December 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 - odd behaviour
by Peter Romianowski 24 Dec '01

24 Dec '01

Hi, I'm using SuSE7.2 and SuSEfirewall2 to connect my lan to the internet and to do some MASQ-forwarding. Everything works fine besides the forwarding stuff. I can connect to [IP of firewall] port 25 which then redirectes to local ip 192.168.1.100 port 25. So SMTP works fine. I try to do the same for http but it won't work! The configuration is: FW_MASQ_NETS="192.168.1.0/24" FW_FORWARD_MASQ="0/0,192.168.1.100,tcp,8000 0/0,192.168.1.100,tcp,25 0/0,192.168.1.100,tcp,80" As I said, port 25 works. If I set up my internal webserver to port 8000, i am able to connect from outside my lan, too. But if I set it to 80 connection is refused. I am not a "die-hard harcore admin" so I am slightly pulling my hair out :) Any ideas? cheers, pero

1 0

Firewall2 blocks local internet traffic
by Jochen Stärk 23 Dec '01

23 Dec '01

(suse 7.2 with kernel 2.4.4, firewall2 installed) Firewall is running a NAT for DSL without a DMZ. When activating it, the local computer isn't anymore allowed to access internet, but the local net is, and vice versa, deactivating means allowing the router to access the net but NAT does of course not run any more. ... some firewall-snippets: FW_DEV_EXT="ppp0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="telnet" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" Any suggestions? Mit freundlichen Grüßen Jochen Stärk usegroup GdBR

1 0

firewall2 basics - how to allow a service only from trusted hosts?
by Michael Zimmermann 23 Dec '01

23 Dec '01

Greetings to all, could you please help me with some pointers - I'm a relatively fresh user of firewall2 and perhaps I'm getting some basic things wrong. The firewall is on a workstation with just one connection (eth0) and is used as a packet-filter. I want to allow a service to be accessed only from trusted hosts - let's say the NTP (Network Time Protocoll - port 123) should only be allowed (via upd) to IP a.b.c.d (say the server I want to synchronize with). Hence in /etc/rc.config.d/firewall2.rc.config I set FW_TRUSTED_NETS="a.b.c.d,udp,123" But then the packets are dropped with the log Dec 23 12:38:22 k2 kernel: SuSE-FW-DROP-DEFAULTIN=eth0 OUT= MAC=blahblah SRC=a.b.c.d DST=m.y.i.p LEN=76 TOS=0x00 PREC=0x00 TTL=233 ID=56172 DF PROTO=UDP SPT=123 DPT=123 LEN=56 The packets get only thru when I add the ntp-port to the DMZ-Services with FW_SERVICES_DMZ_UDP="ntp" and add eth0 as the DMZ-device with FW_DEV_DMZ="eth0" But now (I think) the service is accessible to everyone, the whole internet became the DMZ, and specifying the FW_TRUSTED_NETS is not needed at all - or am I wrong? Thanks for any help or pointer. Michael

2 1

OT: Thanks and merry christmas
by Andreas Amann 23 Dec '01

23 Dec '01

M E R R Y C H R I S T M A S * ------------------------------- / \ S u S E - S e c u r i t y / \ @/.:'\@ @/_ _\@ @ / ,.:'\ @ \/ \/ /:' \ \Y/ \Y/ @/ ,.:'\@ \=/ @/_ ,.:' _\@ ^\o o/^ / ,.:'\ //( ) @/ ,.:' \@ ^~~~~~~~~// \./ @/ ,.:' ,.:' \@ ( ()_____( / @/ ' ,.:' \@ / / / //////////// \\\\\\\\\\\\ |/ \ | | /> \> |_| ______________________________________________________________ (ascii art: Mark Hessling) ... A BIG THANK YOU to all the helpful people who, day by day, share their knowledge with others and make this mailinglist a valuable resource for (SuSE) linux users. ... Best wishes (where ever you are) --Andreas Amann

1 0

Where does SuSEfirewall2 log dropped packets???
by Monte Milanuk 23 Dec '01

23 Dec '01

I am attempting to figure out what is causing my SuSEfirewall2 to not work w/ a given service. I set the logging options to the following: FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW but the only thing firewall related that shows up in /var/log/firewall (or /var/log/messages is this: Dec 22 11:56:22 lansvr kernel: SuSE-FW-ACCEPTIN=eth0 OUT= MAC=00:a0:cc:3b:b4:0b:00:10:5a:11:8a:bc:08:00 SRC=192.168.1.3 DST=192.168.1.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=20416 DF PROTO=TCP SPT=893 DPT=111 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A0998BD690000000001030300) The source port (SPT) is about the only thing that really varies. It is supposed to be an rpc.mount command over NFS, but it's not working w/ SuSEfirewall2 just yet. And w/ no more than this, a single logged packet that _looks_ like it was accepted, not dropped, I don't know where else to look. TIA, Monte _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Slightly OT - SuSE Website
by Duane Kehoe 23 Dec '01

23 Dec '01

Does someone know what is going on with SuSE's website? I have been unable to connect most of the day, but I can still connect to the FTP server for YOU. Just a concerned SuSE user, thanks -- ____________________________________________________________ Long live the Penguin!!! Duane Kehoe Phone # 414.908.1814 Programmer/Analyst Fax # 414.908.1814 Weyco Group, Inc. Email: dkehoe(a)weycogroup.com

5 4

pop3 server
by andrei＠easynet.co.uk 22 Dec '01

22 Dec '01

I am looking for a secure pop3 server but have no idea which pop3 server has a good secure track record. So any advice would be greatly received.. Dre ...

4 7

Entriy in apache log
by abaesche＠worklab.de 21 Dec '01

21 Dec '01

Hi all, I have this entries in my apache log. Anyone an idear what this is? 203.236.245.154 - - [18/Dec/2001:21:23:54 +0100] "GET/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 205 Thanks Armin

6 11

transparent proxy and virual hosts
by Thorsten Marquardt 21 Dec '01

21 Dec '01

Hi, i like to run squid2.3 as a transparent proxy but have trouble with virtual hosts. Requests to virtual hosts are redirected to the wrong virtual host on the same server. But if configure my webbrowser to use my squid-proxy as an ordinary proxy I have no trouble. Any hints? Thanks Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0

What does this mean?
by Jochen Kaechelin 21 Dec '01

21 Dec '01

13174 ? SN 0:01 sort -f 13175 ? SN 0:00 su nobody -c /usr/bin/find / \( -fstype nfs -o -fstype NFS -o -fstype pr13176 ? SN 0:00 /usr/lib/find/frcode 13177 ? RN 0:09 /usr/bin/find / ( -fstype nfs -o -fstype NFS -o -fstype proc -o -fstype afs - -- Jochen

6 5