November 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall v2.0
by marc＠suse.de 11 Nov '01

11 Nov '01

Hi folks, SuSEfirewall2 v2.0 will shortly be available at www.suse.de/~marc/suse Of only interest for people with ADSL, where I fixed a bug for the MTU stuff. That was the last known bug which was fixed, so let's have a happy 2.0 ;-) Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

2 1

af_packet
by Brian Clark 11 Nov '01

11 Nov '01

Greetings, Does anyone have any idea why this would all of a sudden show up in my daily security output? ------ OLD: /var/lib/secchk/security-report-daily Thu Nov 8 00:00:09 2001 NEW: /var/lib/secchk/security-report-daily.new Sun Nov 11 00:00:09 2001 * Changes (+: new entries, -: removed entries): + af_packet ------ % locate af_packet /lib/modules/2.4.12-4GB/kernel/net/packet/af_packet.o I haven't installed anything in about a week and the machine hasn't been touched hardware-wise. -Brian

1 0

Hello
by Terry Belton 10 Nov '01

10 Nov '01

Hello, I have just subscribed to this list. I am a fairly new user running 7.2 who will be setting up a small network. -- Terry Belton

1 0

RE: [suse-security] Assuming closed box get attacked
by Michael Appeldorn 10 Nov '01

10 Nov '01

> >Too keep it simple,the only thing I do on the internet is >to regulary ping a certain server to check its heartbeat. > > >If this is the only thing you do, and you do not run _anything_ else on > >this box that provides a service to the outside, thus no ftp, no smtp > >nothing even. There is no one able from the outside to connect to your > >machine and you do not even need a packet filter. There is nothing to > >subvert at all. Would think, that i need a packet filter to hide myself against ping-scanning (disable whole icmp) and to let flow all packets to (electrical sample) ground without any response (nmap ect.) to be completly unvisible. Packetfilter should be helpful to filter packets that would compromise my tcp/ip stack. A packet that is filtered cannot hurt the stack !? >The only thing making a box like that unsecure is a possible physical >access to it. And what about other protocols then icmp,udp,tcp. Not ipx,smb ect. but routing protocols - i not exactly know about. >But then it would have some function if only to have you think that the >box you ping is still online. However pinging a box does not mean that >the services running on it are still working. The ping traffic example was choosen, to say, that the box is quite on the internet and to prevent answers relating http/ftp ect. attacks. >Now I have never heard of hijacking a ping session, let alone use it to >create a bufferoverflow and have that execute code that came with the >ping response. Makes for a beautiful academic question ofcourse if such >a thing would be possible. Me not too. But the "ping of death" is in afterglow. Michael Appeldorn

1 0

RE: [suse-security] Let's assume a rootkit on our box
by Michael Appeldorn 10 Nov '01

10 Nov '01

> >Too keep it simple,the only thing I do on the internet is >to regulary ping a certain server to check its heartbeat. > > >If this is the only thing you do, and you do not run _anything_ else on > >this box that provides a service to the outside, thus no ftp, no smtp > >nothing even. There is no one able from the outside to connect to your > >machine and you do not even need a packet filter. There is nothing to > >subvert at all. Would think, that i need a packet filter to hide myself against ping-scanning (disable whole icmp) and to let flow all packets to (electrical sample) ground without any response (nmap ect.) to be completly unvisible. Packetfilter should be helpful to filter packets that would compromise my tcp/ip stack. A packet that is filtered cannot hurt the stack !? >The only thing making a box like that unsecure is a possible physical >access to it. And what about other protocols then icmp,udp,tcp. Not ipx,smb ect. but routing protocols - i not exactly know about. >But then it would have some function if only to have you think that the >box you ping is still online. However pinging a box does not mean that >the services running on it are still working. The ping traffic example was choosen, to say, that the box is quite on the internet and to prevent answers relating http/ftp ect. attacks. >Now I have never heard of hijacking a ping session, let alone use it to >create a bufferoverflow and have that execute code that came with the >ping response. Makes for a beautiful academic question ofcourse if such >a thing would be possible. Me not too. But the "ping of death" is in afterglow. Michael Appeldorn

1 0

TEST very sorry
by Christopher Mahmood 10 Nov '01

10 Nov '01

-- -ckm

1 0

RE: [suse-security] susefirewall2 setup: Running postfix in the D MZ
by Nadeem Hasan 09 Nov '01

09 Nov '01

Hi, I have nothing running yet....my DMZ box cannot see anything outside its own network. :) -----Original Message----- From: Willi Brune [mailto:wbrune@wml.de] Sent: Friday, November 09, 2001 11:59 AM To: Nadeem Hasan Subject: Re: [suse-security] susefirewall2 setup: Running postfix in the DMZ Nadeem Hasan wrote: Hello, i have an similar setup. i try to ftp via squid from the dmz to the net. can you use ftp via squid ? if so, would you show me your config? (of course without the real ip's) > Hi, > > Here is my setup: > > Internet > | > +----+-----+ > | Router | > +----+-----+ > |x.x.x.1 > | > |x.x.x.2 > +----+-----+ x.x.x.33 +-------+ > | Firewall |--------------| DMZ | > +----+-----+ x.x.x.40 +-------+ > |192.168.200.1 > | > +----+-----+ > | LocalNet | > +----------+ > > eth0 (EXT) -> x.x.x.0/27 > eth1 (DMZ) -> x.x.x.32/27 > eth2 (INT) -> 192.168.200.0/24 > > I want to run postfix as mail relay and squid as a proxy on the DMZ. > I am using SuSEfirewall2 v1.9 on the "firewall" box. I have masquerading > already working. I have setup the FW_FORWARD to forward port 80 and 25 > to the DMZ. How do I get the outgoing connections working from the DMZ? > Right now, I am unable to even ping the router on x.x.x.1 or the EXT > interface x.x.x.2. The EXAMPLES file does not cover this scenario at all. > I have tried to search the archives of this list but nothing turned up. > Hope to get some help from the fine people on this list :) > > Cheers, > Nadeem Hasan > > > -- Mit freundlichem Gruss Willi Brune

1 0

Mask Routing Firewall 2
by Alberto Butrico (linux) 09 Nov '01

09 Nov '01

I am using SuSE 7.1, kernel 2.4.10, iptables 1.2.1a-53 and firewall2.- I have a NT2000 inside the internal network with an ASP application in IIS. In order to access to her from Internet, I have configured the following rule in /etc/rc.config.d/firewall2.rc.config file: FW_FORWARD_MASQ="0/0,192.168.1.20,tcp,8080,80" where 192.168.1.20 is the WinNT 2000' IP address. But I am not able to enter to the Windows Server of the internal net although the /var/log/firewall log show that seemingly it accepts it and forward correctly: Nov 9 14:08:47 fw kernel: SuSE-FW-ACCEPT-REVERSE_MASQIN=eth0 OUT=eth1 SRC=200.11.85.19 DST=192.168.1.20 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=53270 DF PROTO=TCP SPT=2735 DPT=80 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) In my browser i get: The web page is not available in this moment... ¿Any idea? PD: This is my firewall2.rc.config file: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http-alt ssh smtp imap pop3 domain ftp telnet www 5631 5632" FW_SERVICES_EXT_UDP="domain 5631 5632" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="http-alt ssh ftp smtp domain www telnet imap pop3 imap 137 138 139 901 3128" FW_SERVICES_INT_UDP="domain 137 138 139" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="0/0,192.168.1.20,tcp,8080,80" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" -- Greetings, Alberto mailto:linux@opc.com.uy Linux User #242064

1 0

Re: SuSE Security Announcement: kernel (update) (SuSE-SA:2001:039)
by Thomas Michael Wanka 09 Nov '01

09 Nov '01

Hi, on Oct. 22nd Roman Drahtmüller wrote: --schnipp-- While we're talking about it: We are preparing the updates for the kernel packages. If you want to test the new kernels, go to ftp://ftp.suse.com/pub/people/mantel/next/ and chose your kernel rpm. The one for 2.2.19 is currently missing. :-( Anyway, Hubert Mantel has included all currently available fixes for both 2.2 and 2.4 series kernels. The announcement follows by the second half of this week. --schnapp-- Are these kernel (2.4.12) vulnerable? Thanks mike

3 3

test
by Guido Tschakert 09 Nov '01

09 Nov '01

-- ------------------ Guido Tschakert Sys-Ad, SRC ------------------

1 0