May 2001 - openSUSE Security - openSUSE Mailing Lists

Re[2]: AW: [suse-security] ipchains masq + active ftp / OR NETFILTER/IPTABLES...
by da_bug 23 May '01

23 May '01

hi! S> You can use ipchains with kernel 2.4 . You should recompile your S> kernel with ipchains support ou for just tests, insmod ipchains. I do S> the second option to tests and my ipchains work very well. I know that I can use ipchains with kernel 2.4.x but it seems to me (right or not?) that I cannot use this special ipchains-module "ip_masq_ftp.o" with kernel 2.4.x ... >> >> Hi! >> >> CU> I think you need the module ip_masq_ftp.o to masquarade active ftp with >> CU> ipchains, aren't you? So it works fine for me. Perhaps take a look at >> CU> http://www.linux-firewall-tools.com/linux/. >> >> CU> Hope thats you are looking for! >> >> CU> Christian >> >> ..ip_masq_ftp.o would be a good solution, but it seems to me that it >> just works with kernel 2.2.x and not with 2.4.x .. !? >> If there is a possibilty to use it with 2.4.x (ipchains-compatibility) I >> would like to know about... >> Meanwhile I also took a look at Netfilter/Iptables and set up a >> masquerading-rule that works fine so far... but I have the same >> ftp-problem: ;-) >> How can I realize active ftp-connections from the clients behind a >> netfilter/iptables-gateway-pc? >> >> Bye.

1 0

How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

How do I get loopback encryption filesystems working with 2.2.19? I note the .config file created by make xconfig has lines with: CONFIG_BLK_DEV_LOOP CONFIG_CIPHER_TWOFISH ftp.kernel.org does not have a patch listed for 2.2.19 Thank You. -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

4 4

lost in icmp filtering
by Togan Muftuoglu 23 May '01

23 May '01

Hi, I am trying to tighten up my ipchains firewallon my adsl router/firewall box . But looks like I am a litle bit lost. I have read previous mails backing to 2000 May and I am still lost.Maybe too much info is not good) Below is what I have done. Is there anything I should be carefull with if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] then for f in /proc/sys/net/ipv4/conf/*/rp_filter do echo 1 > $f done fi if [ -e /proc/sys/net/ipv4/tcp_syncookies ] then echo 1 > /proc/sys/net/ipv4/tcp_syncookies fi # echo "1" > /proc/sys/net/ipv4/ip_dynaddr echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo "0" > $file done for file in /proc/sys/net/ipv4/conf/*/log_martians; do echo "1" > $file done $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-reply -l $IPCHAINSs -A input -j REJECT -i $OUTERIF -p tcp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p udp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d OUTERIP --icmp-type destination-unreachable -l IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type destination-unreachable -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type redirect -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type time-exceeded -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type parameter-problem -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-reply -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-reply -l -- Togan Muftuoglu

1 0

Re: How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

On Wed, May 23, 2001 at 01:04:44PM +0200, Hubert Mantel wrote: > Hi, > > On Tue, May 22, Paul Elliott wrote: > > > How do I get loopback encryption filesystems working with 2.2.19? > > It's quite easy. You just need a recent losetup binary. Please note that > losetup as of SuSE Linux 7.1 is recent enough ;) > Does this mean I can just grab a 7.1 binary and use it on a 7.0 2.2.19 system? Will there be library incompatabilities? Do I have to get the source and rebuild? -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

1 0

scanrpm: script to check system for known vulnerable packages
by Bob Vickers 23 May '01

23 May '01

Dear All, I had an idea for a utility to make it easier to check a system is up-to-date with patches. I assumed that someone else must have had the idea already, but I couldn't find it on the web so I wrote the utility myself. For this utility to work it needs someone (and I think that someone really needs to be SuSE) to maintain a machine-readable list of packages known to have security holes. All the utility does is reads such a list and then reports any vulnerable packages it finds on the system. So you would use it something like wget -O - ftp://ftp.suse.com/vulnerabilities.txt | scanrpm The vulnerability file should contain lines like openssh VERSION=8.3.0p2 RELEASE=98 where the uppercase keywords correspond to rpm query tags. Do people think this is useful? If so, are SuSE willing to take it on? Of course, the utility would be useful for bad guys as well as good guys, but we are used to that. Current version of the scanrpm utility can be found at http://www.cs.rhul.ac.uk/home/bobv/utils/scanrpm Nothing in the utility is SuSE-specific, but I guess the database would be. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 2

Re: [suse-security] Rinetd
by Sp0oKeR 23 May '01

23 May '01

Redir is the same tha Redirect4All? Because I'm using this do redirect my ftp. But in my webservers I'm using rinetd. The question is: I have about 6000 hits a day, then, I'm with a interface with 2 ips, this ips were from my NT. And I do the redirects. Can a big number os hits down my rinetd? Do you think a should use redir to webserver too ? Regards ... > > ---------- Início da mensagem original ----------- > De: "Kurt Seifried" <listuser(a)seifried.org> > Para: "Sp0oKeR" <spooker(a)bol.com.br>, <suse- security(a)suse.com> > Cc: > Data: Tue, 22 May 2001 21:01:11 -0600 > Assunto: Re: [suse-security] Rinetd > If you want to do this in user space you can use redir which is pretty > reliable in my experience. If you are willing to muck around with your > kernel/etc you can use ipportforwarding, this is covered in the firewall howto > I believe. > > Kurt Seifried, seifried(a)securityportal.com > Securityportal - your focal point for security on the 'net > > > > ----- Original Message ----- > From: "Sp0oKeR" <spooker(a)bol.com.br> > To: <suse-security(a)suse.com> > Sent: Tuesday, May 22, 2001 8:50 PM > Subject: [suse-security] Rinetd > > > Hi all... > I'm using rinetd to bind de port 80, and redirect > to my NT Servers. But the problem é o seguinte: my > rinetd is going down. I'm using SuSE 7.0 and I have been > instaled rinetd from my cd's. > I'using ipchains and masquerading too. > Can somebody help-me? > > Sp0oKeR - NsC > spooker(a)bol.com.br > Powered By Linux - SuSe > > > _________________________________________________________ _________________ > Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! > ASSINE AGORA! http://www.bol.com.br/acessobol/ > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe & Slackware __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

Bind Problem
by Sp0oKeR 23 May '01

23 May '01

I'm using SuSE Linux 7.0 with Bind 8.2.3. My problem, is : My bind is always stopping , I don't know way. This occurs about 1 or 2 times a day. Then , I need to restart it everytime. Can somebody help me? Regards -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # http://www.nscenter.com.br # # Sao Paulo - SP # #=============================#

4 3

[suse-security] ipchains masq + active ftp
by da_bug 23 May '01

23 May '01

Hi! I want to use active-ftp with some clients behind my gateway-pc (ipchains-masquerading)... (passive ftp works) How do I configure my ipchains-firewall to allow this? I hope someone can help me... Bye.

4 6

SINUS Firewall on SuSE 7.1?
by Benjamin Grogg 23 May '01

23 May '01

Hi folks, Anyone have experience with Sinus Firewall on SuSE 7.1? How it works on SuSE? Thanks a lot for your comments :) Benny

1 0

firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

Hello again, well, I have had good feedback from SUSE and other users of the Japanese language server, Canna. As far as security at a software level is concerened, I think it is secure. However, it still shows as an open port 5680 when tested with nmap. I have been told that while the software settings are secure, if I want to make it invisible to nmap, I would need kernel level firewalling. I have Firewall2 set up on my dialup ppp box. Can anyone tell me what settings I need to change in YaST to enable firewalling on port 5680 and make it invisible to the outside? I thought that blocking high ports would do it, but it still shows up on nmap. thanks very much This is more a learning process than a real world security threat, but I appreciate your help all the same. cheers Joss

2 2