March 2001 - openSUSE Security - openSUSE Mailing Lists

firewall and dns
by Thorsten Marquardt 19 Mar '01

19 Mar '01

Hi, I'm in trouble with firewals-2.6-33 and ipchains-1.3.9-173 (SuSE7.0). I like to run bind9 on the firewall and this are the settings from /etc/rc.config.g/firewall.rc.config: FW_DEV_WORLD="ippp0" #FW_DEV_WORLD_ippp0="192.168.2.99 255.255.255.255" # e.g. for exernal interface ippp0 FW_DEV_INT="eth0" FW_DEV_INT_eth0="192.168.0.4 255.255.255.0" # e.g. for internal interface eth0 FW_DEV_DMZ="" #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # e.g. for dmz interface eth1 FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_MASQ_DEV="$FW_DEV_WORLD" # e.g. "ippp0" or "$FW_DEV_WORLD" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # "yes" is a good choice FW_SERVICES_EXTERNAL_TCP="smtp domain" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="domain" # Common: domain FW_SERVICES_DMZ_TCP="smtp domain" # Common: smtp domain FW_SERVICES_DMZ_UDP="domain syslog" # Common: domain syslog FW_SERVICES_INTERNAL_TCP="ssh smtp domain www 3128" # Common: ssh smtp domain FW_SERVICES_INTERNAL_UDP="domain" # Common: domain FW_TRUSTED_NETS="" FW_SERVICES_TRUSTED_TCP="" # Common: ssh FW_SERVICES_TRUSTED_UDP="" # Common: syslog time ntp FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # Common: "dns" FW_SERVICE_DNS="yes" # if yes, FW_SERVICES_*_TCP needs to have port 53 FW_SERVICE_DHCLIENT="no" # if you use dhclient to get an ip address FW_SERVICE_DHCPD="no" # set to "yes" if this server is a DHCP server FW_SERVICE_SAMBA="no" # set to "yes" if this server uses samba as client FW_FORWARD_TCP="" FW_FORWARD_UDP="" FW_FORWARD_MASQ_TCP="" FW_FORWARD_MASQ_UDP="" FW_REDIRECT_TCP="" FW_REDIRECT_UDP="" FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" But starting the firewall-script leads to this errors- Starting Firewall Initialization: (final run) /sbin/ipchains: invalid port/service `1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack 1024 blackjack' specified Try `/sbin/ipchains -h' or '/sbin/ipchains --help' for more information. Whats going wrong? Yours Thom -- Experience is directly proportional to the value of equipment destroyed. -- Carolyn Scheppner ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://www.pzt.de -------------------------------------------------------------------

1 0

Where to find a good intro to ipchains for a dial-up linux box ?
by Marko Kaening 19 Mar '01

19 Mar '01

Hi, much is read about ipchains in this list. I know there are also howtos about this subject, sure. But maybe somebody could give me a hint concerning a good introduction to how to set-up a firewall using ipchains with SuSE? Unfortunately I found only manuals which explain how to firewall bigger networks, but I have a single host which I connect from time to time to the net. So I think setting-up such a thing should be a lot easier. BUT how? Any help welcome. Regards, Marko -- O _ O 0 0 ------------------m-\o/-m------------------------------------------ Dr. Marko K"aning Tel/Fax: +49-3834 554 442 / -3834 554 301 INP Greifswald email : kaening(a)inp-greifswald.de

7 7

smtp_auth
by Simon Dittlmann 19 Mar '01

19 Mar '01

Hello, where can I finde information about smtp_auth? thanks. cu, sd

2 1

Re:who are logged in ?
by omicron 19 Mar '01

19 Mar '01

hi i installed whowatch, and while it is better than anything i've seen it still does not tell me about ftp, pop,etc. Surely the OS knows who are logged in and all i've to do is get the info from the OS . But how ? regards omicron -- ****** omicron Mail:omicron@omicron.dyndns.org (Sridhar N) www:omicron.symonds.net pubkeys:omicron.symonds.net/pubkeys C O G I T O E R G O S U M ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

network interface problem
by jonathan 17 Mar '01

17 Mar '01

I just loaded 7.1 and a recomplied the 2.4 kernel (with ipmasq and iptables support) and I am getting an error message for my second network interface. I can do in ifconfig and the interface is up but here is the message from /var/log/messages: Mar 17 19:14:43 lucky kernel: NETDEV WATCHDOG: eth1: transmit timed out Mar 17 19:14:43 lucky kernel: eth1: Transmit timed out, status fc124010, CSR12 00000000, resetting... I am using Linksys cards, I am having no problems with them on other systems and tried replacing the card. Any help / ideas would be greatly appreciated. TIA

1 0

SuSEfirewall2 and 2.4 help needed, PLEASE
by jonathan 17 Mar '01

17 Mar '01

I am trying to get the new firewall2-0.5 to work with kernel2.4 that came with SuSE7.1. I have the firewall config file set but the init, start and final run scripts fail on boot up. Could someone please tell me what options I need to have set in the kernel to use iptables. This box will serve as a firewall and ipmasq box from my home network to my cable ISP. I have been able to get previous versions of the SuSEfirewall scripts to work great with IPChains, but the new iptables is a different story. Any help/comments would be greatly appreciated. TIA

1 0

all network ports in use
by Christian Boxhammer 17 Mar '01

17 Mar '01

Hi, There is sometimes a problem, logging into our two SuSE 7.0 (SMP) machines. Trying to log in with telnet procudes the following error Message: "telnetd: all network ports in use" In such a case it is not possible to log into the machine for several hours. Is this because of a portscan an anything else? Did anyone have a similar Problem? Christian Boxhammer -- Linux is like a Wigwam.. No Windows, no Gates, and Apache inside

9 10

SuSEfirewall*
by marc＠suse.de 17 Mar '01

17 Mar '01

Hi folks, SuSEfirewall-4.4 and SuSEfirewall2-0.5 are active now (available at http://www.suse.de/~marc/SuSE.html) if you installed the official SuSEfirewall-4.3 rpm - it is nearly the same as v4.4.tar.gz, however the rpm is not for SuSE 6.x machines, the .tar.gz works fine. Only minor fixed vor v0.5 please: if something is not working for you (and it is not a configuration error ...) please report to me! send me "SuSEfirewall status; grep ^FW /etc/rc.config.d/firewall*" and about harden_suse: the v3.1 is available for some time now, the official rpm update will be out the next days. Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

2 2

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ----- End forwarded message ----- -- Togan Muftuoglu

1 0

What does this mean
by Togan Muftuoglu 16 Mar '01

16 Mar '01

This is what I just had in my logs redirect from 3A90108/eth1 to D55FF0FC88 ignored .PATH =D49CC45A ->D550FC8, tos 00 eth1 is connected to ADSL and after this message for like 5 minutes I could not ping anything except the ADSL gateway What does this mean and where I can get more information TIA -- Togan Muftuoglu

1 0