December 2001 - openSUSE Security - openSUSE Mailing Lists

AvMailGate does not find Eicar
by Jochen Kaechelin 03 Dec '01

03 Dec '01

I installes Antivir and AntivirMailGate from SuSEs original 7.3prof. antivir is working find and it detects the test-file from eicar: checking drive/path (cwd): /home/jochen /home/jochen/fff Date: 2.12.2001 Time: 10:10:59 Size: 68 VIRUS: file contains code of the virus 'Eicar-Test-Signatur' /home/jochen/eicarcom2.zip Date: 2.12.2001 Time: 23:58:43 Size: 308 VIRUS: file contains a signature of the virus 'Eicar-Test-Signatur' My /etc/avmailgate.conf looks this way: user uucp group uucp SpoolDir /var/spool/vscan/avmailgate Postmaster jochen PidFile_avgated /var/run/avmailgate/avmailgate_d.pid ListenAddress 192.168.0.1 port 25 SmtpTimeout 300 MaxIncomingConnections 0 MaxMessageSize 0 #MaxRecipientsPerMessage100 #MinFreeBlocks 100 RefuseEmptyMailFrom NO PidFile_avgatefwd /var/run/avmailgate/avmailgate_fwd.pid MaxForwarders 3 BlockSuspiciousMime FALSE ExposeAlerts FALSE ForwardTo SMTP: localhost port smtp-backdoor my /etc/sendmail.cf contains the following: O DaemonPortOptions=Name=MTA,Port=smtp-backdoor my /etc/services contains the following: smtp-backdoor 825/tcp # AntiVir MailGate When I send the attached eicar-test-file AntiVirMailGate shows no reaction. When starting with "rcavgate start" /var/log/mail shows the following: Dec 3 06:58:15 jochen avgated[19907]: ready to accept connections on port 25 Dec 3 06:58:16 jochen avmgatefwd[19906]: running in full featured mode When sending a mail with kmail /var/log/mail shows the following: Dec 3 07:05:38 jochen sendmail[19982]: fB365c419982: from=jochen, size=442, class=0, nrcpts=1, msgid=<200112030605.fB365c419982(a)jochen.wa-p.netz>, relay=localhost [[UNIX: localhost]] Dec 3 07:05:39 jochen sendmail[19984]: fB365c419982: to=jk(a)wa-p.de, ctladdr=jochen (500/100), delay=00:00:01, xdelay=00:00:01, mailer=relay, pri=120442, relay=smtp.wa-p.de [62.67.200.3], dsn=2.0.0, stat=Sent (ok 1007359540 qp 28590) Can anyone please help me - it's very urgent for me. Thanx. -- WA-P: Programmierung - Beratung - Hosting Stuttgarter Strasse 3 - D-73033 Goeppingen Tel. 07161 - 92 95 94 Fax 07161 - 1 36 01 http://internet.wa-p.de - jk(a)wa-p.de

2 2

SuSE Firewall on CD and SQUID
by Alexander Reach 03 Dec '01

03 Dec '01

Hello Group, just a little question about this nice product. Is it possible to change the squid error pages (html-format) ? I tried to put them on the floppy (in the right subdir, of course), but it seems, that these files won't be copied to the ram-disk. Is the script, responsible for the copy-process, on the CD, or is it on the floppy, so that I can edit it? Thanks in advance, Alexander

1 0

error in amavis?
by Stadt.Waren-Mueritz＠t-online.de 03 Dec '01

03 Dec '01

Hi, in /usr/sbin/amavis (original 25.10.2001 / perl-11) is an "error" in line 1147 [...] 1146 /^gzip compresssed/io && ..... 1147 /^compress'd/io && ..... < is this correct?? 1148 /^bzip2 compressed/io && ..... [...] Kind regards --- Matthias Bitterlich Tel: 03991-177151 Fax: 03991-177112 Stadt Waren (Müritz) Hauptamt - EDV www.stadt-waren.de Zum Amtsbrink 1 17192 Waren (Müritz) Germany

2 1

Zeroing chain (ipchains )
by Erwin Zierler - stubainet.at 03 Dec '01

03 Dec '01

Hi list, I'm using ipchains on some SuSE 6.4 box with kernel 2.2.19. Recently I implemented a few rules to log and count traffic from portscans (coming from know IP addresses). I use ipchains on this box mainly for accounting really and now I'd like to reset (i.e. set to zero) a few chains. According to the manpage on my system it would go like this: ipchains -Z chain_name (i.e. ipchains --zero chain_name) But nothing happens! Am I missing something or should I be worried? TIA for any input on this. Erwin PS.: ipchains -V says ipchains 1.3.9, 17-Mar-1999 -- Erwin Zierler | web- / host- / postmaster - stubainet.at | erwin.zierler(a)stubainet.at / webmaster(a)stubainet.at | Tel.: 0 5225 - 64325 Fax 99 Mobil: 0664 - 130 67 91

2 2

port 445
by spiekey 03 Dec '01

03 Dec '01

Hello! I am using logcheck and portsentry. I read that port 445 is something from smb and not really a reason to worry about, but well, its a external ip which wanted to "do" something. Something to worry about? Active System Attack Alerts =-=-=-=-=-=-=-=-=-=-=-=-=-= Dec 3 01:43:47 suse portsentry[5576]: attackalert: TCP SYN/Normal scan from host: pD951A6F2.dip.t-dialin.net/217.81.166.242 to TCP port: 445 Dec 3 01:43:47 suse portsentry[5576]: attackalert: Host 217.81.166.242 has been blocked via wrappers with string: "ALL: 217.81.166.242" Thanks! Spiekey

3 2

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 03 Dec '01

03 Dec '01

> > Well, it need not be accomplished by proxy-arp, for one. > Then, who's saying > > the IP address that's being DNATed is in a local subnet of > the firewall at > > all? I.e. the firewall could have two networks attached, > 1/8 and 2/8. It > > could still be instructed to DNAT traffic to 2.1.1.1 to 3.1.1.1. No > > proxy-arp involved. > > > I read the man page for arp. It says that the kernel does > automagic arp if a > route exists between the subnets. And...? > > I'd ask for a /30 subnet to put the Cisco and the firewall (external > > interface) into, additionally to the /28 subnet for the DMZ > and have the > > Cisco sysadmin configure the firewall as the gateway to > that /28. The /30 > > subnet needn't have official addresses, BTW, in case that's > a problem, > > because noone should need to send traffic to the firewall directly. > > > What about setting the cisco's default gateway for the > 66.8.45.160/28 network > to the firewall interface? Number one, there is only one default gateway, also called the gateway of last resort. There is no subnet-specific *default* gateway. I don't think the Cisco would let you configure it's interface as 66.8.45.161/255.255.255.240 and then issue a route to that very subnet pointing at a gateway, since it knows that that subnet is directly attached. You can, however, split that subnet into smaller blocks and apply routes to those. More specific routes, i.e. ones with a larger number of bits in the subnet mask, take precedence over less specific routes. The easiest way to do this in your situation, where you don't have many hosts, is to issue host routes. Under no circumstances give the Cisco a different subnet mask than the Linux box. They won't be able to see each other if you do, as network and broadcast addresses don't correspond anymore. Cheers Tobias

1 0

DHCLIENT, masquarding and firewall
by Ryan Allen 03 Dec '01

03 Dec '01

Hi SuSE Security, I'm new to this list. Due to changed to Excite at home shutting down, I had to make some changes to my firewall config. I used to have a static IP and everything worked great, but now I have a dynamic IP assigned via DHCP. Behind my SuSE 7.1 machine, I'm running a LAN that uses masquerading through the SuSE machine. I'm getting my DHCP offer just fine, and have hull access to the Internet from my SuSE machine, but I cannot access the Internet from any machine behind the SuSE machine. I've tweaked everything I can in /etc/rc.config.d/firewall.rc.config and restarted my firewall many times. Any ideas? I'm running kernel 2.4.2, if it makes a difference?? thanks in advanced! -- Ryan here is my firewall config: FW_DEV_WORLD="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="10.10.55.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice FW_SERVICES_EXTERNAL_TCP="20 21 22 80 8080 6346" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="20 21 " # Common: domain FW_SERVICES_EXTERNAL_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_DMZ_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_INTERNAL_TCP="" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="" # Common: domain syslog FW_SERVICES_INTERNAL_IP="" # For VPN/Routing which END at the firewall!! FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp FW_SERVICES_TRUSTED_IP="" # For VPN/Routing which END at the firewall!! FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "DNS" or "domain ntp" FW_SERVICE_DNS="no" # if yes, FW_SERVICES_*_TCP needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DHCLIENT="yes" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCPD="no" # set to "yes" if this server is a DHCP server FW_SERVICE_SAMBA="no" # set to "yes" if this server uses samba as client # or server. As a server, you still have to set # FW_SERVICES_{WORLD,DMZ,INT}_TCP="139" # Everyone may send you udp 137/138 packets if set # to yes! (samba on the firewall is not a good idea!) FW_FORWARD_TCP="" # Beware to use this! FW_FORWARD_UDP="" # Beware to use this! FW_FORWARD_IP="" # Beware to use this! FW_FORWARD_MASQ_TCP="" # Beware to use this! FW_FORWARD_MASQ_UDP="" # Beware to use this! FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" ## # END of rc.firewall ## #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" #FW_CUSTOMRULES="/etc/rc.config.d/firewall-custom.rc.config"

2 2

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 03 Dec '01

03 Dec '01

> On Monday 03 December 2001 07:37, Reckhard, Tobias wrote: > > Try: > > 1. man arp (see the options -D and -s) > > 2. http://www.linuxdoc.org/HOWTO/mini/Proxy-ARP-Subnet/ > > > If I'm using IPTABLES and I'm using the DNAT rules, why does > the kernel not > do the proxy-arp automatically? Surely what DNAT is trying to > accomplish > requires this, i.e. listening on a public IP and redirecting > to a private IP. Well, it need not be accomplished by proxy-arp, for one. Then, who's saying the IP address that's being DNATed is in a local subnet of the firewall at all? I.e. the firewall could have two networks attached, 1/8 and 2/8. It could still be instructed to DNAT traffic to 2.1.1.1 to 3.1.1.1. No proxy-arp involved. Use different tools for different tasks. > > PS: I dislike either of these setups. If you've got > separate subnets, you > > should have separate subnet addresses, IMHO. But the above > should work > > nonetheless. > So you would have 66.8.45.161/28 on the router LAN interface > and something > else on the internet interface on the firewall? Does this > mean that the > internet interface on the firewall requires a public IP? No, you can't have the Linux firewall's external interface and the router's 'internal' interface on different subnets (well, in Linux with PtP interfaces you can and Cisco allows for 'ip unnumbered', so this is actually not entirely true, but..). I'd ask for a /30 subnet to put the Cisco and the firewall (external interface) into, additionally to the /28 subnet for the DMZ and have the Cisco sysadmin configure the firewall as the gateway to that /28. The /30 subnet needn't have official addresses, BTW, in case that's a problem, because noone should need to send traffic to the firewall directly. Cheers Tobias

2 1

RE: [suse-security] Connecting firewall directly to router ...
by Reckhard, Tobias 03 Dec '01

03 Dec '01

> Sorry ... made a mistake there ... 130 should be 166 OK. > > You can do either of two things to remedy the situation: > > 1. Configure the firewall to perform proxy-arp on behalf of > the public > > servers. You do this on the firewall. > This sounds like what I'm looking for, any idea on how I can do this? Try: 1. man arp (see the options -D and -s) 2. http://www.linuxdoc.org/HOWTO/mini/Proxy-ARP-Subnet/ > > 2. Configure the firewall to be the router for the official > subnet of the > > public servers. This is performed on the router. This would work like this (on the Cisco): # conf t (config)# ip route <IP of server1> 255.255.255.255 <IP of Linux-GW> (config)# ip route <IP of server2> 255.255.255.255 <IP of Linux-GW> ... (config)# end # copy run start HTH Tobias PS: I dislike either of these setups. If you've got separate subnets, you should have separate subnet addresses, IMHO. But the above should work nonetheless.

2 1

Have I been hacked?
by Hans Körber 03 Dec '01

03 Dec '01

Hallo, I found user "nobody" performing a "find" on my linux box few days ago. In the /home section of the filesystem I found a subdirectory "httpd" which I did not create. The "httpd" directory itself contained a subfolder, "bin-cgi". I didn't find any other changes. The linux machine runs IPTABLES with open ports for SSH, HTTP and HTTPs. Connection is via pppd. I'm still a "newbie" to security. I would appreciate any key words and explanations to find out if I've been hacked, how this has been achieved and how it can be avoided in the future. Thank you very much in advance. Regards, Hans Körber

5 4