March 2001 - openSUSE Security - openSUSE Mailing Lists

Marc's SuSEfirewall 4.4 together with 'kppp' ???
by Marko Kaening 22 Mar '01

22 Mar '01

Hi, thanks to the hints on this list it wasn't a problem at all to install the new firewall scripts from Marc. I still have 2 questions: 1) If I start the firewall as root with /sbin/SuSEfirewall everything works just fine if there is a ppp connection to my provider to which I dial-up from time to time. BUT, I like to use the program 'kppp' for dialing since it gives me good accounting information is easy to use and so on... So, I prefer this solution instead of wvdial. THE PROBLEM is that the firewall gets only started with the ip-up script which is executed by wvdial BUT NOT by kppp, since kppp manages everything itself. If I want to call SuSEfirewall as a normal user it doesn't work, of course... 2) >From my experiments in 1) I concluded that the firewall startup-scripts only work if a connection via, say, ppp was already established. So what about my dial-up connection. I boot my machine and during that process the firewall starts to build-up, BUT since I am not connected yet, since I only want to surf or read emails for a short time, the firewall isn't properly installed... Maybe these questions are stupid, especially the latter (I am quite sure that I didn't understand the functionality of those init scripts), but I hope someone could help me! Should be a common problem though. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 4

Question about Sync and ack
by rene.marhold 22 Mar '01

22 Mar '01

Hello, can sombody explain me how to use ack and sync in firewalls?? i connt find there any good information about it thx DJMAD

3 2

Re: [suse-security] smtp_auth
by Simon Dittlmann 22 Mar '01

22 Mar '01

Hello, how do I configure smtp_auth? cu simon d.

2 1

RE: [suse-security] SASL and sendmail-tls
by Raffy 22 Mar '01

22 Mar '01

> >Mar 21 15:07:44 off sendmail[7326]: error: > safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory > > >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) > failed: No such >file or directory > > Where are these files to be found? sasldb you have to create. I guess it was saslpasswd which creates it. For the sendmail.conf file, I have it and it includes one line: pwcheck_method: PAM > But why is available only PLAIN LOGIN and ANONYMOUS, is it because I > am missing the files above? Either you go and change your sendmail.cf file or you are changing the m4-file to: TRUST_AUTH_MECH(`LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl replace LOGIN PLAIN by the methods you want! Hope this helps Raffy -- Raffael Marty security.raffy.ch

2 1

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Reckhard, Tobias 22 Mar '01

22 Mar '01

> > firewall it on the local machine, Linux has firewalling capabilities > (ipchains > > in 2.2, iptables in 2.4). > > No no, that's not the point. I could do that. But I thought that other > mailservers (for example yours) is talking to my mailserver on that port > 25. > Isn't that right? So if I block that port, I won't receive any mails any > more! > You can block access to port 25 for specific source IP addresses and specific interfaces with ipchains (and very probably with iptables, too, but I haven't used it myself yet). Sort of as in the following example, where: MAILSERV = mail server's IP address LOCALNET = local network that is only to be allowed SMTP over SSL ipchains -A input -p tcp -s ! $LOCALNET -d $MAILSERV 25 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 25 -d ! %LOCALNET ! -y -j ACCEPT ipchains -A input -p tcp -s $LOCALNET -d $MAILSERV 465 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 465 -d $LOCALNET ! -y -j ACCEPT ipchains -A input -l -j DENY ipchains -A output -l -j DENY HTH Tobias

1 0

ftp/http problems with masquerading
by Stephan Beirer 22 Mar '01

22 Mar '01

Hi List, I have a problem with our masquerading firewall: I use the same configuration on two different machines which route for two networks (one SuSE 7.0 kernel 2.2.16 connected to a isdn device and one SuSE 7.1 kernel 2.2.18 acting as ADSL router). The script (which is called by ip-up) is taken from an article in the german computer magazine "ct" (24/00). On both machines it works quite fine except for two problems: http: Some websites can't be accessed on Windows98 machines. I don't think it's the MTU problem, I once set it to the correct value [unfortunately I can't check this right now] and most websites can be shown ftp: Some servers make problems: Either the download always hangs at the last few (kilo)bytes or the ftp server fails to open the data connection (login is possible but connection hangs when doing a "ls").It seems to be a problem with masquerading: in my logfiles I can see that ipchains denies incoming connections from port 20 of the remote ftpserver. The module ip_masq_ftp is loaded and it works without any problems for many other servers. It would be nice if someone could give me some hints.. thanks && bye: stephan -------------------------------------------------------------------------- Stephan Beirer Immanuelkirchstrasse 12 10405 Berlin System Administration tel +49_30_443509000 fax +49_30_443509001 MicroDiscovery GmbH mail beirer(a)microdiscovery.com Bioinformatics Solutions http://www.microdiscovery.com

5 5

Strange firewall log entries
by SlavaU 22 Mar '01

22 Mar '01

Hi All! I have thousands(!!!) of such entries in logfile on my internet router linux box. 1. Packet log: output DENY ippp0 PROTO=1 [My ISDN Dynamic IP]:3 [ISP_DNS_IP]:3 L=56 S=0x00 I=11521 F=0x0000 T=127 (#3) Port 3 means "compressnet". Could/should I allow this compressnet (and how?) or just to disable loggging? 2. Packet log: input DENY ippp0 PROTO=1 [Some Inet IP]:8 [My ISDN Dynamic IP]:0 L=15 00 S=0x00 I=45898 F=0x4000 T=252 (#161) What is the Port 8, which is missing from /etc/services and what to do with that? Thanks, Slava.

4 3

strange NIC behaviour?
by Philipp Snizek 21 Mar '01

21 Mar '01

Dear list users, I know, this here is more HW than security related; but still maybe something for the SuSE people: I'm setting up a PC with 3 eths. This PC should become a bridge where an ipchains filter runs on. The NICs are: 1 x ne2k-pci 1 x 3c59x 1 x 3c90x 1. The 3c905C-TX card does not run with 3c90x module. 2. Starting 3c59x module it recognizes both 3Com Cards as 3c59x and starts them. 3. Into Yast configuration I put eth0 = 3c59x, eth1 = ne2k-pci while the 3c90x is built into pci slot but not loaded. When restarting the network daemon linux sees eth0=3c59x and eth1=3c59x while ne2k-pci is not loaded. Please anybody help me before I replace one 3Com eth with an intel etherexpress which will cost me another CHF 100.00 Thanx a lot Philipp

5 6

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Raffy 21 Mar '01

21 Mar '01

> > On my box I have sendmail running. In order to use SMTP over SSL I run it > > with stunnel in inetd: > > > > smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D > > 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp > > > > Further I configured sendmail to use SMTP AUTH. Everything works perfect. > > > > But: smpts is on port 465. I configured my clients such that they use that > > port. So far so good. But now port 25 can still be used to send email. I > > could block it at the firewall but then I am not able to receive email any > > more, because other mailservers are talking with me on that port. (right?) > > > > Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients > > should not be able to connect without SSL or SMPT AUTH! > > firewall it on the local machine, Linux has firewalling capabilities (ipchains > in 2.2, iptables in 2.4). No no, that's not the point. I could do that. But I thought that other mailservers (for example yours) is talking to my mailserver on that port 25. Isn't that right? So if I block that port, I won't receive any mails any more! Raffy

2 1

SASL and sendmail-tls
by Egan 21 Mar '01

21 Mar '01

>Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) failed: No such >file or directory Where are these files to be found? >Mar 21 15:07:44 off sendmail[7326]: NOQUEUE: connect from root@localhost >Mar 21 15:07:44 off sendmail[7326]: TLS: file CertFile missing >Mar 21 15:07:44 off sendmail[7326]: SASL: available mech=PLAIN LOGIN ANONYMOUS, >allowed mech=GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5 This is why it's not working, the intersection of available and allowed is null. But why is available only PLAIN LOGIN and ANONYMOUS, is it because I am missing the files above? Egan

1 0