March 2001 - openSUSE Security - openSUSE Mailing Lists

Router with NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Hello ! I have seen, it is an english list ! I want to know the differences between a router with NAT, a software firewall and hardware firewall. Maybe one of you have some links to an web-page or article. I read the book "Linux Firewall from R. Ziegler" an therefore I known the strategie of paket-filtering. (a) What is a router with NAT for ? - is there the posibility of dialing in via internet - in which area is a router better / worse than a simple paket-filter SW-firewall with masquerating (NAT) (b) A software firewall (SuSE-firewall) is only a paket-filtering aspect. - what is missing ? is it enough ? (c) what supports a hardware firewall instead of an software firewall ? - why is it better than a software firewall ? (is it really better ?) thanks Harald

1 0

Router mit NAT <-> SW-Firewall <-> HW-Firewall
by DI H. Arnold 16 Mar '01

16 Mar '01

Liebe Gemeinde ! Ich versuche mich gerade in den Bereich "Sicherheit" einzuarbeiten und suche Unterlagen oder einen Vergleich zu folgende Schutzarten: Anmerkung: mein Grundwissen ist das Verstandnis der SuSE- Firewall aus Theorie (Bucher "Linux Firewall, R. Ziegler" als Paketfilter) und Praxis. (a) Was deckt ein Router mit NAT (masquerading) ab ? - kann ich mich dann uberhaupt von "drau?en" einwahlen ? - was kann ein Router mehr oder weniger als die SusE-FW ? (b) Welchen Schutz bietet eine LINUX-Firewall (ist ja nur Paketfilter) - altbekannte Thematik aus Buchern (c) eine richtige Hardware-Firewall - was kann eine HW-Firewall mehr als eine SW-Firewall (SuSE) lg Harald

1 0

strange fw log entry
by Michael Keyl 15 Mar '01

15 Mar '01

hi, I have just found the following lines in the log file of my firewall: Mar 14 17:45:06 linux sshd[8830]: Server listening on 0.0.0.0 port 22. Mar 14 18:27:30 keyl kernel: Packet log: input DENY eth0 PROTO=6 134.169.85.76:47157 0.0.0.0:0 L=40 S=0x00 I=43008 F=0x4000 T=1 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 11:02:35 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 11:02:37 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=359 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 11:02:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 12:15:41 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=1 F=0x4000 T=60 (#38) Mar 15 12:15:42 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#38) Mar 15 12:15:43 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=400 S=0x00 I=3 F=0x4000 T=60 (#38) Mar 15 12:15:47 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#38) Mar 15 17:02:45 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=1 F=0x4000 T=60 (#45) Mar 15 17:02:46 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=2 F=0x4000 T=60 (#45) Mar 15 17:02:48 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=333 S=0x00 I=3 F=0x4000 T=60 (#45) Mar 15 17:02:52 keyl kernel: Packet log: input DENY eth0 PROTO=17 0.0.0.0:68 255.255.255.255:67 L=576 S=0x00 I=4 F=0x4000 T=60 (#45) Can anybody explain me what is going on there? Bye, Michael

3 2

problem mit spam und inflex
by Wolfgang Schäfer 14 Mar '01

14 Mar '01

Hi an ALLE, ich setze SuSE 6.3/6.4 ein! Ein firewall mit proxy, einen mailserver usw. Der firewall-Rechner leitet die mails direkt an den mailserver-Rechner weiter. Der mailserver läuft jetzt mit sendmail 8.11.0 von SuSE. Soweit ist das ganze spam-sicher. Wenn ich aber inflex benutzen will hab ich ein open relay! Was tun? Soll ich auf dem firewall noch einen mail2-server aufbauen, der dann spam-sicher ist und alle mails an den eigentlichen mail-server weiterleitet, oder gibt es andere scanner die auch Dateitypen filtern? Gruss -- _______________________________ Wolfgang Schaefer Diplom-Ingenieur (FH) Elektronik Systemadministrator Fon +49-(0)7308-818-22 Fax +49-(0)7308-818-65 busse design ulm gmbh Nersinger Str. 18 89275 Elchingen / Ulm, Germany http://www.busse-design-ulm.de _______________________________

3 2

Re: [suse-security] Obtuse SMTPD problem
by andreas.baetz＠herma.de 14 Mar '01

14 Mar '01

nix wrote: >I have a problem with the version of Obtuse SMTPD that is >precompiled with SuSE 7.0 >It does not seem to be able to resolve names of connections >even though they do have reverse DNS. >Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) >Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as Let's suppose your smtpd runs chrooted in /var/spool/smtpd. Did you check that the lib files for name resolution are present in /var/spool/smtpd/lib ? There should be at least libnss_dns.so.2 and libnss_files.so.2 (for SuSE 6.3, don't know for 7.0). Also check that the files /var/spool/smtpd/etc/nsswitch.conf, /var/spool/smtpd/etc/resolv.conf /var/spool/smtpd/etc/hosts are present and have the right contents. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

2 1

Update to Apache 1.3.17-0 (SuSE 6.3)
by Holger-Schmidt＠arcor.net 13 Mar '01

13 Mar '01

Hi all, while using SuSE 6.3 I updated the Apache to Version 1.3.17-0 from FTP-Server. After updating the packages on our systems I 've got an error message while restarting the apache with "rcapache restart": rcapache: /etc/rc_status: no such command or file There is no file /etc/rc_status. For what is it ? Do I need it ? After removing this program call out of the startup script, the restart works. Hope somebody can answer my question. Bye Holger

2 1

Ipchains log messages
by Christian Bohn 13 Mar '01

13 Mar '01

Hi! my ipchains is producing the following output in the logfiles: Mar 13 15:35:32 clint kernel: Packet log: input DENY eth0 PROTO=1 aaa.aaa.aaa.aaa:8 bbb.bbb.bbb.bbb:0 L=84 S=0x00 I=11654 F=0x0000 T=57 (#792) I wonder why I get this messages because the IP-Adress bbb.bbb.bbb.bbb is none of mine! (but its in the same subnet) Its very annoying because Host aaa.aaa.aaa.aaa is sending ICMPs to bbb.bbb.bbb.bbb for several hours now, and my logfile is growing quite big... bye Christian

3 3

Re: I would like to be on your mailing list
by Roman Drahtmueller 13 Mar '01

13 Mar '01

> Subject: I would like to be on your mailing list > > I have just purchased SuSe Linux 7.1 Professional and would like to be > added to the security mailing list > > My e-mail address is: CharleeChinks(a)aol.com > > Thank you Please go to http://www.suse.de/en/support/mailinglists/index.html and subscribe yourself. Thank you, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

TLS and Sendmail
by Nix 13 Mar '01

13 Mar '01

Has anyone else successfully configured TLS on sendmail in SuSE 7.1? I have installed the sendmail-tls package from the sec section, but I can't find any ttls related doco anywhere. There is certainly nothing in /usr/share/doc/packages/sendmail that relates to it. Help Anyone? Do i need to configure certificates etc? I assume I do, but nothing seems to exist to describe how.. Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Obtuse SMTPD problem
by Nix 13 Mar '01

13 Mar '01

I have a problem with the version of Obtuse SMTPD that is precompiled with SuSE 7.0 It does not seem to be able to resolve names of connections even though they do have reverse DNS. For instance, here are some logs where there is an SMTP connection initiated from 9.9.9.9 which resolves to the.gov (Names/IPs have been changed) As you can see from the 5th line, SMTPD does not actually managed to resolve the IP to a name. This limits some of the rules that you can use with SMTPD and makes it less useful. Is there an easy way to fix this?? Mar 13 16:14:19 mayhem smtpd[3775]: smtpd running in Paranoid mode Mar 13 16:14:19 mayhem smtpd[3775]: No reverse mapping for address 9.9.9.9 (0) Mar 13 16:14:19 mayhem smtpd[3775]: SMTP HELO from UNKNOWN(9.9.9.9) as "the.gov" Mar 13 16:14:19 mayhem smtpd[3775]: mail from <daffy.duck(a)the.gov> Mar 13 16:14:19 mayhem smtpd[3775]: smtp connection from UNKNOWN(a)UNKNOWN(9.9.9.9) MAIL FROM: <daffy.duck(a)the.gov> RCPT TO: <bugs.bunny(a)mydomain.com>, allowed by line 49 of /etc/smtpd_check_rules Mar 13 16:14:19 mayhem smtpd[3775]: Recipient <bugs.bunny(a)mydomain.com> Mar 13 16:14:19 mayhem smtpd[3775]: Received 6236 bytes of message body from UNKNOWN(9.9.9.9) Cheers --- Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0