December 2001 - openSUSE Security - openSUSE Mailing Lists

hilfe
by Eicke Kemm 20 Dec '01

20 Dec '01

-help

1 0

problems after running harden_suse
by Christian Endres 20 Dec '01

20 Dec '01

Hi all, I'm using SuSE Linux 7.2. After I run 'harden_suse' a remote login via ssh (openssh) isn't working anymore. Also I'm using Samba to access a network printer, which is connected to a W2k machine. Samba is still running and didn't changed anything in Samba. Before using 'harden_suse' printing was possible, but now it doesn't work either. I really hope that somebody can help me. Many thanks!! Best regards Christian

4 3

Re: AW: [suse-security] firewall newbe
by Thomas Hohler 19 Dec '01

19 Dec '01

Thank you all for some very nice tutorials and info on firewall rules and iptables. This is a great help -- Aloha Thomas Hohler VS Web Design P.O. Box 781 Kailua-Kona, HI 96745 Cell: (808) 936-9198 Tel. & Fax: (808) 325-1766 http://www.vswebdesign.com/ hohler(a)turquoise.net design(a)vswebdesign.com Have a nice day. "Arbeit macht das Leben Süß"

1 0

Re: [suse-security] SuSE Firewall & Reverse Masquerading
by Alexander Reach 19 Dec '01

19 Dec '01

> >For example: > > > >1.2.3.4 80 -> 192.168.1.40 80 > >1.2.3.5 80 -> 192.168.1.41 80 > > > >I already set up Virtual Interfaces on my firewall with an offical IP, > >and redirected the Ports with "ipmasqadm portfw". (Didn't used rinetd, because > >he will change the source IP adress :( ) > > > Smells like the wish 4 loadbalancing ? No, because I want to redirect _different_ offical IP's to _different_ private IP's ;) Bye, Alex

1 0

Re: [suse-security] SuSE Firewall & Reverse Masquerading
by Halder, Roland 19 Dec '01

19 Dec '01

> -----Ursprüngliche Nachricht----- > Von: Alexander Reach [mailto:newsletter@reach.de] > Gesendet: Donnerstag, 13. Dezember 2001 13:57 > An: SuSE-Security > Betreff: [suse-security] SuSE Firewall & Reverse Masquerading > > > Hello, > > I want to do reverse masquerading with the SuSE firewall. > Okay! (I must admit that I only know SuSEfirewall2 with iptables, though ...) > I know, that I can use the switch FW_FORWARD_MASQ_* to do this. > The Syntax is "Source IP / Destination IP / Destination Port". > Right! > The Problem is, that I want to redirect to more than one > Computer in my > local DMZ. > > How can I do it with this firewall ? You can only forward to different hosts if they use different ports. This is because the external client specifies the IP address of the external interface of your fw gateway, so the protocol and port number is the only criterion to differentiate the target hosts ... Assuming your fw gateway looks like: external/internet ! ! eth1 (provider assigned address) ! firewall ! eth0 (192.168.1.x) ! ! +--- 192.168.1.10 port 80 +--- 192.168.1.20 port 992 +--- ... To reach an internal server e.g. on port 80 (192.168.1.10) and another on port 992 (192.168.1.20) use something like the following in your etc/rc.config.d/firewall2.rc.config: FW_FORWARD_MASQ="0/0,192.168.1.10,tcp,80 0/0,192.168.1.20,tcp,992" The "0/0" means _any_ external IP-Adress is allowed access to the internal hosts! To allow outgoing replies from your internal hosts use: FW_MASQ_NETS="192.168.1.10 192.168.1.20" That is: your hosts can do anything outgoing! You can narrow this if you extend it with proto/port ... You also have to provide the following ... FW_ROUTE="yes" This config works on my gateway - but not already behind a second fw gateway which does no masquerading :-( ... try to solve this one in the moment ... Hope that helps Greetings Roland > > Greetings, > Alexander > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

What does this mean?
by Jochen Kaechelin 19 Dec '01

19 Dec '01

Could anybody tell me if I should care about this: Dec 18 01:27:22 jochen kernel: invalid operand: 0000 Dec 18 01:27:22 jochen kernel: CPU: 0 Dec 18 01:27:22 jochen kernel: EIP: 0010:[__free_pages_ok+26/464] Dec 18 01:27:22 jochen kernel: EFLAGS: 00210282 Dec 18 01:27:22 jochen kernel: eax: c136bc80 ebx: c136bc80 ecx: c136bc80 edx: ce651eb0 Dec 18 01:27:22 jochen kernel: esi: c136bc80 edi: 00000000 ebp: 40eb0000 esp: c25b9f00 Dec 18 01:27:22 jochen kernel: ds: 0018 es: 0018 ss: 0018 Dec 18 01:27:22 jochen kernel: Process xmms (pid: 4215, stackpage=c25b9000) Dec 18 01:27:22 jochen kernel: Stack: c136bc80 00040000 cc90dbc0 40eb0000 c1040000 00200203 ffffffff 000035e6 Dec 18 01:27:22 jochen kernel: c012b883 c012bda5 c136bc80 00040000 c0121161 c136bc80 000a7000 c012151f Dec 18 01:27:22 jochen kernel: 0daf2025 ccbf8bd0 000a7000 40ab0000 00000000 c337740c c337740c 40eb0000 Dec 18 01:27:22 jochen kernel: Call Trace: [__free_pages+27/28] [free_page_and_swap_cache+145/148] [__free_pte+81/88] [zap_page_range+375/540] [do_munmap+439/560] Dec 18 01:27:22 jochen kernel: [sys_munmap+54/92] [system_call+51/56] Dec 18 01:27:22 jochen kernel: Dec 18 01:27:22 jochen kernel: Code: 0f 0b 89 f0 2b 05 2c a8 2d c0 c1 f8 06 3b 05 20 a8 2d c0 72 Dec 18 01:27:22 jochen kernel: <6>Firewall:IN=ppp0 OUT= MAC= SRC=18.218.0.99 DST=80.131.16.224 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=55876 DF PROTO=TCP SPT=38060 DPT=6346 WINDOW=5840 RES=0x00 SYN URGP=0 Dec 18 01:29:35 jochen pppoe[1797]: Bad TCP checksum ee7e

2 1

Linux machine hangs.
by Abhijit Chavan 19 Dec '01

19 Dec '01

hey guys What all things one should check if a Linux system hangs? After rebooting, there were some bad block messages, but other than that the system was pretty much ok ....... but generally what all things should one check from a general and security point of view when a system hangs? Ofcourse "security" is an important part of the "general" things :) thanx in advance, Abhijit. -- ~~~~~~~~~~~~ expect nothing and be surprised ~~~~~~~~~~~~~

4 3

Webmail access
by Daniel Nilsson 19 Dec '01

19 Dec '01

All, I have a question regarding running a webmail client. I'm asked to make our users that have their mail on our internal IMAP based e-mailserver (Cyrus running on Solaris 8) able to check their mail through a secure webinterface from outside the company. Obviously this is a security risk for us and I'd like to get some input on what your experience is on this matter. This is what our network currently looks like: ------------------ ------------ | Firewall/Gateway | | Mailserver | ISP----| SuSE Linux 7.1 |--- Internal LAN---| | | | (192.168.1.0/24) | Solaris 8 | ------------------ ------------ This is a pretty simple setup, we also have a couple of external sites for which I run an IPSEC tunnel to using the gateway. The gateway will also be responsible for relaying SMTP mail from the outside to the mailserver which is located on the Internal LAN. The machine running the mailserver has quite a bit of sensitive information stored in addition to the e-mail which is served over NFS. What I was thinking about doing is this: ------------------- ------------ | Firewall/Gateway | | Mailserver | ISP----| SuSE Linux 7.1 |--- Internal LAN---| | \ |IP Masq for Int LAN| (192.168.1.0/24) | Solaris 8 | \ ------------------- ------------ \ | / SMTP/HTTP | ------- IMAP -------- \ | / SMTP \ | / ---------------- | DMZ Webserver | | SMTP gateway | | SuSE Linux 7.3 | ---------------- So I would allow SMTP and HTTP traffic between external hosts and the webserver on the DMZ network. IMAP traffic would only be allowed between the mailserver and the DMZ webserver. SMTP traffic to the mailserver would only be allowed from the DMZ host, not directly from the Internet. I can imagine cases where this would break, but an external hacker would really have to mess up the DMZ webserver to be able to attack the NFS exported storage on the mailserver. Obviously the mail is not going to be better protected then the users username/password pair. I have entered HTTP in the pictures but in reality I would use HTTPS for users entering the password for the mailserver. The software on the mailserver would be apache with mod_ssl and the webserver software would be squirrelmail which is based on php scripts. Regardning the SMTP software I was planning to use sendmail though I hear a lot of people recommending postfix instead. I'm not to concerned about sendmail configuration, I have resonably succesful being able to have sendmail do what I ask it to do. I also haven't heard about too many security flaws in sendmail (recent versions) where an external attacked could do harm (I would obviously not allow users to login to the gateway or on the DMZ host). Is it really worth learning a new SMTP MTA (postfix) for what it brings that sendmail doesn't have ? Any input appreciated ! Thanks Daniel Nilsson

2 1

WindowsXP contact it's home ?!
by Michael Appeldorn 17 Dec '01

17 Dec '01

Today I saw in some firewall logs a misconfigured interface with martian source lines. So far- so good. But this is a new XPnotebook that contacts with the standard IP of network-adapter 169.x.x.x a page at microsoft time.windows.com not nice. Anybody knows more. Should I block certain MS-Sites with my firewall? Michael

12 13

Re: [suse-security] WindowsXP contact it's home ?!
by JW 17 Dec '01

17 Dec '01

At 09:10 AM 12/14/2001 -0800, you wrote: >If you consistently prevent XP from contacting Microsoft, it >will quit working after sixty days. Do you know this for a fact? That would imply that you can't run WindowsXP without an Internet connection, which I find hard to belive - there's still plenty of offices and home computers without Internet connections. Do you know this from eXperience (pun intended), or did you red that somewhere? > I think this particular >call is just setting the system time, but the license code >also depends on servers at Microsoft. > > Bear > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

4 4