April 2001 - openSUSE Security - openSUSE Mailing Lists

ports and ftp
by stephane parenton 03 Apr '01

03 Apr '01

hi, I'm working on a 7.0, and have a slight problem... everything seems to be rightly installed, but there should be a "small" configuration problem (I haven't installed the box). I can't ftp the box. i'm answered "ftp: connect: connection refused". if I nmap the box, the ftp ports are not "opened"... is it normal ? Where am I to look to solve this problem ?.... Regards Stephane

3 2

Re: [suse-security] SuSEfirewall2 / iptables
by christian.burri＠synecta.ch 03 Apr '01

03 Apr '01

Well, two packets, right? ICMP_Echo_Request i.e. is an ICMP packet, that like, say, goes out from ure box to the one u're pinging. The pinged machine will reply with a 2nd packet ICMP_Echo_Reply So like, you will send out an ICMP packet and you will recieve an ICMP packet. Im no netfilter xpert but like I can imagine that if program tracks outgoing ICMP packets and like creates entries in some table, then it could look this table up to see if the ICMP packet coming in (say its an Echo_Reply) could have been triggered by the machine it is addressed to (through an Echo_Request, of course). If there is an entry in the table, then netfilter could let the ICMP packet pass. If theres no entry in the table, then either noone actually requested that packet or the ping simply took to long to complete (I guess theres a timeout removing table entries which havent been referred to in the past (n) minutes) and thus gets discarded. Correct me if Im wrong =P cheers gridrun .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ Marco Ahrendt <marco.ahrendt@ad To: Bjoern Engels <bengels(a)lanworks.de> consys.de> cc: suse-security(a)suse.de Subject: Re: [suse-security] SuSEfirewall2 / iptables 03.04.2001 13:30 On Tue, Apr 03, 2001 at 08:18:21AM +0200, Bjoern Engels wrote: > > Connection tracking doesn't use flags to determine <... SNIP> I don´t think so. According to some threads in netfilter-ml the connection tracking code currently requires a udp packet in both directions before considering a connection to be established. Therefor how it is possible to conntrack icmp if there are only 2 packets? Ping and reply for example? Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 / iptables
by Marco Ahrendt 03 Apr '01

03 Apr '01

Hi all, after looking at Marc's firewall script I'm wondering about this line: $IPTABLES -A $CHAIN -j "$ACCEPT" -m state --state ESTABLISHED,RELATED -p icmp --icmp-type $TYPE There are much more lines where the state module is used on icmp packets. I thought the icmp packets had no flags like syn/ack/fin etc. who allows connection tracking? Did I missunderstand anything? I'm using my own iptables script and now I wanted to add some icmp rules for accepting icmp-type *unreachable* packets from the internet. If there is the chance to use connection tracking on icmp packets this would be very fine but I can't imagine how iptables could grep the state when not finding any flags. Marco -- Marco Ahrendt phone : +49-341-98-474-0 adconsys AG fax : +49-341-98-474-59 Karl-Liebknecht-Str. 19 email : marco.ahrendt(a)adconsys.de 04107 Leipzig/Germany gnupg key at www.aktex.net/marco_work.asc

3 3

Re: [suse-security] restrict ftp user to home directory
by andreas.baetz＠herma.de 03 Apr '01

03 Apr '01

Torsten Harling <harling(a)fnet.de> wrote: >I'd like to restrict every ftp user to their home directory. How >can I do this? >We're using wu-ftpd version 2.6.1. supposing your users have /home/userX as their homedirectories, and they are all in group "usergroup". Then you could put the following into /etc/ftpaccess: class remote guest,anonymous * guest-root /home restricted-gid usergroup guestgroup usergroup If you only want to restrict the root dir for some users, you could do: restricted-uid user1 user2 guestuser user1 user2 You can also mix the settings, i.e. using "restricted-uid" combined with "guestgroup" Andreas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

restrict ftp user to home directory
by Torsten Harling 03 Apr '01

03 Apr '01

Hello list, I'd like to restrict every ftp user to their home directory. How can I do this? And what's the best way to restrict normal login? And, can I grant scp, but no ssh access? I think, scp uses ssh, so it is maybe impossible to have scp only. We're using wu-ftpd version 2.6.1. Torsten Harling -- fnet.de AG Frankfurter Ring 193A 089 / 323 55 - 127

2 1

Re: [suse-security] Permissions rpm directories
by Roman Drahtmueller 03 Apr '01

03 Apr '01

> > > > mkdir -p usr/src/packages > > rpm -ihv schnick.spm > > > > That works. Uh, sorry, I meant rpm -r $HOME -ihv schnick.spm Otherwise, it uses the system paths, and the mkdir is useless. Thanks, Volker. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

RE: [suse-security] SuSEfirewall2 / iptables
by Reckhard, Tobias 03 Apr '01

03 Apr '01

> Connection tracking doesn't use flags to determine > if a connection was startet from inside or outside - > and this is the big advantage over ipchains. If a > packet is sent out to initiate a new connection, > an entry is being written to the connection table > to keep track of the connection and possibly allow > the reply froom outside. UDP doesn't use flags, too, > and you can keep track of those sessions as well > as icmp's. > Actually, there is no such thing as a "UDP session." UDP is connectionless by definition and doesn't have any notion of sessions, in contrast to TCP. There are many application layer protocols that implement sessions and use UDP as their transport method, yes, but it's the applications that are session-aware, not the transport layer process. The same applies to ICMP. Stateful filters assume that UDP is used in session fashion by allowing return traffic that matches the inverse socket pair of an allowed packet. However, they are much more susceptible to e.g. IP spoofing attacks, as there is no sequence and acknowledgement number information in UDP to check (not that they are checked in stateful TCP filters either, but they could..). There also doesn't exist any form of connection teardown, since no connection is ever established, so UDP entries to the connection table can only be removed by having them time out (unless you boldly assume that a fixed number of response packets will be received for every 'request'). The ability to grant more security in handling UDP is one of the main advantages of stateful filters compared to basic packet filters. You need to be aware of the fact that their operation is based on assumptions that are not generally true. This shouldn't mean too much of a problem for the most commonly used application layer protocols, but those are only around a handful in number. More obscure protocols or those with TCP/IP information embedded in the data are inherently more difficult to support with statefuls. Just thought I'd throw in a couple of remarks, so people won't blindly think that stateless filters are crap and statefuls are great. The world isn't that simple. Cheers, Tobias

1 0

Permissions rpm directories
by Theo v. Werkhoven 02 Apr '01

02 Apr '01

Hi all, This is more or less one for Roman & Co. Is there a compelling reason why the directories under /usr/src/packages should be world writable and readable? theo:/home/theo $ sudo rpm -ql --dump rpm-3.0.4-0 [..] /usr/src/packages/BUILD 35 953918273 041777 root root 0 0 8772 X /usr/src/packages/RPMS 77 953918273 041777 root root 0 0 597 X /usr/src/packages/RPMS/i386 35 953918273 041777 root root 0 0 0 X /usr/src/packages/RPMS/noarch 35 953918273 041777 root root 0 0 18526 X /usr/src/packages/SOURCES 35 953918273 041777 root root 0 0 18707 X /usr/src/packages/SPECS 35 953918273 041777 root root 0 0 18508 X /usr/src/packages/SRPMS 35 953918273 041777 root root 0 0 18504 X What stops a local from messing with sources, (re)builds, specs etc? Theo

3 4

Sendmail SMTP AUTH / SSL
by Raffy 02 Apr '01

02 Apr '01

Hey list, On my box I have sendmail running. In order to use SMTP over SSL I run it with stunnel in inetd: smpts stream tcp nowait root /usr/local/sbin/stunnel stunnel -D 3 -p /usr/local/ssl/certs/stunnel.pem -r smtp Further I configured sendmail to use SMTP AUTH. Everything works perfect. But: smpts is on port 465. I configured my clients such that they use that port. So far so good. But now port 25 can still be used to send email. I could block it at the firewall but then I am not able to receive email any more, because other mailservers are talking with me on that port. (right?) Is there a solution that I can use SMTP over SSL and SMTP AUTH? Clients should not be able to connect without SSL or SMPT AUTH! Thanks Raffy

19 31

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> I have the same problem as described below. I´m running SuSE 6.4/bind8.2.2 > for about 1/2 year without any problems. In the last weeks named is going > down first about one time a week up to now every second day - and I can´t > find any hint in the logs...any idea? > Have you tried more extensive logging or perhaps execution in debug mode? That will give you many more hints than are available from the default logging. cya, Tobias

3 2

Bind
by Hipolito A. Gonzalez M. 02 Apr '01

02 Apr '01

I upgrade to the new 8-8.2.3 bind version, but, every morning the daemon "named" is stop. Is any trying to hack me? I have and real ip and I'm making hosting. Thank you. In log nothing appear. -- www.geekcode.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ h! r++ y++ ------END GEEK CODE BLOCK------ - A veces creo que hay vida en otros planetas, y a veces creo que no. En cualquiera de los dos casos, la conclusión es asombrosa (Carl Sagan) -----------------------------------------------------------------

3 3

firewalling
by Ralf Freisinger 02 Apr '01

02 Apr '01

Hello all, following i want to use for internet topology: Internet | eth0 62.153.xxx.190/255.255.255.192 Router outside eth1 (internal DMZ) 62.153.xxx.134/255.255.255.224 | Mailserver (all Server in the DMZ should have official IP's like above eth1 (internal DMZ interface) | DNS-Server | WWW-Server | eth0 62.153.xxx.133/255.255.255.224) to DMZ Router inside/Firewall eth0 (local Lan) 192.168.2.29 | | Local Network (official IPs) It's only an Idea from me, is it possible to set up the DMZ like this, I've an ip-range of 64 addresses ( network 62.153.xxx.128/255.255.255.192) Outside of the DMZ there are more WWW-Server, only one of these should be in the DMZ, because on this host are running some special software. If i try it like this, i've problems with the routing, the DMZ is pingable from the "Router outside" but i can't reach the Internet from this Router. Perhaps some people can help me set up the routing correctly and perhaps could tell (explain) me the mistakes i make! Thanxs a lot greetings Ralf

2 1

iptables
by office＠tride.net 02 Apr '01

02 Apr '01

Hello list, does the SuSEfirewall-script support iptables? cu

3 2

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

Umm, yeah, that's debug mode, but there's a lot more to the logging statement in /etc/named.conf. I'd thought I'd mentioned how to start named in debug mode, but that wasn't to the list. Sorry, my bad. Tobias > -----Original Message----- > From: emm(a)eggler.ch [SMTP:emm@eggler.ch] > Sent: Monday, April 02, 2001 3:24 PM > To: Reckhard, Tobias > Cc: 'hgonzale(a)celularshow.com'; suse-security(a)suse.de > Subject: Re: [suse-security] Bind > > At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" > <Reckhard(a)secunet.de> wrote: > > >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging > >config is way beyond the scope of this list. > > sure. but it's no secret and trivial: named -d 9 starts bind the > noisy way. > > regards > emmerich

1 0

Re: [suse-security] Bind
by emm＠eggler.ch 02 Apr '01

02 Apr '01

At Mon, 2 Apr 2001 15:19:38 +0200 , "Reckhard, Tobias" <Reckhard(a)secunet.de> wrote: >Check out the contents of /usr/share/doc/packages/bind8. BIND's logging >config is way beyond the scope of this list. sure. but it's no secret and trivial: named -d 9 starts bind the noisy way. regards emmerich

1 0

RE: [suse-security] Bind
by Reckhard, Tobias 02 Apr '01

02 Apr '01

Check out the contents of /usr/share/doc/packages/bind8. BIND's logging config is way beyond the scope of this list. Good luck, Tobias > -----Original Message----- > From: Hipolito A. Gonzalez M. [SMTP:hgonzale@celularshow.com] > Sent: Monday, April 02, 2001 2:58 PM > To: Reckhard, Tobias; suse-security(a)suse.de > Subject: Re: [suse-security] Bind > > Reckhard, Tobias wrote: > > > > > Have you tried more extensive logging or perhaps execution in debug mode? > That will give you many more hints than are available from the default > logging. > > > How can I put the extensive logging? Thank you. > > > -- > www.geekcode.com <http://www.geekcode.com> > -----BEGIN GEEK CODE BLOCK----- > Version: 3.1 > GCS/cc/e/it d++ s+:+ a-- C++$ UL+++$ E++ W+++$ w--- O---- > M V- PS PE+++ Y+ PGP- t+ 5 X++ R tv+ b++ DI-- D+ G e++$ > h! r++ y++ > ------END GEEK CODE BLOCK------ > - A veces creo que hay vida en otros planetas, y a veces creo que > no. En cualquiera de los dos casos, la conclusión es asombrosa > (Carl Sagan) > ----------------------------------------------------------------- >

1 0

re bind
by webmaster 02 Apr '01

02 Apr '01

Tobias, would you give hints how to run named in debug mode ? I am having the same problem It logs however: Apr 2 06:00:41 mand sshd2[10183]: DNS lookup failed for "x..x.42.2". Apr 2 06:01:11 mand sshd[10183]: fatal: Read from socket failed: Connection reset by peer Antal -------------------------- webmaster Kreorg Oktatóközpont Tel/Fax: 321-0031 email: webmaster(a)kreorg.hu

2 1

SuSEfirewall question
by Michael Long 02 Apr '01

02 Apr '01

When running 'SuSEfirewall check' I get the following output: /sbin/SuSEfirewall: split-brained.: command not found /sbin/SuSEfirewall: host/network.: No such file or directory /sbin/SuSEfirewall: dmz/intern: No such file or directory /sbin/SuSEfirewall: addesses!: command not found ipchains produced errors, no default routing set up? ipchains produced errors, no default routing set up? ipchains produced errors, no default routing set up? What is this telling me? The firewall appears to be working. --Thanks, Mike

1 0

RE: [suse-security] firewalling
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> following i want to use for internet topology: > I'm snipping your ASCII art for brevity. > Internet -- eth0 62.153.xxx.190/255.255.255.192 (= /26) > Router outside [DMZ: 62.153.xxx.134/255.255.255.224 (= /27) > Router inside/Firewall > eth0 (local Lan) 192.168.2.29 > > It's only an Idea from me, is it possible to set up the DMZ like this, > I've an ip-range of 64 addresses ( network 62.153.xxx.128/255.255.255.192) > OK, you've got an official 26-bit network. You can subnet that into two 27-bit networks, yes. However, you should apply that mask to the outside interface as well and have your ISP modify his interface accordingly and add a route to the DMZ subnet, pointing at your router. This is the most straightforward and hard to mess up solution. Alternatively you can fake the non-existence of your DMZ by mucking around with Linux' IP capabilities. The two alternatives I can think off right now are proxy arp and a combination of IP aliasing, IP masquerading and port forwarding. Proxy arp is the less dirty of the two, it makes your outside router answer arp requests for the machines in the DMZ and is thereby addressed by machines in the network between it and your ISP's router. See http://www.linuxdoc.org/HOWTO/mini/Proxy-ARP-Subnet/index.html for details. The other possibilty is to add the DMZ server's IP addresses to the the exterior router's eth0 interface with IP aliasing and to use RFC1918 addresses in the DMZ. Using port forwarding, you can redirect traffic from the router to the DMZ and masquerade the return traffic. Both of these alternatives are hacks, more or less, to circumvent the need for your ISP to do anything or, in fact, notice any change. However, they are administratively much more complicated. It's your call. > Outside of the DMZ there are more WWW-Server, only one of these should > be in the DMZ, because on this host are running some special software. > Why shouldn't all of your public servers go into a DMZ? I'd probably advise you to get an additional 30-bit or 29-bit subnet from your ISP to place the exterior router and the ISP's router in and use your 26-bit network in one or more DMZs. > If i try it like this, i've problems with the routing, the DMZ is pingable > from > the "Router outside" but i can't reach the Internet from this Router. > Hmm, your routing is probably mucked up. > Perhaps some people can help me set up the routing correctly and perhaps > could > tell (explain) me the mistakes i make! > The following should work on the exterior router: /sbin/route add -net 62.153.xxx.128 netmask 255.255.255.224 dev eth1 /sbin/route add -net 62.153.xxx.128 netmask 255.255.255.192 dev eth0 You need to add both routes to the machines in front of the exterior router as well as in the DMZ for routing between these networks to function. These need to specify the exterior router as the gateway to use, of course. HTH, Tobias

1 0

RE: [suse-security] bind-update-attempt
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> in the last weeks i often got the syslog-message > that somebody wanted to update my bind-server > for somedomain which was of course denied by > my bind-system by default. > Are you sure an attempt to update your server software and not the database is being made? > are there any problems in the software i have > to think about with regard to a worst case > scenario...;-) > Well, BIND isn't considered to be very reliable with respect to security. djbdns is, on the other hand, but isn't and probably won't be distributed by SuSE, due to DJB's, umm.., unusual licensing policy. It's pretty easy to compile, install and configure, though. HTH, Tobias

1 0

RE: [suse-security] Re: [Fwd: [suse-security] many nic's]
by Reckhard, Tobias 02 Apr '01

02 Apr '01

> For example it would be possible to install 4 nics in my box an then use > one nic for isp A and one for isp B. Would it be also possible to set up > firewalling so that isp A provides internet access to network C and B for > network D. > Box > ISP A (eth0) -----> Network C (eth1) > ISP B (eth2) -----> Network D (eth3) > > But it should not be possile to access ISP B from Network C and visa verse > for ISP A. > This is possible with a 2.4 (or late 2.2?) kernel with the advanced routing options. You need to perform routing based on source address. I expect it to be pretty easy to muddle up in setup and maintenance, so I'd probably advise against it and urge you to set up another box to properly separate both networks. If we're talking about WAN uplinks any old box will be able to handle the traffic easily. > I think it should be possible with the SuSEfirewall. You only have to set > up > the > right routing configuration. > I barely know SuSEFirewall myself, but generic iptables/ipchains aren't your problem. The routing is, as you correctly assume. Cheers, Tobias

1 0

Re: [Fwd: [suse-security] many nic's]
by office 02 Apr '01

02 Apr '01

For example it would be possible to install 4 nics in my box an then use one nic for isp A and one for isp B. Would it be also possible to set up firewalling so that isp A provides internet access to network C and B for network D. Box ISP A (eth0) -----> Network C (eth1) ISP B (eth2) -----> Network D (eth3) But it should not be possile to access ISP B from Network C and visa verse for ISP A. I think it should be possible with the SuSEfirewall. You only have to set up the right routing configuration. Any comments? ----- Original Message ----- From: Bernhard Pavdi <bernhard.pavdi(a)tride.net> To: <office(a)tride.net> Sent: Monday, April 02, 2001 8:39 AM Subject: [Fwd: [suse-security] many nic's] > >

1 0

netscreen 5 and ftp
by Philipp Snizek 02 Apr '01

02 Apr '01

For evaluation I received a netscreen 5a. I'm a little bit unhappy with it because it seems not to support pasv ftp. Moreover if it runs only in active mode I have to open all hi-ports for ftp which is a fact I really hate. If somebody knows how to set up pasv ftp on netscreen 5a please let me know. TIA Philipp

2 3