March 2001 - openSUSE Security - openSUSE Mailing Lists

Capi4Linux and capi4hylafax
by Technik NIT 21 Mar '01

21 Mar '01

Hello, world I had a problem with my Hylafax-server on SuSe7.0 I had installed my Fritz!Classic with the drivers from AVM-Homepage(capi4linux and capi4hylafax). But now when i change my i4l to AVM B1 PCI and want to restart it i get the error message: /dev/isdninfo no such file or dir. And the ippp0 device could not be found in /proc/net/dev The rci4l_hardware starts and capiinit also. But the isdnlog in kernel messages didn't recognize any incoming-ring and no outgoing calls are made. My hylafax-client on win9x tells me that the fax had successfully be send, but didn't really work!

2 1

SuSEfirewall runlevel errors at bootup
by Pao Sayaovang 21 Mar '01

21 Mar '01

Hello List: I have been monitoring the post to see if the SuSEfirewall run level scripts had been fixed. I'm was running SuSEfirewall version 4.3.x and upgraded to 4.4 yesterday without the run level error going away. This is just a annoyance and not a big problem as my firewall is running perfectly fine. Sorry If I had missed the posting on this fix but I've looked at all the previous postings and could not find the applied solution. Previous email listing ---------------------------------------------------------------------------- -- A customer had bought the new SuSE Linux. I saw there were lots of changes... e.g. the fiewall script "SuSEfirewall". It runs three times. On the installation we have the following problem: the first time the firewall script runs the Network is not up so we only get an error message. Can someone tell me if this is normal or how I can fix this. Since I didn't get the subscription-update until now - I don't have anything here to make experiments or to read... Thanx for any hint. Christian ___________________________________ Pao Sayaovang Systems Analyst - Telecom Admin Weyco Group, Inc. DID(414) 908~1813 Fax(414) 908~1913 psayang(a)weycogroup.com

1 0

SuSEfirewall 4.3-3 and dial-up connections
by Thorsten Stoelk 21 Mar '01

21 Mar '01

hi, I installed the SuSEfirewall 4.3-3 and set it up with an ISDN card as ext. device. On startup, the firewall protects the given ip (192.168.0.1). When I dial in (kinternet) no connections can be made. So I added /etc/ip-up.local witch includes: /sbin/SuSEfirewall2 start now everything works. Is it ok or may I get get into trouble? Thanx Thorsten

2 2

SuSEfirewall refuses to work after nameservers are definded (was: Bei Nutzung von...)
by Thorsten Büker 21 Mar '01

21 Mar '01

Hi! I have to apologize for the german-only mail I sent a couple of minutes before. A subscriber of this list informed me, that this mailing-list is lead in English. I'm sorry I didn't know this, I found the address in a German SuSE-manual. Nevertheless I seek and hope for your help ;-) The firewall on our freshly installed box runs fine as long as no nameservers are defined. I'm talking about the nameservers of our provider, we don't run named on our machine. After defining two nameservers using Yast, the command dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart delivers Starting Firewall Initialization: (phase 3 of 3) and stops. If the firewall is started during a reboot it stops after phase2. Without nameservers in /etc/resolve.conf it is possible to restart the firewall: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done We configured the firewall as desribed in the manual, I have no idea, what might be wrong. Maybe these variables can help you: FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Do you have the right hint for us? Thanks a lot and kind regards from Cologne, Thorsten

2 1

Bei Nutzung von Nameservern bleibt SuSEfirewall hängen
by Thorsten Büker 20 Mar '01

20 Mar '01

Hallo! Nachdem ich im Handbuch, der SDB und bei einer - zugegeben zügigen - Suche in deja nichts finden konnte, wende ich mich an Euch. Ich hoffe, Ihr könnt mir helfen. Die Firewall auf unserem neu-installierten Rechner läuft tadellos, lediglich im Zusammenhang mit unseren Nameservern haben wir ein Problem. Es geht lediglich um die Abfrage von externen Nameservern, wir haben selbst keinen named laufen. Nachdem die Nameserver mittels YaST eingerichtet sind, bleibt ein dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart nach der Ausgabe von Starting Firewall Initialization: (phase 3 of 3) ohne Meldung hängen. Wird die Firewall im Rahmen eines Neustart initialisiert, so hängt sie sich bereits bei Phase 2 auf und es hilft nur der Umweg über eine Bootdisk. Nach dem Weg-Kommentieren der Nameserver in /etc/resolve.conf geschieht das folgende: dr-gonzo:/etc/rc.config.d # rcSuSEfirewall restart Starting Firewall Initialization: (phase 3 of 3) Warning: No nameservers in /etc/resolv.conf! done Gemäss den Hinweisen im Handbuch ist die Firewall wie folgt konfiguriert, ich hoffe, ich habe die entscheidenden Variablen getroffen. FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" FW_SERVICES_EXTERNAL_IP="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="dns" FW_SERVICE_DNS="no" Habt Ihr einen Tipp, was ich noch ändern muss? Vielen Dank, Gruss aus Köln, Thorsten

1 0

squid <--> raptor
by Thomas Hartmann 20 Mar '01

20 Mar '01

Hallo Leute, habe auf einer Suse 7.0 Box squid installiert. Diese muß durch einer Firewallbox hindurch. Deshalb habe ich in meiner Config einen cache_peer - Parent-Eintrag vorgenommen. Auch habe ich mit never direct all versucht keinen direkt zugriff zuzulassen. Wenn ich jetzt mit einem Client versuche eine Seite aufzurufen, muß ich ca. 5 minuten warten bis die seite kommt (ohne Bilder) und jedes weitere bild dauert dann auch wieder so lange? Ein strace zeigt: dns - anfragen werden sofort aufgelöst, dann versucht squid direkt den web-server zu erreichen, geht aber nicht wegen der firewall! Kann squid nicht gleich die Raptor-box auf Port 80 anfragen? Was muß ich da tun? Gruss Thomas

1 0

popper
by Nix 20 Mar '01

20 Mar '01

Does anyone know of a way to stop popper from doing ident and reverse dns lookups everytime someone connects? I can't seem to find any info on how to do it in the usual places. It takes insufferably long to connect to pop3 on a server I have just built. For ident I have configured my firewall to reject instead of drop, (it's a FW-1 box) but it doesn't seem to speed up connections any. I some instances the connections are coming through up to 5 firewalls, some NATed, some private addresses, and some public. (also via IPsec connections) Obviously not all of these addresses have reverse dns set, So I think that is the problem. (it may not be.. is there any other known reason for popper to be VERY slow to connect?) Any ideas? --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

7 8

netfilter documentation
by Greisberger Christophe 20 Mar '01

20 Mar '01

Do anyone know a detailed documentation on netfilter? I read the HOWTOs on http://netfilter.filewatcher.org/ but it didn't helped me much. I want to setup masq+firewall+port forwarding. So if anyone could send me a sample config script that's doing that, it = would help me much. Thanks! -- Christophe Greisberger Zenon-Media GmbH Phone: +49 (7852) 9133 / 34 Fax : +49 (7852) 9133 / 35

3 2

Starting SuSefirewall 4.4
by Dietmar Strasdat 20 Mar '01

20 Mar '01

Hello Listuser, after updating my SuSE 7.0 Kernel 2.2.16 with Marcs firewall 4.4 the first service SuSEfirewall_init fails. I dont know why, cause the rel 4.2 works fine. In init.d/rc2.d SuSEfirewall_init starts with kerneld as S01... Any hints? -- Best regards, Dietmar mailto:earthmate@gmx.net

4 3

RE: [suse-security] Router with NAT <-> SW-Firewall <-> HW-Firewa ll
by Reckhard, Tobias 20 Mar '01

20 Mar '01

> (a) What is a router with NAT for ? > It provides access to a network for machines with IP addresses that are unknown on that network by mapping the original source sockets to sockets on the NAT gateways interface connected to the network that access is desired to. > - is there the posibility of dialing in via internet > The NAT gateway is connected to the Internet, so it can be accessed normally. It should not be possible to directly access machines in the network behind the NAT gateway (from the Internet's point of view). However, it could be possible to hijack TCP sessions or fool the NAT engine. This has happened with UDP in the past. > - in which area is a router better / worse than a simple paket-filter > SW-firewall with masquerating (NAT) > You need to be more specific. The feature list of Linux boxes is very long and Cisco routers have a large set of features as well. Linux has ipchains (stateless) and iptables (stateful) for packet filtering, IP Masquerading is stateful per definition. Cisco routers have three types of access control lists ('basic', extended and reflexive), one of which is stateful, and there exists a 'firewall feature set' (CBAC) that can perform some inspection of some protocols. Ciscos also have NAT support. Linux is more extensible, but more work initially. > (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. > > - what is missing ? is it enough ? > You don't have any application-level inspection. I try to use application proxies wherever I can, they give you protection an order of magnitude higher than packet filters. Of course, it always depends on how much you trust your machines' TCP/IP stacks. Those are protected by proxies, but usually not by packet filters (well, making a Linux router defragment all packets does give some protection). > (c) what supports a hardware firewall instead of an software firewall ? > > - why is it better than a software firewall ? (is it really better ?) > There is no such thing as a hardware firewall. All firewalls are combinations of hardware and software. Cheers, Tobias

1 0