November 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 blocks dialin-Traffic to LAN
by Karlheinz Blank 27 Nov '01

27 Nov '01

Hi, I'm currently using a SuSE 7.3( with Kernel 2.4) server with one NIC (eth0)[192.168.12.1]; The Server is using DSL (ppp0) with a modem attached to eth0 via a network switch. The DSL-Route is the default route to the internet. Additionally I need employees to dial in via ISDN (ippp0). Everything works ok so far. ;-) As soon as I switch on my SuSEfirewall2, the remote dialin person is restricted in TCP/IP Traffic to the dialin server (e.g. Ping is only successfull to the dialin-server, but not Successfull to any other host in the 192.168.12.0 network). I'm sorry - I really don't understand the misconfiguration here.... I thought, the masquerade settings are the most important here.... /etc/rc.config: Eth0: IFCONFIG_0="192.168.12.1 broadcast 192.168.12.255 netmask 255.255.255.0 up" Ippp0: IFCONFIG_1="192.168.12.97 pointopoint 192.168.12.1 up" Ppp0: IFCONFIG_2="192.168.0.99 broadcast 192.168.0.255 netmask 255.255.255.0 up" firewall2.config: FW_DEV_EXT="ppp0" FW_DEV_INT="eth0 ippp0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.12.0/24 192.168.13.0/24 192.168.15.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" If there is a dialin connection to the server, the server reports the following: gitta:~ # route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 199.5.98.33 0.0.0.0 255.255.255.255 UH 0 0 0 ppp0 192.168.15.0 0.0.0.0 255.255.255.0 U 0 0 0 ippp0 192.168.12.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 192.168.12.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 0.0.0.0 199.5.98.33 0.0.0.0 UG 0 0 0 ppp0 The assigned IP-Addresses during dialin via ISDN are: Dialin-Client: 192.168.15.33 Dialin-Server(ippp0): 192.168.12.97 Any hints? Thanks for your help Karlheinz

1 0

Looking for a Howto
by spiekey 26 Nov '01

26 Nov '01

Hello! It might not be the right mailing list to ask, but i hope you can help me anyway. I tried to read the "Understanding IP Addressing: Everything You Ever wanted to know" from 3com. Its in English, for the first tiem now i am looking for an German howto because this one is quite hard to understand. Don´t get me wrong, i have nothing agains engl HowTos, just this time i wish it would be in German ;) I searched a lot o the Internet to find a translation, but i was unlucky so far. Does anybody know is there is a German Version of it. Or Is there any other Garman howto which is about the same stuff. It would be really really nice if you could help me! Regards, Spiekey

3 2

Excotic Firewall Police
by spiekey 26 Nov '01

26 Nov '01

Hello All! What would be the advantage or disadvantage of this idea: Why not forward the packets, which will be dropped usually, and forward it to the source address? Forward execpt of dropping. A kind of mirror effect would mybe keep an attacker busy till you check your logs ;D Just an Idea. Spiekey

7 11

Security problem with sendmail?
by Laurie Brown 26 Nov '01

26 Nov '01

Hi all, The log-checking script on one of the machines I look after has picked this up [edited to avoid giving too much away]: ---- cut here ---- Nov 26 07:31:39 mymachine sendmail[16970]: HAA16970: from=<nobody(a)host.bwhst.com>, size=1860, class=0, pri=31860, nrcpts=1, msgid=<E168GFQ-0000vz-00(a)host.bwhst.com>, proto=ESMTP, relay=[66.78.13.34] [where mymachine is the machine name] Nov 26 07:31:39 mymachine sendmail[16971]: HAA16970: forward /dir/acct/.//.forward: Permission denied [where /dir is a directory and /acct is an account] Nov 26 07:31:39 mymachine sendmail[16971]: HAA16970: to=<info(a)adomain.com>, delay=00:00:00, xdelay=00:00:00, mailer=local, stat=Sent [where adomain is a domain on the machine] ---- cut here ---- The mail to info(a)adomain.com was some search engine spam. The /dir/acct directory is the home directory of a non-root account, set up that way (home=/dir/./acct) for chroot wuftpd. Should I be worried about this, and if so, what can I do about it? I'm running SuSE 6.4 with sendmail-8.9.3-105 (AFAIK, the most recent SuSE rpm I can run without upgrading the machine). Cheers, Laurie. -- --------------------------------------------------------------------- Laurie Brown laurie(a)brownowl.com PGP key at http://pgpkeys.mit.edu:11371 ---------------------------------------------------------------------

2 1

RE: [suse-security] Excotic Firewall Police
by Thomas Schmidt 26 Nov '01

26 Nov '01

Hi Spiekey, I think this is not a very good idea. Just imagine your attacker has a very high bandwith or the attackers fakes his source ip address. Then YOU would attack an other system! > -----Original Message----- > From: spiekey [mailto:spiekey@hotmail.com] > Sent: Friday, November 23, 2001 4:56 PM > To: suse-security(a)suse.com > Subject: [suse-security] Excotic Firewall Police > > Hello All! > What would be the advantage or disadvantage of this idea: > > Why not forward the packets, which will be dropped usually, > and forward it > to the source address? > Forward execpt of dropping.

1 0

k_smp-2.4.7-22.i386.rpm and Starfire does not work
by Peter Nixon 26 Nov '01

26 Nov '01

Hi Guys Quick question, I have a box with an Adaptec Starfire quad card in it. upon updating to k_smp-2.4.7-22.i386.rpm the Starfire card no longer works and trows these messages into /var/log/messages whenever data is passed to the card: Nov 26 11:21:00 machine-name kernel: eth1: Transmit timed out, status 00000000, resetting... Nov 26 11:21:00 machine-name kernel: Rx ring dc172000: 1ca04811 1efda811 1f081011 1cdda811 1c1e4011 1d0d6011 1f085011 1d0d4011 Nov 26 11:21:00 machine-name kernel: 0c011 1c13b811 1c13b011 1c139811 1c139011 1c138811 1c138011 1c415811 1c415011 1c414811 1c414 Nov 26 11:21:00 machine-name kernel: 1f811 1c71f011 1c71e811 1c71e011 1c71d811 1c71d011 1c71c811 1c71c011 1c5eb811 1c5eb011 1c5ea Nov 26 11:21:00 machine-name kernel: Tx ring dc173000: b101002a b101002a b101002a b1010046 b101002a b101002a b101002a b101002a Nov 26 11:21:04 machine-name kernel: NETDEV WATCHDOG: eth1: transmit timed out Does anyone have any idea what the problem is? I hate running old kernels with IP bugs on firewalls :-) -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 1

no mail for root
by Jonathan 26 Nov '01

26 Nov '01

Hello all, I have just installed a fresh 7.3 (replacing my 6.4) w/ iptables, harden_suse and security scripts for my cable firewall. All is looking good but looks like my daily security scripts aren't running and root has yet to receive any mail. I have made the change in /etc/rc.config to start the security scripts. Any help or point in the right directions would be greatly appreaciated. Thank you.

1 0

SuSE 7.3 : Kernel 2.4.10-4GB Bug (fwd)
by Sven Koch 25 Nov '01

25 Nov '01

Forward from Bugtraq Is the updated Kernel 2.4.10-20011026 secure against this bug? (Sorry, can't test it for myself at the moment, as my 7.3-box is in production use and I need to avoid unnecessary downtimes) ---------- Forwarded message ---------- From: Juergen Pabel <spamtrap(a)invalid.domain> To: bugtraq(a)securityfocus.com Date: Wed, 21 Nov 2001 10:52:17 +0100 Subject: SuSE 7.3 : Kernel 2.4.10-4GB Bug Summary: Any local user can crash a SuSE 7.3 Kernel 2.4.10-4GB (I imagine this is a buffer overflow or pointer verification problem while in kernel mode) Details: I updated my SuSE 7.2 installation to 7.3 and now I can reproducably crash the system as any local user (ie: non-root). Out of curiousity i started the file /usr/src/linux/vmlinux (basically: the file "vmlinux" in the base kernel source directory) which is the "pure" (for lack of a better word) kernel after a successful kernel compilation. Since this file is essentially an ELF executable it's possible to start it (whether or not it actually "runs" is a different story). On a correctly running kernel it should (and does) exit with SIGSEGV, while on a 2.4.10-4GB kernel it crashes the whole system (hard reset, instantly...kaputt). I have not tested this any further except to verify that this is actually a problem with the kernel and not some other kernel module i use (vmware, pcmcia, ...) or even hardware (tested with same result on a different machine) I have also not notified the vendor yet because I haven't verified if the cause is a SuSE patch or if the problem resides within the original kernel code (I haven't even started looking for the source of the problem). If you want to contact me do so via email "jpabel at akkaya dot de" Juergen Pabel Akkaya Consulting GmbH www.akkaya.de

6 6

logsurfer.conf syntax / help
by Maarten J H van den Berg 24 Nov '01

24 Nov '01

Hi there, I'm trying to get rid of non-vital logging info, with the aid of logsurfer. The accent is not on mailing suspicious stuff, more on keeping logfiles manageably small. However I find the docs that come with logsurfer inadequate, quite confusing even. I had hoped for more examples... Can anyone here share [parts of-] his/her logsurfer.conf for clarity and / or as examples ? The way to "ignore" certain messages is clear and simple, so is the way to alert when something evil is happening. What I don't really understand is how the "context" rules work. Let's say for instance I'd like to get rid of the 'named' starting messages: Oct 30 16:21:09 hostname named[16988]: starting (/etc/named.conf). [...] Oct 30 16:21:09 hostname named[16988]: hint zone "" (IN) loaded (serial 0) Oct 30 16:21:09 hostname named[16988]: master zone "localhost" (IN) [...] Oct 30 16:21:09 hostname named[16988]: master zone "0.0.127.in-addr.arpa" Oct 30 16:21:09 hostname named[16988]: master zone "foobar" (IN) [...] Oct 30 16:21:09 hostname named[16988]: master zone "8.9.10.in-addr.arpa" Oct 30 16:21:09 hostname named[16988]: listening on [10.9.8.7].53 (eth8) Oct 30 16:21:09 hostname named[16988]: Forwarding source address [...] Oct 30 16:21:09 hostname named[16989]: Ready to answer queries. In that case we'd like a rule that, if it sees a 'named .* starting (/etc/named.conf)' will open a context (and eventually ignore all inside) for all following rules from the same PID, UNLESS there is a '.* rejected due to errors .*' statement in one of those lines. My problem is, A) I don't know how to implement this, and B) This is not safe because it could drop other types of, possibly fatal, errors. Yet the only alternative is, "make 1 rule per line". Not only is that quite a mess and a LOT of work, but it makes it impossible to look at the context to see whether a message is benign or not; "With invalid flags" sounds like a serious warning, but looking at the context it's just 1 line out of many when squid is attempting to start. Oct 29 18:17:24 hostname squid[950]: 0 With invalid flags. Does anyone have relevant experience(s) with logsurfer that he /she is willing to share and / or discuss here (or off-list if perhaps perceived off-topic) ? Maybe even agree on a generic "safe_to_use"(...) ruleset for SuSE machines ? Any help or comments are greatly appreciated, Maarten -- Maarten J. H. van den Berg ~~//~~ network administrator van Boetzelaer van Bemmel - Amsterdam - The Netherlands http://vbvb.nl T+31204233288 F+31204233286 G+31651994273

3 2

php with imap
by Dr. Thomas Hartl 24 Nov '01

24 Nov '01

Hello ! We have some web and mailservers running SuSE 7.1/7.2. One of them with a webmail-software called NOCC (see sourceforge.org) Now I did the security updates from Sep. 14th (http://www.suse.de/de/support/download/updates/72_i386.html) mod_php4 4.0.6 and mod_php4-core 4.0.6 (A little late ... I know...) Unfourtunately NOCC does not work any longer because php was made without the configure-option '--with-imap=yes'. Now my Questions: Was this option left away for security reasons? If no, would SuSE provide a new rpm with imap compiled in? kind regards, tom ----------------------------------------------------------------------- Dr. Thomas Hartl [th(a)shmx.de] UNIX is like an indian tipi: No windows, no gates and apache inside -----------------------------------------------------------------------

2 1