas echo "Creando nuevas tablas" iptables -N dmz iptables -N ids iptables -N loopback #iptables -N lan_dmz echo "Relacionando nuevas tablas" iptables -A FORWARD -s $ANYIP -d $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_IDS -d $ANYIP -j ids iptables -A FORWARD -s $ANYIP -d $LAN_IDS -j ids iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback #iptables -A lan_dmz -j ACCEPT #iptables -A lan_dmz -j LOG --log-prefix "#lan-dmz##" # Logs generales echo "Activando logs" #iptables -A INPUT -j LOG --log-prefix "##IN## " #iptables -A OUTPUT -j LOG --log-prefix "##OUT## " #iptables -A FORWARD -j LOG --log-prefix "##FWD## " # NAT echo "Configurando NAT..." iptables -t nat -A POSTROUTING -o $INT_PUB -j MASQUERADE #iptables -t nat -A POSTROUTING -j LOG --log-prefix "##NATpost##" #PORT FORWARDING - NAT IN echo "Configurando PNAT ..." #transparent proxy # # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.10:80 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_0 -j DNAT --to-destination $DMZWEB_0_0 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_1 -j DNAT --to-destination $DMZWEB_0_1 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_1_0 -j DNAT --to-destination $DMZWEB_1_0 #iptables -t nat -A PREROUTING -j LOG --log-prefix "##NATpre##" #SERVICIOS PERMITIDOS LAN - FUERA echo "Permisos de salida desde ids_lan..." #tcp iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 23 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 25 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 80 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 110 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 137 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 443 -j ACCEPT iptables -A ids -p tcp -s $ANYIP --dport $UNPRIVPORTS -j ACCEPT #icmp iptables -A ids -p icmp -j ACCEPT #udp iptables -A ids -p udp -s $LAN_IDS -d $DNS1 --dport 53 -j ACCEPT iptables -A ids -p udp -s $LAN_IDS -d $DNS2 --dport 53 -j ACCEPT iptables -A ids -p udp -s $DNS1 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT iptables -A ids -p udp -s $DNS2 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A ids -j LOG --log-prefix "##DENY ids##" iptables -A ids -j DROP # LOOPBACK iptables -A loopback -j ACCEPT iptables -A loopback -j LOG --log-prefix "##loopback##" echo "Habilitando acceso a servidores Web DMZ..." iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_1_0 -j ACCEPT #tienda virtual (tpv) iptables -A dmz -p tcp -s $LAN_DMZ -d 193.24.33.9 --dport 56005 -j ACCEPT #permitit consultas a los dns autorizados "ojo falta el syn!!! y el source port" iptables -A dmz -p udp -s $LAN_DMZ -d $DNS1 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $LAN_DMZ -d $DNS2 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $DNS1 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT iptables -A dmz -p udp -s $DNS2 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A dmz -j LOG --log-prefix "##DENY dmz##" iptables -A dmz -j DROP echo "***** Fin de firewall script ********************" Thanks -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4