November 2001 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement: wuftpd (SuSE-SA:2001:043)
by adam 30 Nov '01

30 Nov '01

This should serve as a warning to all those running wuftp ..DONT. I was always amazed to see people on this list talking about how to configure it etc after all the previous problems with it. It seems to be the most consistently vulnerable FTP daemon ever created. As a friend of mine Grant says: "wuftpd is little more than a remote rootshell with ftp extensions" Adam Daniel Technical Consultant ----------------------------------------------------------------------- FORENSIC DATA SERVICES PTY LIMITED http://www.forensicdata.com.au ------------------------------------------------------------------------ > -----BEGIN PGP SIGNED MESSAGE----- > > ______________________________________________________________________________ > > SuSE Security Announcement > > Package: wuftpd > Announcement-ID: SuSE-SA:2001:043 > Date: Wednesday, Nov. 28th, 2001 23:45 MET > Affected SuSE versions: 6.3, 6.4, 7.0, 7.1, 7.2, 7.3 > Vulnerability Type: remote root compromise > Severity (1-10): 7 > SuSE default package: no > Other affected systems: all liunx-like systems using wu-ftpd 2.4.x / > 2.6.0 / 2.6.1 > > Content of this advisory: > 1) security vulnerability resolved: wuftpd > problem description, discussion, solution and upgrade information > 2) pending vulnerabilities, solutions, workarounds > 3) standard appendix (further information) > > ______________________________________________________________________________ <CHOP>

8 11

Web-Server in DMZ, SuSEfirewall2
by Holger.Schaekel＠t-online.de 30 Nov '01

30 Nov '01

I use SuSE 7.3 Prof with the latest SuSEfirewall2 from Marc Heuse. I have three Nic in the Bastion Host (one for internet with official assigned IP-Address, one for the DMZ (192.168.5.0/24) and one to the second firewall-System (192.168.1.0/24)). The second Firewall-System connect to the internal LAN. At the time, thats not for interest. On the Bastion-Host (no proxies, no services), I want to give access from the internet to the Web-Server in the DMZ (Port 80 and 443). I have read all the Documentation, Faqs, Examples and so on, but I think I make mistakes in firewall2.rc.config and can't find them, because there is no access from the Internet to the Web-Server possible. It is possible to get access from the Bastion-Host to the Web-Server. The Logs tells me, that the Firewall make an 'SuSE-FW-ACCEPT-REVERSE_MASQ' from the internet-interface to the DMZ-interface on the wright ports (client initiate >1024 to Server-Destination 80 or 443), but that's all. Nothing happens, no answer, no packets on the NIC of the Web-Server:-(. My Internet-connection looks like: Internet | +--eth2--------+ | Bastion Host | | |-- eth1/DMZ --- Web-Server +--eth0--------+ | +--------------+ | Firewall to | | internal LAN | | with proxies | +--------------+ | internal LAN The Masquerading/NAT is on eth2 active eth1 is on net 192.168.5.0 (192.168.5.2) eth0 is on net 192.168.1.0 (192.168.1.1) The Web-Server is on net 192.168.5.0 (192.168.5.1), no IP-Forwarding There is no access from internet to the DMZ Web-Server possible. The rest works fine (LAN - Internet). I want to create access from the internal lan to the Web-Server too. But at the time, thats not for interest, because the other side won't work. Here is the relevant extract from my configuration via firewall2.rc.config: <--- Snip # 2.) FW_DEV_EXT="eth2" # 3.) FW_DEV_INT="eth0" # 4.) FW_DEV_DMZ="eth1" # 5.) FW_ROUTE="yes" # 6.) FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24,0/0,tcp,80 192.168.1.0/24,0/0,tcp,443 192.168.1.0/24,0/0,tcp,21 192.168.1.0/24,0/0,tcp,10021 192.168.1.0/24,0/0,tcp,53 192.168.1.0/24,0/0,udp,53" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="" # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="" # Beware to use this! # 14.) FW_FORWARD_MASQ="0/0,192.168.5.1,tcp,80 0/0,192.168.5.1,tcp,443" # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="no" # EXPERT OPTIONS - all others please don't change these! # # 20.) FW_ALLOW_FW_TRACEROUTE="yes" # 21.) FW_ALLOW_FW_SOURCEQUENCH="yes" # 22.) FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" # 23.) FW_ALLOW_CLASS_ROUTING="no" # 25.) #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" Snap ---> Can someone help me please? What's wrong? :-) Holger

1 0

Iptables, netfiltering? I need only...
by mario libraro 30 Nov '01

30 Nov '01

Hi people, I installed up a linux SuSE 7.2 server with Oracle 9i and Apache/Tomcat. All works very nice. Now i have only a need, for security reasons: I have to administer this server remotely so i need this configuration: - port 80: open worldwide; - port 1521 (Oracle) open only for a C-class address, say x.y.z.*; - port 22 as above; I read various howto and faqs about netfilter and iptables but they talks about nat, ipforwarding, ipmasquerading... I think I need something much more simple.. a simple filter of incoming packets.. isn't it? Can someone be so nice to tell me what i exactly need, whether I have or not to recompile kernel and give me a scratch of a possible configuration?. I'm confused, help me! Thanks in advance for your time. -- Mario Libraro Web Applications Developer Fulltrading S.p.A. 00148 Roma - Via Di Affogalasino, 105 tel. +39 06 65 73 170 fax +39 06 65 73 529 mob. +39 347 5205 752 email: m.libraro(a)fulltrading.it m.libraro(a)tiresia.it web: www.fulltrading.it

2 1

AW: [suse-security] Iptables, netfiltering? I need only...
by Peer Stefan 30 Nov '01

30 Nov '01

Hi Mario, try SuSEFirewall2, which is quite easy to understand and helps you setting up a rather complex firewall without expert knowledge on netfilters. regards, Stefan -----Ursprüngliche Nachricht----- Von: mario libraro [mailto:m.libraro@fulltrading.it] Gesendet: Freitag, 30. November 2001 12:09 An: suse-security(a)suse.com Betreff: [suse-security] Iptables, netfiltering? I need only... Hi people, I installed up a linux SuSE 7.2 server with Oracle 9i and Apache/Tomcat. All works very nice. Now i have only a need, for security reasons: I have to administer this server remotely so i need this configuration: - port 80: open worldwide; - port 1521 (Oracle) open only for a C-class address, say x.y.z.*; - port 22 as above; I read various howto and faqs about netfilter and iptables but they talks about nat, ipforwarding, ipmasquerading... I think I need something much more simple.. a simple filter of incoming packets.. isn't it? Can someone be so nice to tell me what i exactly need, whether I have or not to recompile kernel and give me a scratch of a possible configuration?. I'm confused, help me! Thanks in advance for your time. -- Mario Libraro Web Applications Developer Fulltrading S.p.A. 00148 Roma - Via Di Affogalasino, 105 tel. +39 06 65 73 170 fax +39 06 65 73 529 mob. +39 347 5205 752 email: m.libraro(a)fulltrading.it m.libraro(a)tiresia.it web: www.fulltrading.it -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 30 Nov '01

30 Nov '01

> This is the setup: > > Internet <-> Router <-> Firewall <- DNAT -> DMZ > > The DMZ can browse the network via a proxy on the firewall. > The internet cannot browse the DMZ (this is what I'm trying to fix) > > It seems that the router is sending ARP requests to the > firewall network, but > does not get any responses. These would be arp requests for > the DNATed DMZ > servers. For example: I want to access a machine in the DMZ > with a private IP > of 192.168.1.5 and a public IP of 196.34.3.130 from the > internet. I can see > (using tcpdump) that the router is sending arp requests for > the public IP > onto the firewall network, but doesn't get any responses. Ahhhh, different game altogether. The firewall and the router get along just fine, it's just that the router doesn't know how to get to the DMZ. Your router's IP configuration doesn't seem to be correct after all. If it's sending ARP requests for 196.34.3.130 to the firewall network, which is confined to 196.34.3.160..175. You can do either of two things to remedy the situation: 1. Configure the firewall to perform proxy-arp on behalf of the public servers. You do this on the firewall. 2. Configure the firewall to be the router for the official subnet of the public servers. This is performed on the router. HTH Tobias

2 1

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 30 Nov '01

30 Nov '01

> > > Can anyone tell me what I have to do to connect my SuSE > firewall directly > > > to my Cisco router? > > > > > > I have tried using a crossover cable, but the router is > sending arp > > > requests and the firewall is not responding to these. > > > > Are they in the same subnet? > > Yes. > > example: > > Router has LAN iface 196.38.2.161/28 and firewall connected > via xover cable > has 196.38.2.162/28. 1. How can you see the ARP requests (and missing replies)? 2. If you try to ping the router from the firewall, do you see arp requests (and maybe replies)? 3. Have you tried this without any firewalling? 4. Is the Ethernet speed the same on both devices? Autosensing is prone to fail ever so often. Your IP configuration looks good. Maybe you could give us the output from: Linux box: ifconfig && route -n Cisco: sh ip int brief sh ip route HTH Tobias

1 0

Re: [suse-security] Connecting firewall directly to router ...
by michael.ryan＠storm.ie 30 Nov '01

30 Nov '01

On our 2501, crossover cable from external firewall interface is plugged into 10BaseT Ethernet transceiver which in turn is connected to the AUI port on the router. Can you ping/telnet to router? Ray Leach <raymondl@knowledgefact To: laurie(a)brownowl.com ory.co.za> cc: suse-security(a)suse.com Subject: Re: [suse-security] Connecting firewall directly to router 11/30/2001 10:28 AM ... Yes. example: Router has LAN iface 196.38.2.161/28 and firewall connected via xover cable has 196.38.2.162/28. Ray On Friday 30 November 2001 11:18, Laurie Brown wrote: > Ray Leach wrote: > > Hi > > > > Can anyone tell me what I have to do to connect my SuSE firewall directly > > to my Cisco router? > > > > I have tried using a crossover cable, but the router is sending arp > > requests and the firewall is not responding to these. > > > > Ray > > Are they in the same subnet? > > Cheers, Laurie. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] Connecting firewall directly to router ...
by Laurie Brown 30 Nov '01

30 Nov '01

Ray Leach wrote: > Yes. > > example: > > Router has LAN iface 196.38.2.161/28 and firewall connected via xover cable > has 196.38.2.162/28. That's your problem. The kernel can't work out what to do with the packets. AFAIK, the only way is to have separate subnets. Given the addresses above (which don't fall on a subnet boundary), your subnet allocation has to be 196.38.2.160/28 which gives you ussable addresses of .161 to .174. which is 14 hosts. Depending on what you want to do in the DMZ you could use a /29 internally, which would be usable addresses of .169 to 174 (6 hosts). That way, the firewall box is in a different subnet. If you need all 14 addresses, then you need to ask the ISP to change the subnet at the router. No doubt, if I'm wrong, someone will enlighten me! Cheers, Laurie. -- --------------------------------------------------------------------- Laurie Brown laurie(a)brownowl.com PGP key at http://pgpkeys.mit.edu:11371 ---------------------------------------------------------------------

1 0

Connecting firewall directly to router ...
by Ray Leach 30 Nov '01

30 Nov '01

Hi Can anyone tell me what I have to do to connect my SuSE firewall directly to my Cisco router? I have tried using a crossover cable, but the router is sending arp requests and the firewall is not responding to these. Ray

2 2

RE: [suse-security] secure web-serving with dynamic ip
by José Luis Ledesma 30 Nov '01

30 Nov '01

try www.dnsalias.com José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: remo suter [mailto:suter@runbox.com] Sent: jueves 29 de noviembre de 2001 16:36 To: suse-security(a)suse.com Subject: [suse-security] secure web-serving with dynamic ip hi there, i have set-up an apache web-server with mod_ssl, and it all works fine in the intranet.. but if i try to reach it from the outside, it seems to be unreachable... now the ip of my server is a dynamic one of the isp => might that be the problem, because in httpd.conf u have to add a server name and because my server is on a dial up, i dont have a domain-name? .. or would there be other possibilities for secure webserving with dynamic ips? thanks remo -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0