March 2001 - openSUSE Security - openSUSE Mailing Lists

Marc's SuSEfirewall 4.4 together with 'kppp' ???
by Marko Kaening 22 Mar '01

22 Mar '01

Hi, thanks to the hints on this list it wasn't a problem at all to install the new firewall scripts from Marc. I still have 2 questions: 1) If I start the firewall as root with /sbin/SuSEfirewall everything works just fine if there is a ppp connection to my provider to which I dial-up from time to time. BUT, I like to use the program 'kppp' for dialing since it gives me good accounting information is easy to use and so on... So, I prefer this solution instead of wvdial. THE PROBLEM is that the firewall gets only started with the ip-up script which is executed by wvdial BUT NOT by kppp, since kppp manages everything itself. If I want to call SuSEfirewall as a normal user it doesn't work, of course... 2) >From my experiments in 1) I concluded that the firewall startup-scripts only work if a connection via, say, ppp was already established. So what about my dial-up connection. I boot my machine and during that process the firewall starts to build-up, BUT since I am not connected yet, since I only want to surf or read emails for a short time, the firewall isn't properly installed... Maybe these questions are stupid, especially the latter (I am quite sure that I didn't understand the functionality of those init scripts), but I hope someone could help me! Should be a common problem though. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 4

Question about Sync and ack
by rene.marhold 22 Mar '01

22 Mar '01

Hello, can sombody explain me how to use ack and sync in firewalls?? i connt find there any good information about it thx DJMAD

3 2

Re: [suse-security] smtp_auth
by Simon Dittlmann 22 Mar '01

22 Mar '01

Hello, how do I configure smtp_auth? cu simon d.

2 1

RE: [suse-security] SASL and sendmail-tls
by Raffy 22 Mar '01

22 Mar '01

> >Mar 21 15:07:44 off sendmail[7326]: error: > safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory > > >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) > failed: No such >file or directory > > Where are these files to be found? sasldb you have to create. I guess it was saslpasswd which creates it. For the sendmail.conf file, I have it and it includes one line: pwcheck_method: PAM > But why is available only PLAIN LOGIN and ANONYMOUS, is it because I > am missing the files above? Either you go and change your sendmail.cf file or you are changing the m4-file to: TRUST_AUTH_MECH(`LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl replace LOGIN PLAIN by the methods you want! Hope this helps Raffy -- Raffael Marty security.raffy.ch

2 1

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Reckhard, Tobias 22 Mar '01

22 Mar '01

> > firewall it on the local machine, Linux has firewalling capabilities > (ipchains > > in 2.2, iptables in 2.4). > > No no, that's not the point. I could do that. But I thought that other > mailservers (for example yours) is talking to my mailserver on that port > 25. > Isn't that right? So if I block that port, I won't receive any mails any > more! > You can block access to port 25 for specific source IP addresses and specific interfaces with ipchains (and very probably with iptables, too, but I haven't used it myself yet). Sort of as in the following example, where: MAILSERV = mail server's IP address LOCALNET = local network that is only to be allowed SMTP over SSL ipchains -A input -p tcp -s ! $LOCALNET -d $MAILSERV 25 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 25 -d ! %LOCALNET ! -y -j ACCEPT ipchains -A input -p tcp -s $LOCALNET -d $MAILSERV 465 -j ACCEPT ipchains -A output -p tcp -s $MAILSERV 465 -d $LOCALNET ! -y -j ACCEPT ipchains -A input -l -j DENY ipchains -A output -l -j DENY HTH Tobias

1 0

ftp/http problems with masquerading
by Stephan Beirer 22 Mar '01

22 Mar '01

Hi List, I have a problem with our masquerading firewall: I use the same configuration on two different machines which route for two networks (one SuSE 7.0 kernel 2.2.16 connected to a isdn device and one SuSE 7.1 kernel 2.2.18 acting as ADSL router). The script (which is called by ip-up) is taken from an article in the german computer magazine "ct" (24/00). On both machines it works quite fine except for two problems: http: Some websites can't be accessed on Windows98 machines. I don't think it's the MTU problem, I once set it to the correct value [unfortunately I can't check this right now] and most websites can be shown ftp: Some servers make problems: Either the download always hangs at the last few (kilo)bytes or the ftp server fails to open the data connection (login is possible but connection hangs when doing a "ls").It seems to be a problem with masquerading: in my logfiles I can see that ipchains denies incoming connections from port 20 of the remote ftpserver. The module ip_masq_ftp is loaded and it works without any problems for many other servers. It would be nice if someone could give me some hints.. thanks && bye: stephan -------------------------------------------------------------------------- Stephan Beirer Immanuelkirchstrasse 12 10405 Berlin System Administration tel +49_30_443509000 fax +49_30_443509001 MicroDiscovery GmbH mail beirer(a)microdiscovery.com Bioinformatics Solutions http://www.microdiscovery.com

5 5

Strange firewall log entries
by SlavaU 22 Mar '01

22 Mar '01

Hi All! I have thousands(!!!) of such entries in logfile on my internet router linux box. 1. Packet log: output DENY ippp0 PROTO=1 [My ISDN Dynamic IP]:3 [ISP_DNS_IP]:3 L=56 S=0x00 I=11521 F=0x0000 T=127 (#3) Port 3 means "compressnet". Could/should I allow this compressnet (and how?) or just to disable loggging? 2. Packet log: input DENY ippp0 PROTO=1 [Some Inet IP]:8 [My ISDN Dynamic IP]:0 L=15 00 S=0x00 I=45898 F=0x4000 T=252 (#161) What is the Port 8, which is missing from /etc/services and what to do with that? Thanks, Slava.

4 3

strange NIC behaviour?
by Philipp Snizek 21 Mar '01

21 Mar '01

Dear list users, I know, this here is more HW than security related; but still maybe something for the SuSE people: I'm setting up a PC with 3 eths. This PC should become a bridge where an ipchains filter runs on. The NICs are: 1 x ne2k-pci 1 x 3c59x 1 x 3c90x 1. The 3c905C-TX card does not run with 3c90x module. 2. Starting 3c59x module it recognizes both 3Com Cards as 3c59x and starts them. 3. Into Yast configuration I put eth0 = 3c59x, eth1 = ne2k-pci while the 3c90x is built into pci slot but not loaded. When restarting the network daemon linux sees eth0=3c59x and eth1=3c59x while ne2k-pci is not loaded. Please anybody help me before I replace one 3Com eth with an intel etherexpress which will cost me another CHF 100.00 Thanx a lot Philipp

5 6

RE: [suse-security] Sendmail SMTP AUTH / SSL
by Raffy 21 Mar '01

21 Mar '01

> > On my box I have sendmail running. In order to use SMTP over SSL I run it > > with stunnel in inetd: > > > > smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D > > 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp > > > > Further I configured sendmail to use SMTP AUTH. Everything works perfect. > > > > But: smpts is on port 465. I configured my clients such that they use that > > port. So far so good. But now port 25 can still be used to send email. I > > could block it at the firewall but then I am not able to receive email any > > more, because other mailservers are talking with me on that port. (right?) > > > > Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients > > should not be able to connect without SSL or SMPT AUTH! > > firewall it on the local machine, Linux has firewalling capabilities (ipchains > in 2.2, iptables in 2.4). No no, that's not the point. I could do that. But I thought that other mailservers (for example yours) is talking to my mailserver on that port 25. Isn't that right? So if I block that port, I won't receive any mails any more! Raffy

2 1

SASL and sendmail-tls
by Egan 21 Mar '01

21 Mar '01

>Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/usr/lib/sasl/Sendmail.conf) >failed: No such file or directory >Mar 21 15:07:44 off sendmail[7326]: error: safesasl(/etc/sasldb) failed: No such >file or directory Where are these files to be found? >Mar 21 15:07:44 off sendmail[7326]: NOQUEUE: connect from root@localhost >Mar 21 15:07:44 off sendmail[7326]: TLS: file CertFile missing >Mar 21 15:07:44 off sendmail[7326]: SASL: available mech=PLAIN LOGIN ANONYMOUS, >allowed mech=GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5 This is why it's not working, the intersection of available and allowed is null. But why is available only PLAIN LOGIN and ANONYMOUS, is it because I am missing the files above? Egan

1 0

Capi4Linux and capi4hylafax
by Technik NIT 21 Mar '01

21 Mar '01

Hello, world I had a problem with my Hylafax-server on SuSe7.0 I had installed my Fritz!Classic with the drivers from AVM-Homepage(capi4linux and capi4hylafax). But now when i change my i4l to AVM B1 PCI and want to restart it i get the error message: /dev/isdninfo no such file or dir. And the ippp0 device could not be found in /proc/net/dev The rci4l_hardware starts and capiinit also. But the isdnlog in kernel messages didn't recognize any incoming-ring and no outgoing calls are made. My hylafax-client on win9x tells me that the fax had successfully be send, but didn't really work!

2 1

SuSEfirewall runlevel errors at bootup
by Pao Sayaovang 21 Mar '01

21 Mar '01

Hello List: I have been monitoring the post to see if the SuSEfirewall run level scripts had been fixed. I'm was running SuSEfirewall version 4.3.x and upgraded to 4.4 yesterday without the run level error going away. This is just a annoyance and not a big problem as my firewall is running perfectly fine. Sorry If I had missed the posting on this fix but I've looked at all the previous postings and could not find the applied solution. Previous email listing ---------------------------------------------------------------------------- -- A customer had bought the new SuSE Linux. I saw there were lots of changes... e.g. the fiewall script "SuSEfirewall". It runs three times. On the installation we have the following problem: the first time the firewall script runs the Network is not up so we only get an error message. Can someone tell me if this is normal or how I can fix this. Since I didn't get the subscription-update until now - I don't have anything here to make experiments or to read... Thanx for any hint. Christian ___________________________________ Pao Sayaovang Systems Analyst - Telecom Admin Weyco Group, Inc. DID(414) 908~1813 Fax(414) 908~1913 psayang(a)weycogroup.com

1 0

SuSEfirewall 4.3-3 and dial-up connections
by Thorsten Stoelk 21 Mar '01

21 Mar '01

hi, I installed the SuSEfirewall 4.3-3 and set it up with an ISDN card as ext. device. On startup, the firewall protects the given ip (192.168.0.1). When I dial in (kinternet) no connections can be made. So I added /etc/ip-up.local witch includes: /sbin/SuSEfirewall2 start now everything works. Is it ok or may I get get into trouble? Thanx Thorsten

2 2

SuSEfirewall refuses to work after nameservers are definded (was: Bei Nutzung von...)
by Thorsten Büker 21 Mar '01

21 Mar '01

Hi! I have to apologize for the german-only mail I sent a couple of minutes before. A subscriber of this list informed me, that this mailing-list is lead in English. I'm sorry I didn't know this, I found the address in a German SuSE-manual. Nevertheless I seek and hope for your help ;-) The firewall on our freshly installed box runs fine as long as no nameservers are defined. I'm talking about the nameservers of our provider, we don't run named on our machine. After defining two nameservers using Yast, the command dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart delivers Starting Firewall Initialization: (phase 3 of 3) and stops. If the firewall is started during a reboot it stops after phase2. Without nameservers in /etc/resolve.conf it is possible to restart the firewall: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done We configured the firewall as desribed in the manual, I have no idea, what might be wrong. Maybe these variables can help you: FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Do you have the right hint for us? Thanks a lot and kind regards from Cologne, Thorsten

2 1

Bei Nutzung von Nameservern bleibt SuSEfirewall hängen
by Thorsten Büker 20 Mar '01

20 Mar '01

Hallo! Nachdem ich im Handbuch, der SDB und bei einer - zugegeben zügigen - Suche in deja nichts finden konnte, wende ich mich an Euch. Ich hoffe, Ihr könnt mir helfen. Die Firewall auf unserem neu-installierten Rechner läuft tadellos, lediglich im Zusammenhang mit unseren Nameservern haben wir ein Problem. Es geht lediglich um die Abfrage von externen Nameservern, wir haben selbst keinen named laufen. Nachdem die Nameserver mittels YaST eingerichtet sind, bleibt ein dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart nach der Ausgabe von Starting Firewall Initialization: (phase 3 of 3) ohne Meldung hängen. Wird die Firewall im Rahmen eines Neustart initialisiert, so hängt sie sich bereits bei Phase 2 auf und es hilft nur der Umweg über eine Bootdisk. Nach dem Weg-Kommentieren der Nameserver in /etc/resolve.conf geschieht das folgende: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done Gemäss den Hinweisen im Handbuch ist die Firewall wie folgt konfiguriert, ich hoffe, ich habe die entscheidenden Variablen getroffen. FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Habt Ihr einen Tipp, was ich noch ändern muss? Vielen Dank, Gruss aus Köln, Thorsten

1 0

squid <--> raptor
by Thomas Hartmann 20 Mar '01

20 Mar '01

Hallo Leute, habe auf einer Suse 7.0 Box squid installiert. Diese muß durch einer Firewallbox hindurch. Deshalb habe ich in meiner Config einen cache_peer - Parent-Eintrag vorgenommen. Auch habe ich mit never direct all versucht keinen direkt zugriff zuzulassen. Wenn ich jetzt mit einem Client versuche eine Seite aufzurufen, muß ich ca. 5 minuten warten bis die seite kommt (ohne Bilder) und jedes weitere bild dauert dann auch wieder so lange? Ein strace zeigt: dns - anfragen werden sofort aufgelöst, dann versucht squid direkt den web-server zu erreichen, geht aber nicht wegen der firewall! Kann squid nicht gleich die Raptor-box auf Port 80 anfragen? Was muß ich da tun? Gruss Thomas

1 0

popper
by Nix 20 Mar '01

20 Mar '01

Does anyone know of a way to stop popper from doing ident and reverse dns lookups everytime someone connects? I can't seem to find any info on how to do it in the usual places. It takes insufferably long to connect to pop3 on a server I have just built. For ident I have configured my firewall to reject instead of drop, (it's a FW-1 box) but it doesn't seem to speed up connections any. I some instances the connections are coming through up to 5 firewalls, some NATed, some private addresses, and some public. (also via IPsec connections) Obviously not all of these addresses have reverse dns set, So I think that is the problem. (it may not be.. is there any other known reason for popper to be VERY slow to connect?) Any ideas? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

7 8

netfilter documentation
by Greisberger Christophe 20 Mar '01

20 Mar '01

Do anyone know a detailed documentation on netfilter? I read the HOWTOs on http://netfilter.filewatcher.org/ but it didn't helped me much. I want to setup masq+firewall+port forwarding. So if anyone could send me a sample config script that's doing that, it = would help me much. Thanks! -- Christophe Greisberger Zenon-Media GmbH Phone: +49 (7852) 9133 / 34 Fax : +49 (7852) 9133 / 35

3 2

Starting SuSefirewall 4.4
by Dietmar Strasdat 20 Mar '01

20 Mar '01

Hello Listuser, after updating my SuSE 7.0 Kernel 2.2.16 with Marcs firewall 4.4 the first service SuSEfirewall_init fails. I dont know why, cause the rel 4.2 works fine. In init.d/rc2.d SuSEfirewall_init starts with kerneld as S01... Any hints? -- Best regards, Dietmar mailto:earthmate@gmx.net

4 3

RE: [suse-security] Router with NAT <-> SW-Firewall <-> HW-Firewa ll
by Reckhard, Tobias 20 Mar '01

20 Mar '01

> (a) What is a router with NAT for ? > It provides access to a network for machines with IP addresses that are unknown on that network by mapping the original source sockets to sockets on the NAT gateways interface connected to the network that access is desired to. > - is there the posibility of dialing in via internet > The NAT gateway is connected to the Internet, so it can be accessed normally. It should not be possible to directly access machines in the network behind the NAT gateway (from the Internet's point of view). However, it could be possible to hijack TCP sessions or fool the NAT engine. This has happened with UDP in the past. > - in which area is a router better / worse than a simple paket-filter > SW-firewall with masquerating (NAT) > You need to be more specific. The feature list of Linux boxes is very long and Cisco routers have a large set of features as well. Linux has ipchains (stateless) and iptables (stateful) for packet filtering, IP Masquerading is stateful per definition. Cisco routers have three types of access control lists ('basic', extended and reflexive), one of which is stateful, and there exists a 'firewall feature set' (CBAC) that can perform some inspection of some protocols. Ciscos also have NAT support. Linux is more extensible, but more work initially. > (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. > > - what is missing ? is it enough ? > You don't have any application-level inspection. I try to use application proxies wherever I can, they give you protection an order of magnitude higher than packet filters. Of course, it always depends on how much you trust your machines' TCP/IP stacks. Those are protected by proxies, but usually not by packet filters (well, making a Linux router defragment all packets does give some protection). > (c) what supports a hardware firewall instead of an software firewall ? > > - why is it better than a software firewall ? (is it really better ?) > There is no such thing as a hardware firewall. All firewalls are combinations of hardware and software. Cheers, Tobias

1 0

firewall and dns
by Thorsten Marquardt 19 Mar '01

19 Mar '01

Hi, I'm in trouble with firewals-2.6-33 and ipchains-1.3.9-173 (SuSE7.0). I like to run bind9 on the firewall and this are the settings from /etc/rc.config.g/firewall.rc.config: FW_DEV_WORLD="ippp0" #FW_DEV_WORLD_ippp0="192.168.2.99 255.255.255.255" # e.g. for exernal interface ippp0 FW_DEV_INT="eth0" FW_DEV_INT_eth0="192.168.0.4 255.255.255.0" # e.g. for internal interface eth0 FW_DEV_DMZ="" #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # e.g. for dmz interface eth1 FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="domain" # Common: domain FW_SERVICES_DMZ_TCP="smtp domain" # Common: smtp domain FW_SERVICES_DMZ_UDP="domain syslog" # Common: domain syslog FW_SERVICES_INTERNAL_TCP="ssh smtp domain www 3128" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="domain" # Common: domain FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" FW_SERVICE_DNS="yes" # if yes, FW_SERVICES_*_TCP needs to have port 53 FW_SERVICE_DHCLIENT="no" # if you use dhclient to get an ip address FW_SERVICE_DHCPD="no" # set to "yes" if this server is a DHCP server FW_SERVICE_SAMBA="no" # set to "yes" if this server uses samba as client FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_MASQ_TCP="" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" But starting the firewall-script leads to this errors- Starting Firewall Initialization: (final run) /sbin/ipchains: invalid port/service `1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack' specified Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. Whats going wrong? Yours Thom -- Experience is directly proportional to the value of equipment destroyed. -- Carolyn Scheppner ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de -------------------------------------------------------------------

1 0

Where to find a good intro to ipchains for a dial-up linux box ?
by Marko Kaening 19 Mar '01

19 Mar '01

Hi, much is read about ipchains in this list. I know there are also howtos about this subject, sure. But maybe somebody could give me a hint concerning a good introduction to how to set-up a firewall using ipchains with SuSE? Unfortunately I found only manuals which explain how to firewall bigger networks, but I have a single host which I connect from time to time to the net. So I think setting-up such a thing should be a lot easier. BUT how? Any help welcome. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

7 7

smtp_auth
by Simon Dittlmann 19 Mar '01

19 Mar '01

Hello, where can I finde information about smtp_auth? thanks. cu, sd

2 1

Re:who are logged in ?
by omicron 19 Mar '01

19 Mar '01

hi i installed whowatch, and while it is better than anything i've seen it still does not tell me about ftp, pop,etc. Surely the OS knows who are logged in and all i've to do is get the info from the OS . But how ? regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

network interface problem
by jonathan 17 Mar '01

17 Mar '01

I just loaded 7.1 and a recomplied the 2.4 kernel (with ipmasq and iptables support) and I am getting an error message for my second network interface. I can do in ifconfig and the interface is up but here is the message from /var/log/messages: Mar 17 19:14:43 lucky kernel: NETDEV WATCHDOG: eth1: transmit timed out Mar 17 19:14:43 lucky kernel: eth1: Transmit timed out, status fc124010, CSR12 00000000, resetting... I am using Linksys cards, I am having no problems with them on other systems and tried replacing the card. Any help / ideas would be greatly appreciated. TIA

1 0

SuSEfirewall2 and 2.4 help needed, PLEASE
by jonathan 17 Mar '01

17 Mar '01

I am trying to get the new firewall2-0.5 to work with kernel2.4 that came with SuSE7.1. I have the firewall config file set but the init, start and final run scripts fail on boot up. Could someone please tell me what options I need to have set in the kernel to use iptables. This box will serve as a firewall and ipmasq box from my home network to my cable ISP. I have been able to get previous versions of the SuSEfirewall scripts to work great with IPChains, but the new iptables is a different story. Any help/comments would be greatly appreciated. TIA

1 0

all network ports in use
by Christian Boxhammer 17 Mar '01

17 Mar '01

Hi, There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. Trying to log in with telnet procudes the following error Message: "telnetd: all network ports in use" In such a case it is not possible to log into the machine for several hours. Is this because of a portscan an anything else? Did anyone have a similar Problem? Christian Boxhammer -- Linux is like a Wigwam.. No Windows, no Gates, and Apache inside

9 10

SuSEfirewall*
by marc＠suse.de 17 Mar '01

17 Mar '01

Hi folks, SuSEfirewall-4.4 and SuSEfirewall2-0.5 are active now (available at http://www.suse.de/~marc/SuSE.html) if you installed the official SuSEfirewall-4.3 rpm - it is nearly the same as v4.4.tar.gz, however the rpm is not for SuSE 6.x machines, the .tar.gz works fine. Only minor fixed vor v0.5 please: if something is not working for you (and it is not a configuration error ...) please report to me! send me "SuSEfirewall status; grep ^FW /etc/rc.config.d/firewall*" and about harden_suse: the v3.1 is available for some time now, the official rpm update will be out the next days. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

2 2

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ----- End forwarded message ----- -- Togan Muftuoglu

1 0

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu

1 0

Router with NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Hello ! I have seen, it is an english list ! I want to know the differences between a router with NAT, a software firewall and hardware firewall. Maybe one of you have some links to an web-page or article. I read the book "Linux Firewall from R. Ziegler" an therefore I known the strategie of paket-filtering. (a) What is a router with NAT for ? - is there the posibility of dialing in via internet - in which area is a router better / worse than a simple paket-filter SW-firewall with masquerating (NAT) (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. - what is missing ? is it enough ? (c) what supports a hardware firewall instead of an software firewall ? - why is it better than a software firewall ? (is it really better ?) thanks Harald

1 0

Router mit NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Liebe Gemeinde ! Ich versuche mich gerade in den Bereich "Sicherheit" einzuarbeiten und suche Unterlagen oder einen Vergleich zu folgende Schutzarten: Anmerkung: mein Grundwissen ist das Verstandnis der SuSE- Firewall aus Theorie (Bucher "Linux Firewall, R. Ziegler" als Paketfilter) und Praxis. (a) Was deckt ein Router mit NAT (masquerading) ab ? - kann ich mich dann uberhaupt von "drau?en" einwahlen ? - was kann ein Router mehr oder weniger als die SusE-FW ? (b) Welchen Schutz bietet eine LINUX-Firewall (ist ja nur Paketfilter) - altbekannte Thematik aus Buchern (c) eine richtige Hardware-Firewall - was kann eine HW-Firewall mehr als eine SW-Firewall (SuSE) lg Harald

1 0

strange fw log entry
by Michael Keyl 15 Mar '01

15 Mar '01

hi, I have just found the following lines in the log file of my firewall: Mar 14 17:45:06 linux sshd[8830]: Server listening on 0.0.0.0 port 22. Mar 14 18:27:30 keyl kernel: Packet log: input DENY eth0 PROTO=6 134.169.85.76:47157 0.0.0.0:0 L=40 S=0x00 I=43008 F=0x4000 T=1 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 11:02:37 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 11:02:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 12:15:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 12:15:42 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 12:15:43 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 12:15:47 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 17:02:45 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=1 F=0x4000 T=60 (#45) Mar 15 17:02:46 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#45) Mar 15 17:02:48 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=3 F=0x4000 T=60 (#45) Mar 15 17:02:52 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#45) Can anybody explain me what is going on there? Bye, Michael

3 2

problem mit spam und inflex
by Wolfgang Schäfer 14 Mar '01

14 Mar '01

Hi an ALLE, ich setze SuSE 6.3/6.4 ein! Ein firewall mit proxy, einen mailserver usw. Der firewall-Rechner leitet die mails direkt an den mailserver-Rechner weiter. Der mailserver läuft jetzt mit sendmail 8.11.0 von SuSE. Soweit ist das ganze spam-sicher. Wenn ich aber inflex benutzen will hab ich ein open relay! Was tun? Soll ich auf dem firewall noch einen mail2-server aufbauen, der dann spam-sicher ist und alle mails an den eigentlichen mail-server weiterleitet, oder gibt es andere scanner die auch Dateitypen filtern? Gruss -- _______________________________ Wolfgang Schaefer Diplom-Ingenieur (FH) Elektronik Systemadministrator Fon +49-(0)7308-818-22 Fax +49-(0)7308-818-65 busse design ulm gmbh Nersinger Str. 18 89275 Elchingen / Ulm, Germany http://www.busse-design-ulm.de _______________________________

3 2

Re: [suse-security] Obtuse SMTPD problem
by andreas.baetz＠herma.de 14 Mar '01

14 Mar '01

nix wrote: >I have a problem with the version of Obtuse SMTPD that is >precompiled with SuSE 7.0 >It does not seem to be able to resolve names of connections >even though they do have reverse DNS. >Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) >Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as Let's suppose your smtpd runs chrooted in /var/spool/smtpd. Did you check that the lib files for name resolution are present in /var/spool/smtpd/lib ? There should be at least libnss_dns.so.2 and libnss_files.so.2 (for SuSE 6.3, don't know for 7.0). Also check that the files /var/spool/smtpd/etc/nsswitch.conf, /var/spool/smtpd/etc/resolv.conf /var/spool/smtpd/etc/hosts are present and have the right contents. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

2 1

Update to Apache 1.3.17-0 (SuSE 6.3)
by Holger-Schmidt＠arcor.net 13 Mar '01

13 Mar '01

Hi all, while using SuSE 6.3 I updated the Apache to Version 1.3.17-0 from FTP-Server. After updating the packages on our systems I 've got an error message while restarting the apache with "rcapache restart": rcapache: /etc/rc_status: no such command or file There is no file /etc/rc_status. For what is it ? Do I need it ? After removing this program call out of the startup script, the restart works. Hope somebody can answer my question. Bye Holger

2 1

Ipchains log messages
by Christian Bohn 13 Mar '01

13 Mar '01

Hi! my ipchains is producing the following output in the logfiles: Mar 13 15:35:32 clint kernel: Packet log: input DENY eth0 PROTO=1 aaa.aaa.aaa.aaa:8 bbb.bbb.bbb.bbb:0 L=84 S=0x00 I=11654 F=0x0000 T=57 (#792) I wonder why I get this messages because the IP-Adress bbb.bbb.bbb.bbb is none of mine! (but its in the same subnet) Its very annoying because Host aaa.aaa.aaa.aaa is sending ICMPs to bbb.bbb.bbb.bbb for several hours now, and my logfile is growing quite big... bye Christian

3 3

Re: I would like to be on your mailing list
by Roman Drahtmueller 13 Mar '01

13 Mar '01

> Subject: I would like to be on your mailing list > > I have just purchased SuSe Linux 7.1 Professional and would like to be > added to the security mailing list > > My e-mail address is: CharleeChinks(a)aol.com > > Thank you Please go to http://www.suse.de/en/support/mailinglists/index.html and subscribe yourself. Thank you, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

TLS and Sendmail
by Nix 13 Mar '01

13 Mar '01

Has anyone else successfully configured TLS on sendmail in SuSE 7.1? I have installed the sendmail-tls package from the sec section, but I can't find any ttls related doco anywhere. There is certainly nothing in /usr/share/doc/packages/sendmail that relates to it. Help Anyone? Do i need to configure certificates etc? I assume I do, but nothing seems to exist to describe how.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Obtuse SMTPD problem
by Nix 13 Mar '01

13 Mar '01

I have a problem with the version of Obtuse SMTPD that is precompiled with SuSE 7.0 It does not seem to be able to resolve names of connections even though they do have reverse DNS. For instance, here are some logs where there is an SMTP connection initiated from 9.9.9.9 which resolves to the.gov (Names/IPs have been changed) As you can see from the 5th line, SMTPD does not actually managed to resolve the IP to a name. This limits some of the rules that you can use with SMTPD and makes it less useful. Is there an easy way to fix this?? Mar 13 16:14:19 mayhem smtpd[3775]: smtpd running in Paranoid mode Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as "the.gov" Mar 13 16:14:19 mayhem smtpd[3775]: mail from <daffy.duck(a)the.gov> Mar 13 16:14:19 mayhem smtpd[3775]: smtp connection from UNKNOWN(a)UNKNOWN(9.9.9.9) MAIL FROM: <daffy.duck(a)the.gov> RCPT TO: <bugs.bunny(a)mydomain.com>, allowed by line 49 of /etc/smtpd_check_rules Mar 13 16:14:19 mayhem smtpd[3775]: Recipient <bugs.bunny(a)mydomain.com> Mar 13 16:14:19 mayhem smtpd[3775]: Received 6236 bytes of message body from UNKNOWN(9.9.9.9) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

RE: [suse-security] Dynamic routgin
by Björn Engels 13 Mar '01

13 Mar '01

Give this a try (I'm not good in scripting, but it works for me): #!/bin/bash GW1="192.168.10.4" GW2="19.18.31.18" TEST=$GW1 echo "Setting default gw to $GW1" route add default gw $GW1 route -n echo Starting gateway test ... while true ; do echo "GW1: $GW1, GW2: $GW2, testing $TEST" ping $TEST -c 1 > /dev/null 2>&1 # $? returns 1 if host if [ $? = 1 ] ; then echo Gateway is down, resetting routes ... route del default gw $GW1 route add default gw $GW2 route -n if [ $TEST=$GW1 ] ; then TEST=$GW2 else TEST=$GW1 fi echo "Now testing $TEST" fi done

3 2

who are logged in ?
by omicron 12 Mar '01

12 Mar '01

hi all w, who, finger commands tell me who are all logged in _and_ alloted tty's. if a person uses ssh -T , or rsh, then i cannot find out on the fly without examining the logs. same goes for ftp too. If i want to watch the users logged in then , there really are few options to me ... closely examine the log files ( i put "*.* /dev/tty12" in my syslog.conf), checking the ps tree often but they dont help much. In short, i want the wtmp record to be written if there is logins in the below given categories. i think it might be to do with pam, but i really dont know much of pam usage, and i'm at a loss. So is there any single tool which tells the logins in the foll protocols.. 1> telnet / ssh logins with pty allocation as in normal who 2> ssh, rsh logins without pty allocation 3> ftp , preferably with the files being transferred 4> pop3 or is this too much to ask ? i dont mind if such a tool is su-only ,or requires priv mode. anything will do as long as i get the above ... regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

5 4

Personal Firwall vs. SuSEfirewall
by Ernst Koch 12 Mar '01

12 Mar '01

Do I need both Personal Firewall and SuSEfirewall or is Personal Firewall enough for a single box only connected to the internet? Regards Ernst -- Sent through GMX FreeMail - http://www.gmx.net

2 1

Why apache-1.3.17 ... leads to probs with .htaccess
by Gerd Aschemann 12 Mar '01

12 Mar '01

What is the reason to upgrade to Apache-1.3.17 with SuSE 7.0? I have been looking into the page with current fixes for SuSE 7.0 http://www.suse.de/de/support/download/updates/70_i386.html recently and found that Apache needs to be fixed. So I applied the recommended rpms (besides Apache some of the modules: - mod_php4-4.0.4pl1-19 - mod_perl-1.24-74 - modcontr-1.0.7-154 ) and all went ok. But today one of my users claimed that pages with .htaccess are no longer accessible. I investigated the problem and found that the respective Apache child process aborts with a segmentation fault ... Any ideas? I could not find a reason why to upgrade to 1.3.17 (I do not read the Apache mailing lists). Regards, -- Gerd Aschemann --- Veröffentlichen heißt Verändern (Carmen Thomas)

4 6

compartment and bind8
by Björn Engels 11 Mar '01

11 Mar '01

Hi ! I am running the latest bind8 rpm package from SuSE and I want to put it into a chrooted environment with Marc's "compartment". I am wondering if it is safer if I run bind as user root, but chrooted, or if I run it normally, but as user named. Removing the caps option and adding --user named --group named does not work, because the server isn't allowed to bind to ports < 1024. So what to do ? Björn

4 3

Dynamic routgin
by SUSE Mailing list 11 Mar '01

11 Mar '01

Does anyone know how to config route tables for dynamic routing. I would like to set 2 default gateways and if nobmer 1 is unavalible, system would use second one. Thanx, Tic Pavlin Neosystems Slovenia

2 1

Mail-Attachments
by Christian Erpelding 11 Mar '01

11 Mar '01

Hi there, I want to filter out some mail-attachments on our mailserver for security reasons. Any attachments ending with .vbs, .exe, .com and so on should be bounced when they come from a remote host and are addressed to a local user. We use SuSE 7.1 (Kernel 2.2.18), Sendmail 8.11 and Amavis 0.1.2 with avplinux as virusscanner. The incoming mails are fetched by fetchmail using pop3 as protocol. (Fetchmail is running as root and fetches all incoming mails for our domain) Any ideas how to create such filter rules? Thanks in advance, Christian --- MfG, Chr. Erpelding ce-data datentechnik erpelding(a)ce-data.de

4 3

firewall rule for talk
by Marco Ahrendt 09 Mar '01

09 Mar '01

hi list, is it possible to accept the "talk" application in any way? I tried to -j ACCEPT the udp port but talk isn't really using these ports for chatting. only the first packets are over udp 518 for example. then the client (remote) sends a new packet (syn) with totally different ports. does anyone has a solve? marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

2 4

AW: [suse-security] Mail-Attachments
by Payreder Roman 09 Mar '01

09 Mar '01

Hi, i just use Postfix and the procmail-security script (html-trap.procmail) which can rename such files, so that the arent executable anymore. It works fine for me. Besides, it also filters rename the javascript,... tags in HTML Mails: http://www.impsec.org/email-tools/procmail-security.html br, Roman

1 0

Secumod
by Richard 09 Mar '01

09 Mar '01

Dear All Just out of curiosity I've installed secumod 1.6a from the 7.0 RPMs under sec1 on the CDs. The docs tell me to do 'insmod secumod.o' to start secumod but when I do that I get "secumod.o: No such file or directory" printing out on the screen on my SuSE 7.0 system. I can also see that there's a list of options such as "insmod secumod.o [OPTION]=[OPTION]". They don't work either. I think there might be a newer version but the problem is the lack of documents to give more detail about what to do with this package. Marc's done some really nice work with this but it's hard to figure it out without some help. Thanks Richard

6 12