March 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> AFAIK you should NEVER use a > proxy etc. on any firewall due to the buffer- > overflow-problem. sorry... > Huh? Get real, man, with that attitude you shouldn't connect anything to an untrusted network, as any application could be susceptible to buffer overflows. And check out the literature on firewalls whenever you have a bit of spare time, I recommend the 2nd edition of 'Building Internet Firewalls' by Chapman, Cooper and Zwicky. Most, if not all, of the firewall people prefer application layer gateways, aka application proxies, over packet filters when constructing firewalls. And I'd much rather have only one application, the proxy, to watch for a compromise than the entire number of client applications.. Cheers, Tobias

5 5

Kernel Backdoor (April Fool's joke)
by Roman Drahtmueller 29 Mar '01

29 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- To those involved in Linux security: The latest release of "Linux-Magazin", a monthly German magazine that focuses on Linux, contains an article by Mirko Dölle about security problems in the Linux kernel. In particular, the article argues that IP packets could be forwarded to the address 208.47.125.33 (there is a PTR record at gary7.nsa.gov, which has an A record back to the same address). Many German Linux users have been calling SuSE support to learn details on how to deal with this problem, not willing to believe that the article is an April Fool's joke on security. None of the claims are correct, which makes a kernel update unnecessary for this particular problem. Now, as inclined readers of security mailing lists may have noticed, there are indeed security problems in the Linux kernel. These problems are no backdoors of any kind, and they are not related to the article mentioned above. In addition, the known kernel security issues are not remotely exploitable, which means that local shell access is needed to take advantage of the weaknesses. The weaknesses allow for a local attacker to gain superuser access to the system. SuSE will provide update packages for the supported distributions 6.3, 6.4, 7.0 and 7.1 shortly that eliminate the known problems. The SuSE kernels are standard kernels, equipped with a set of patches that introduce drivers and many other enhancements to the standard Linux kernel. The update packages are currently being tested and will be available and announced as soon as possible. As an information for those who compile and install their own kernels: The freshly released Linux kernel version 2.2.19 fixes the known issues in the kernel. It should run smoothly on all 6.x SuSE Linux distributions, but please note that 2.2.19 requires update packages for the lvm and/or the raidtools (formerly mdutils) package if lvm (logical volume manager) or the software raid facility of the Linux kernel are used. The lvm package is available for download from our ftp server ftp.suse.com, the raidtools package will follow soon. Regards, Roman Drahtmüller, SuSE Security -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOsM8uney5gA9JdPZAQGnRggAkh+oXciCyj07rUgi0YJ4DEQVYopJRZQw oYFcktCTC/CYXE42ZEkChlMO9UA2Op6kiFyqDnaIKo12C1555CxAJgjszQfAjPCe 1b2kxLNtY0GvibkFHjgJ5BLeh7rM3d7bMoA14HKSNXcHDQIuJEUD0Hh0ENe4fNng qfZNHsd2EIdkjN3ncuQGjqPvy5N+se145OrEUGsOFY5Xb1KajxJhd8SlJ8+VkjTA 5tRi4NvLUZqdk1eKPvcKSkIuuv/rmSSOBEASUr/dEmy4Z8guVNW3qP6jk4HtPjYp 23yTkhZDHaYpCC7S/gMoU3pSrre0nh51W6yQx1oBOqaWZJtLSUJ+2A== =RpeD -----END PGP SIGNATURE-----

1 0

Lion worm with SuSEfirewall blocked?
by Marko Kaening 29 Mar '01

29 Mar '01

Hi, at http://www.sans.org/y2k/lion_protection.htm one can read how to prevent Lion attack using ipchains. Is this already included in the SuSEfirewall 4.4? Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

2 1

Security updates and You
by Togan Muftuoglu 29 Mar '01

29 Mar '01

Hi, I might be wrong in jumping in making an assumption yet when I clicked the location mentioned in the message with the subject [suse-security] Lion worm with SuSEfirewall blocked? I out of curiosity cliked the link to the suse update site mentioned where I have been informed regarding teh apache update with security fix note. 1) Has there been a security announcement for that which I accidently did not noticed. If there was none the package is dated 21 st March meaning a week over so there is something missing. Or alternativle apache 1.3.17 is not vulnarable. 2) patches directory does not have anything regarding apache so if you do an update with YOU you will not get it. I though YOU was for security fixes Sorry if there had been an announcement an I have missed it -- Togan Muftuoglu

1 0

security checking daemons
by Morsal Roudbay 29 Mar '01

29 Mar '01

I have installed several security checking deamons that come with SuSE 7.0. Daily, weekly and monthly reports are all sent to root... Is it possible to somewhere change this setting so it's sent to an email account of mine? Thanks in advance.

3 2

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 29 Mar '01

29 Mar '01

> > However, of course you'll have programs running on the packet filter > > as well. First, there's the kernel. Then you've probably got syslogd > > and crond running. > > A DHCP client is more likely. I would not have crond, the only thing ... [large snip] Yeah, whatever. Those are good ideas, Mike, but my point was *that* he'll have software running on a packet filter, not *what* software that is exactly. That's an entirely different and rather large can of beans.. Cheers, Tobias

1 0

Re: [suse-security] dns zone x-fers on tcp 53
by Markus Gaugusch 28 Mar '01

28 Mar '01

> What is the reason for installing pri dns server in a self owned DMZ and sec > dns server at the isp? Convenience - you can manipulate the zones easier. > If the firewall ist not stateful this enables inet users to do dns > probes on tcp 53 and other worse things. why? you can block tcp port 53 for everyone except the ip of the secondary NS. bye Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

2 1

do these log entries document attacks?
by Christian Gorski 28 Mar '01

28 Mar '01

hallo friends of linux does anybody know what i´ve got here, where X.X.X.1 is the box which logs these messages? 1) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=59472 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=60496 F=0x4000 T=111 SYN (#42) Mar 27 19:46:38 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=337 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=3921 F=0x4000 T=111 SYN (#42) Mar 27 19:46:39 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4590 X.X.X.255:27374 L=48 S=0x00 I=6993 F=0x4000 T=111 SYN (#42) Mar 27 19:46:41 linux kernel: Packet log: input DENY eth0 PROTO=6 212.94.211.160:4586 X.X.X.1:27374 L=48 S=0x00 I=18257 F=0x4000 T=111 SYN (#42) 2) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.1:28431 L=29 S=0x00 I=44573 F=0x0000 T=119 (#42) Mar 27 20:26:44 linux kernel: Packet log: input DENY eth0 PROTO=17 212.93.208.240:28432 X.X.X.255:28431 L=29 S=0x00 I=45597 F=0x0000 T=119 (#42) 3) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1002 X.X.X.1:111 L=60 S=0x00 I=38602 F=0x4000 T=49 SYN (#42) Mar 27 21:38:29 linux kernel: Packet log: input DENY eth0 PROTO=6 207.194.143.211:1006 X.X.X.255:111 L=60 S=0x00 I=38606 F=0x4000 T=49 SYN (#42) 4) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=34799 F=0x4000 T=46 SYN (#42) Mar 28 02:17:11 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2716 X.X.X.255:53 L=60 S=0x00 I=34843 F=0x4000 T=46 SYN (#42) Mar 28 02:17:17 linux kernel: Packet log: input DENY eth0 PROTO=6 207.18.60.53:2712 X.X.X.1:53 L=60 S=0x00 I=36023 F=0x4000 T=46 SYN (#42) 5) Mar 28 08:36:18 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61465 F=0x0000 T=105 (#42) Mar 28 08:36:20 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61721 F=0x0000 T=105 (#42) Mar 28 08:36:21 linux kernel: Packet log: input DENY eth0 PROTO=17 210.104.121.253:55675 X.X.X.1:137 L=78 S=0x00 I=61977 F=0x0000 T=105 (#42) tia cg

4 4

dns zone x-fers on tcp 53
by Philipp Snizek 28 Mar '01

28 Mar '01

Dear list users, What is the reason for installing pri dns server in a self owned DMZ and sec dns server at the isp? If the firewall ist not stateful this enables inet users to do dns probes on tcp 53 and other worse things. Thank you all for a quick answer, Philipp

2 1

RE: [suse-security] AW: Squid on Firewall?
by Reckhard, Tobias 28 Mar '01

28 Mar '01

Re Daniel. > yes, your are right! getting compromised by a > client applications isn't good indeed...;-) > It sure ain't. :-) > but that wasn't my hint about this topic. > my idea is to separate your system into two > ones: > first you have a hardened firewall-system without > any programm running on it. > second there is a proxy-server behind the wall with > "your" application proxies. > So you mean a pure packet filter when you say 'hardened firewall-system'? I call that a packet filter. :-) Yes, it generally makes sense to have a packet filter as the point of entry to your network. However, there are a couple of possible architectures. Quoting from the book I named: 1. Single-box architectures: screening router, dual-homed host. 2. Screened host architectures 3. Screened subnet architectures 4. Architectures with multiple screened subnets: split-screened subnet, independent screened subnet 5. Variations on firewall architectures If what you're proposing is a packet filter up front and a proxy in the internal network, then you have a screened host architecture. A screened subnet architecture, in which the screened subnet is referred to as a DMZ, is more common in the corporate world. Most Linux home users use a single box, either as a screening router (if they only use ipchains) or, if they're running (some) proxies on the box, as something you could term a hybrid between a screening router and a dual-homed host, or a collapsed DMZ. The latter is the setup described by the initiator of this thread. It is stupid, yes, not to perform packet filtering on a proxy that is part of a firewall system, if you can. However, of course you'll have programs running on the packet filter as well. First, there's the kernel. Then you've probably got syslogd and crond running. Unless you're performing administration from the console only, you'll probably have sshd running. Cheers, Tobias

2 1