May 2001 - openSUSE Security - openSUSE Mailing Lists

SuSE Security Announcement: sgmltool
by Sebastian Krahmer 04 May '01

04 May '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: sgmltool-1.0.9-266 Announcement-ID: SuSE-SA:2001:16 Date: Friday, May 4th, 14:55:35 CEST 2001 Affected SuSE versions: 6.3, 6.4, 7.0, 7.1 Vulnerability Type: local fileaccess problem Severity (1-10): 2 SuSE default package: yes Other affected systems: All UN*X systems using this package Content of this advisory: 1) security vulnerability resolved: sgmltool problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The sgmltool programs ("sgml2html" and others) are used to convert SGML-files into various other formats. During operation, the underlying SGML perlmodule creates temporary files in an insecure way. This allows attackers to destroy arbitrary files owned by the user who invoked the sgmltool program. The problem has been fixed by creating temporary files with the exclusive (O_EXCL) option upon opening them. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/sgm1/sgmltool-1.0.9-302.i386.rpm bdedaefb82dc2bb8ff0a522607b80ac3 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/sgmltool-1.0.9-302.src.rpm dc5612aa475c5d6dcaaeee86e6bf985f SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/sgm1/sgmltool-1.0.9-301.i386.rpm 916953307d466d3bd8d26fb0655ce55a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/sgmltool-1.0.9-301.src.rpm 5e11b85a494e1033ee2a83839cb296fe SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/sgm1/sgmltool-1.0.9-300.i386.rpm a489acc5c3dce4c44915e47b3ee64790 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/sgmltool-1.0.9-300.src.rpm efdb6b08988b689127600a954ebe2e2f SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/sgm1/sgmltool-1.0.9-300.i386.rpm 9c1e5da161b67248935cbc7f485dfd40 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/sgmltool-1.0.9-300.src.rpm a2deae294821e73ed24429636b20ed2a Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sgm1/sgmltool-1.0.9-283.sparc.… b3e0ec269392fb3d77c37cc698f77d16 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/sgmltool-1.0.9-283.src.rpm eb80b6efe08f40139ec181fed7ccc832 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/sgm1/sgmltool-1.0.9-284.sparc.… 8312ac046de5df7a47008dba32f1a7e8 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/sgmltool-1.0.9-284.src.rpm a7e48214ae01f4f720240c1204120927 AXP Alpha Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/sgm1/sgmltool-1.0.9-283.alpha.rpm 06348dc4b669098d80bc16a8cc836123 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/sgmltool-1.0.9-283.src.rpm c7c7ff5507f7a510d615235323f9f636 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/sgm1/sgmltool-1.0.9-281.alpha.rpm ee6bb4dd45c90ba716f0d825fba7bbca source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/sgmltool-1.0.9-281.src.rpm 44366d7edcace3448a606aff0c73026f SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/sgm1/sgmltool-1.0.9-281.alpha.rpm 2c2450e3dfdde9066269add9cfb0757b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/sgmltool-1.0.9-281.src.rpm 66a9d60866a5ebbb2e0682a2056f2528 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sgm1/sgmltool-1.0.9-216.ppc.rpm 01bda0ee0edfa1e1036d27b2bb3de352 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/sgmltool-1.0.9-216.src.rpm 1c6668d3ccc1b27bb3d5a4f84b308323 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/sgm1/sgmltool-1.0.9-216.ppc.rpm e9b7161fe3a10624790ce65d9909165d source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/sgmltool-1.0.9-216.src.rpm 15b8204b9378f8e833e6bac263bbacdd SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/sgm1/sgmltool-1.0.9-216.ppc.rpm 6af30c53d022866df5dd69ae053eeeea source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/sgmltool-1.0.9-216.src.rpm 35aa3ab2a86498c5e6ad145c0c7e378a ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Marcus Meissner (Caldera) found a bug in KDE 2.1.*'s kdesu program which allows attackers to gather private information. This is due to insecure local filehandling by the kdesu program. Please update to the newest packages. - minicom format string vulnerabilities have been found in the minicom package. If /usr/bin/minicom is installed suid, the vulnerability may be exploited to gain elevated privileges. Please note that this is not the case in SuSE distributions. If you decided to make /usr/bin/minicom suid uucp or even suid root, please make sure that you grant access to the execution of minicom to trusted users only. - cfingerd The package has been found vulnerable to a remotely exploitable weakness. SuSE Linux distributions do not ship this version of fingerd. - webmin Insecure handling of temporary files has been found in webmin, a comprehensive administration webinterface. SuSE distributions do not contain the webmin package and therefore are not vulnerable to the found vulnerabilities by default. We urge administrators who use webmin to upgrade to the latest version of webmin available. - gnupg/gpg, openssl Several weaknesses have been found in gnupg/gpg that can reduce the strength of encrypted data. We will provide updates for the gnupg/gpg package. The updates are currently being tested. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOvKmBHey5gA9JdPZAQFNrQf/WNKH2qdtejRaCkmkqO0h2zMSKrhWDmqA v0vhSI/iG+Ax+SXq2Jt7hhGbi8qNBGEGQI4Pm1gA66prJgDsh6azwqCCDU33Q8AK nQ0smS65VaFJsc5inSM/KIa33mpA82uwkihmTFUxrt0zh96Pqgbdu4ayr2BqlGCD G7QRQD79RFzJwMDlmrAZjAHslKe3RlXwXcyXfUgWZnkNW+Ehv6Pd1Zqj/EyIDHhg T6f5t5+QxCoIKiw1aVbW8UZ4Kpk0wMzfoU0A/INS8omEgDZFPxdm7woNDXYvlrfp l7MS1/fqt9LqFZOW+XGFvVJOrKhSbDPxQ96W8Oft6mAx8XhH5se3Mw== =WRNV -----END PGP SIGNATURE-----

1 0

IPSec on linux 2.4.4
by RoMaN SoFt / LLFB!! 04 May '01

04 May '01

Hi. I want to make an encrypted VPN and I'd like you to advice some free (linux) solutions. My 1st try was FreeSwan but it doesn't build on 2.4.4 kernel (tested with both freeswan latest versions: stable and today's snapshot). I'm having a look to other alternatives (listed in "Other approaches to VPNs for Linux" from freeswan doc). Just right now I'm going to have a look to CIPE. As usual I'd like to hear some words from you (which solution do you recommend and/or have tested for my kernel, ...). Greetings to the ml :) =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 5

New gnpg version. Will SuSE do an upgraded rpm?
by Paul Elliott 04 May '01

04 May '01

I have noted that the gnpg people have made a new release that fix several potential security problems. Will SuSE provide an upgraded RPM or should I get the tar file from the gnpg people?? Viel Spaß -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

security-control.sh
by wolfgang tinhofer 04 May '01

04 May '01

greetings! a reboot this morning caused 5 D prozesses after the cron.daily/aaa_base_rotate_logs 3300 ? D 0:00 cp /var/log/messages /var/log/messages.o 11506 ? D 0:02 pico messages 17222 ? D 0:00 /usr/local/bin/logtail /var/log/messages 22112 ? D 0:00 tailf messages 30305 ? D 0:00 tail messages as this script worked for a long time and works for others, maybe someone could give me a hint, where to search for reasons for this strange behavior (not the script behavior) thanks wolfgang tinhofer

2 1

harden suse log
by Togan Muftuoglu 04 May '01

04 May '01

Hi, Hope this is not a FAQ but I have questions I did run harden_suse yes since this is a firewall/router box. Output from harden_suse v3.2 run on Fri May 4 09:07:42 EEST 2001 1) If this is a firewall router pc why disabling IP Forwarding I thought it was necessary Found /etc/rc.config, working on it ... Disabled IP Forwarding. 2) If ADSL is disabled how am I suppose to connect the Internet ? Disabled service ADSL. 3) Why disable IDS or issue a warning for a similiar? Warning: I'm leaving SCANLOGD enabled! Disabled service SNORT. 4) the only difference I see is use of cracklib whats the importance or benefit having it enabled ATTENTION: You have modified /etc/pam.d/sshd. Leaving it untouched... You can find my version in /etc/pam.d/sshd.SuSEconfig... -- Togan Muftuoglu

1 0

Re: [suse-security] kernel 2.4.2 and (new) IP MasQ configuration
by Harold ! 04 May '01

04 May '01

Ashley and other helpful list posters: Yes, please do. I appreciate your help in this matter. I am new to linux (less then 6 months serious exp) and want to keep my local lan secure. For you others: I apoligise if I intruded on your security discussions. I did NOT see a listserv for "idiots". I had no intentions of disturbing your "world" I only seek to learn what is (IMHO) a much better netowrking OS. In the short time I've used it, I'm inpressed. No, my real name does not appear in my emails sent. If ya really must know it's Bramton (NorDak Internet) >From: Ashley <ashleyg(a)dnai.com> >To: suse-security(a)suse.com >Subject: Re: [suse-security] kernel 2.4.2 and (new) IP MasQ configuration >Date: Thu, 3 May 2001 11:00:47 -0700 >MIME-Version: 1.0 >Received: from [202.58.118.3] by hotmail.com (3.2) with ESMTP id >MHotMailBCBAF530002040043251CA3A76030B230; Thu May 03 11:57:53 2001 >Received: (qmail 14470 invoked by alias); 3 May 2001 18:57:20 -0000 >Received: (qmail 14449 invoked from network); 3 May 2001 18:57:19 -0000 >From suse-security-return-7039-ambrosius1972 Thu May 03 11:58:44 2001 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >list-help: <mailto:suse-security-help@lists.suse.com> >list-unsubscribe: <mailto:suse-security-unsubscribe@lists.suse.com> >list-post: <mailto:suse-security@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)lists.suse.com >Message-ID: <20010503110047.E32593(a)rose.ashnet> >Mail-Followup-To: suse-security(a)suse.com >References: <F219hQdOgl4rhYQYx3G00012142(a)hotmail.com> >User-Agent: Mutt/1.3.12i >In-Reply-To: <F219hQdOgl4rhYQYx3G00012142(a)hotmail.com>; from >ambrosius1972(a)hotmail.com on Thu, May 03, 2001 at 02:36:19AM -0500 > >SuSEfirewall does not support iptables as shipped with 7.1, But it does >recognized if you are using the 2.2.18 or 2.4 kernel and does the >appropriate thing to setup ipchains. > >I was just playing with netfilter yesterday (and the day before that, >and the day before that... ). I'm masquerading a subnet behind a >dynamic ppp link. I hacked together a SuSEesque >init script and iptables rules script to setup up a iptables >firewall for a stock 7.1 system. I will send it to you if you are >interested. > >Some good sites for netfilter: >http://va.samba.org/netfilter/ >http://www.BoingWorld.com/workshops/linux/iptables-tutorial/ >http://ods.dyndns.org/ipt_flow.html >http://www.cs.princeton.edu/~jns/security/iptables/ >http://www.kalamazoolinux.org/presentations/20010417 > > >On Thu, May 03, 2001 at 02:36:19AM -0500, Harold ! wrote: > > Has anyone setup Connection sharing with kernel 2.4.2-4suse ?? > > I use a dialup connection and share it currently with IP Masq. Looking > > forward to migrating to netfilter's con sharing... > > > > I am currently running ManDrake 7.2 on my "server" box, and and to >replace > > it with SuSE (running the updated kernel. I know that IP Masq has been > > replaced with netfilter. My questions are as follows: > > > > 1. Is the neccessary utils bundled with SuSE 7.1 Pro (updated)? > > 2. Does the SuSEFirewall utility set this up? > > 3. If not Where can I find Idiot instructions? > > > > Thank you for your time. > > Ambrosius1972(a)hotmail.com > > > > _________________________________________________________________ > > Get your FREE download of MSN Explorer at http://explorer.msn.com > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > >-- >-ashley > > One of these days I'm going to completely organize my life. > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

2 1

ashley's netfilter firewall scripts for SuSE7.1
by Ashley 04 May '01

04 May '01

Several people asked me for these scripts, so I'm posting them. Perhaps frittering my week on this was not a waste after all. But really I should be out looking for a job. Take a look. I'm very open to comments. My sh skills are rough. To make the init script part of the SuSE init system, I added a var in /etc/rc.config: START_IPTABLES_FW, I made links in /etc/init.d/rc#.d and a link for rciptables in /use/sbin: root@rose:~ >ls -l /usr/sbin/rciptables lrwxrwxrwx 1 root root 20 May 2 11:06 /usr/sbin/rciptables -> /etc/init.d/iptables root@rose:~ >ls -lR /etc/init.d/rc*.d/*iptables lrwxrwxrwx 1 root root 11 May 2 10:27 /etc/init.d/rc2.d/K17iptables -> ../iptables lrwxrwxrwx 1 root root 11 May 2 10:28 /etc/init.d/rc2.d/S04iptables -> ../iptables lrwxrwxrwx 1 root root 11 May 2 11:02 /etc/init.d/rc3.d/K17iptables -> ../iptables lrwxrwxrwx 1 root root 11 May 2 11:01 /etc/init.d/rc3.d/S04iptables -> ../iptables root@rose:~ >grep FW /etc/rc.config START_FW="no" START_IPTABLES_FW="yes" And definately have a look at James Stephen's iptables tutorial: http://www.cs.princeton.edu/~jns/security/iptables/ #!/bin/sh #set -x # # ================================================================== # # Iptables startup script # /etc/init.d/iptables # # For use on rose.ashnet SuSE7.1 # by ashley 4/30/2001 IPTABLES=/usr/sbin/iptables IPTABLES_CONFIG=/sbin/iptables.rules . /etc/rc.config # Determine the base and follow a runlevel link name. base=${0##*/} link=${base#*[SK][0-9][0-9]} # Force execution if not called by a runlevel directory. # I added a var in /etc/rc.config test $link = $base && START_FW=yes test "$START_IPTABLES_FW" = yes && START_FW="yes" test "$START_FW" = yes || exit 0 # Let's test that everything is in place echo "Ashley's iptables firewall: " return=$rc_done # check we have the iptables executable if [ ! -x $IPTABLES ]; then echo " Can't find $IPTABLES:$rc_failed" return=$rc_failed && exit 1 fi # check we have the right kernel version KERNELMAJ=`uname -r | sed -e 's,\..*,,'` KERNELMIN=`uname -r | sed -e 's,[^\.]*\.,,' -e 's,\..*,,'` if [ "$KERNELMAJ" -lt 2 ] || [ "$KERNELMAJ" -eq 2 -a "$KERNELMIN" -lt 3 ] ; then echo " No iptables support in kernel `uname -r`:$rc_failed" return=$rc_failed && exit 1 fi # Check if ipchains is already running if /sbin/lsmod 2>/dev/null |grep -q ipchains ; then echo " module ipchains already loaded:$rcfailed" return=$rc_failed && exit 1 fi # Check if iptables modules are already loaded iptables_loaded="no" if /sbin/lsmod 2>/dev/null |grep -q ip_tables ; then iptables_loaded="yes" fi # Looks good, let's get started case "$1" in start | restart) # We don't have the rules script? if [ ! -f $IPTABLES_CONFIG ]; then echo -n " Can't find firewall rules file $IPTABLES_CONFIG: " return=$rc_failed else echo -n " Loading rules: " $IPTABLES_CONFIG > /dev/null 2>&1 || return=$rcfailed fi echo -e "$return" ;; stop) if [ $iptables_loaded = yes ]; then echo " Flushing all chains, removing user defined chains and" echo " Resetting built-in chains to the default ACCEPT policy:" echo -n " The filter table: " $IPTABLES -P INPUT ACCEPT $IPTABLES -P OUTPUT ACCEPT $IPTABLES -P FORWARD ACCEPT $IPTABLES -F $IPTABLES -X $IPTABLES -Z echo -e "$rc_done" echo -n " The nat table: " $IPTABLES -t nat -P PREROUTING ACCEPT $IPTABLES -t nat -P OUTPUT ACCEPT $IPTABLES -t nat -P POSTROUTING ACCEPT $IPTABLES -t nat -F $IPTABLES -t nat -X $IPTABLES -t nat -Z echo -e "$rc_done" # Not in use #echo -n " The mangle table: " #$IPTABLES -t mangle -P PREROUTING ACCEPT #$IPTABLES -t mangle -P OUTPUT ACCEPT #$IPTABLES -t mangle -F #$IPTABLES -t mangle -X #$IPTABLES -t mangle -Z #echo -e "$rc_done" #echo -n " Stop forwarding and unload all the iptables modules: " #echo 0 > /proc/sys/net/ipv4/ip_forward #/sbin/rmmod `lsmod | awk '{print $1}' | grep '^ip'` #echo -e "$rc_done" else echo " No iptables modules loaded." fi ;; status) # I recommend piping this to `less` if [ $iptables_loaded = yes ]; then echo echo ' FILTER TABLE' echo $IPTABLES -t filter -L -v --line-numbers echo echo ' NAT TABLE' echo $IPTABLES -t nat -L -v --line-numbers echo #echo ' MANGLE TABLE' #echo #$IPTABLES -t mangle -L -v --line-numbers #echo else echo " No iptables modules loaded." fi ;; panic) if [ $iptables_loaded = yes ]; then echo " PANIC! Change all target policies to DROP: " echo -n " The filter table: " $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -F $IPTABLES -X $IPTABLES -Z echo -e "$rc_done" echo -n " The nat table: " $IPTABLES -t nat -P PREROUTING DROP $IPTABLES -t nat -P OUTPUT DROP $IPTABLES -t nat -P POSTROUTING DROP $IPTABLES -t nat -F $IPTABLES -t nat -X $IPTABLES -t nat -Z echo -e "$rc_done" # Not in use #echo -n " The mangle table: " #$IPTABLES -t mangle -P PREROUTING DROP #$IPTABLES -t mangle -P OUTPUT DROP #$IPTABLES -t mangle -F #$IPTABLES -t mangle -X #$IPTABLES -t mangle -Z #echo -e "$rc_done" echo -n " Stop forwarding and unload all the iptables modules: " echo 0 > /proc/sys/net/ipv4/ip_forward /sbin/rmmod `lsmod | awk '{print $1}' | grep '^ip'` echo -e "$rc_done" else echo " No iptables modules loaded." fi ;; *) echo "Usage: $0 {start|stop|restart|status|panic}" exit 1 esac # Inform the caller not only verbosely and set an exit status. test "$return" = "$rc_done" || exit 1 exit 0 #!/bin/bash ##============================================================ # Iptables firewall rules loading script # /sbin/iptables.rules # ##ag Adapted form the tutorial by James C. Stephens <jns(a)gfdl.noaa.gov> ##ag for use on rose.ashnet 4/30/2001 by ashley. ##ag My comments look like this ##ag # ##ag This is the K I S S version. ##ag I cut out James' wonderful comments for readablity. ##ag Look for full documentation at James' site: ##ag http://www.cs.princeton.edu/~jns/security/iptables/ IPTABLES=/usr/sbin/iptables MODPROBE=/sbin/modprobe ECHO=/bin/echo # Load appropriate modules. #$MODPROBE ip_tables #$MODPROBE ip_conntrack #$MODPROBE ip_conntrack_ftp ##ag The above calls aren't needed if the MASQ module is loaded; ##ag it brings them with it. $MODPROBE ipt_MASQUERADE # Flush rules $IPTABLES -F $IPTABLES -X $IPTABLES -Z $IPTABLES -t nat -F $IPTABLES -t nat -X $IPTABLES -t nat -Z # Default policy $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT DROP $IPTABLES -t nat -P PREROUTING ACCEPT $IPTABLES -t nat -P OUTPUT ACCEPT $IPTABLES -t nat -P POSTROUTING ACCEPT ## =========================================================== ## Some definitions: ##ag ashnet locals INT_NET="192.168.0.0/24" INT_IPADDR="198.168.0.1" INT_IFACE="eth0" EXT_IFACE="ppp0" INT_MAIL="192.168.0.2" ##ag my isp stuff NAMESERVER_1="207.172.3.10" NAMESERVER_2="207.172.3.11" POP3_HOST="208.59.199.22" SMTP_MAIL_RELAY= ##ag general P_PORTS="0:1023" UP_PORTS="1024:65535" TR_SRC_PORTS="32769:65535" TR_DEST_PORTS="33434:33523" ## ============================================================ ## Kernel flags #echo kernel flags $ECHO "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts $ECHO "0" > /proc/sys/net/ipv4/conf/all/accept_source_route $ECHO "0" > /proc/sys/net/ipv4/conf/all/accept_redirects $ECHO "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ##ag Don't I need to do this _after_ my ppp0 interface comes up? #for interface in /proc/sys/net/ipv4/conf/*/rp_filter; do # $ECHO "1" > ${interface} #done ##ag Instead I'll just do the 'all' version $ECHO "1" > /proc/sys/net/ipv4/conf/all/rp_filter $ECHO "1" > /proc/sys/net/ipv4/conf/all/log_martians $ECHO "1" > /proc/sys/net/ipv4/ip_forward ## ============================================================ # RULES #=================================================================== ## The FORWARD chain #echo The FORWARD chain # I'm masquerading everything from my internal lan $IPTABLES -t nat -A POSTROUTING -o $EXT_IFACE -j MASQUERADE #$IPTABLES -A FORWARD -i $INT_IFACE -m state --state NEW,RELATED,ESTABLISHED -j LOG --log-prefix "ACCEPT FORWARD --state NEW,E,R:" $IPTABLES -A FORWARD -i $INT_IFACE -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT #$IPTABLES -A FORWARD -i $EXT_IFACE -m state --state RELATED,ESTABLISHED -j LOG --log-prefix "ACCEPT FORWARD --state E,R:" $IPTABLES -A FORWARD -i $EXT_IFACE -m state --state RELATED,ESTABLISHED -j ACCEPT # Log the losers $IPTABLES -A FORWARD -i $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -j LOG --log-prefix "DROP FORWARD IN-PPP0: " $IPTABLES -A FORWARD -i $EXT_IFACE -j DROP #============================================================================== # Local Processes on Rose #echo Local Processes on Rose ## LOOPBACK #echo LOOPBACK $IPTABLES -A INPUT -i lo -j ACCEPT $IPTABLES -A OUTPUT -o lo -j ACCEPT ## SYN-FLOODING PROTECTION #echo SYN-FLOODING PROTECTION ##ag Probably I don't need this, as I have no servers running. $IPTABLES -N syn-flood $IPTABLES -A INPUT -p tcp --syn -j syn-flood $IPTABLES -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN $IPTABLES -A syn-flood -j DROP ## Make sure NEW tcp connections are SYN packets $IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP ## FRAGMENTS #echo FRAGMENTS # Log fragments just to see if we get any, and deny them too. $IPTABLES -A INPUT -f -j LOG --log-prefix "IPTABLES FRAGMENTS: " $IPTABLES -A INPUT -f -j DROP ## SPOOFING ##ag I cut out this section ##ag I'll rely on the kernel flags ## DNS #echo DNS # Allow UDP packets in for DNS client from nameservers. No tcp. $IPTABLES -A INPUT -i $EXT_IFACE -p udp -s $NAMESERVER_1 --sport 53 -m state --state ESTABLISHED -j ACCEPT $IPTABLES -A INPUT -i $EXT_IFACE -p udp -s $NAMESERVER_2 --sport 53 -m state --state ESTABLISHED -j ACCEPT # Allow UDP packets to DNS servers from client. $IPTABLES -A OUTPUT -o $EXT_IFACE -p udp -d $NAMESERVER_1 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT $IPTABLES -A OUTPUT -o $EXT_IFACE -p udp -d $NAMESERVER_2 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT ## SSH #echo SSH # Allow ssh outbound all interfaces. $IPTABLES -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT $IPTABLES -A OUTPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT ##ag Allow connections from internal lan (and log while testing) #$IPTABLES -A INPUT -i $INT_IFACE -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j LOG --log-prefix "ACCEPT ssh from internal --state NEW,E,R: " $IPTABLES -A INPUT -i $INT_IFACE -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT #$IPTABLES -A OUTPUT -o $INT_IFACE -p tcp --sport 22 -m state --state ESTABLISHED -j LOG --log-prefix "ACCEPT ssh from internal --state E,R: " $IPTABLES -A OUTPUT -o $INT_IFACE -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT ## WWW ##ag I'll include this when I get my squid proxy up #echo WWW # Allow www outbound to 80. #$IPTABLES -A INPUT -i $EXT_IFACE -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT #$IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT # Allow www outbound to 443. #$IPTABLES -A INPUT -i $EXT_IFACE -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT #$IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT ## FTP ##ag For future ftp proxy #echo FTP # Allow ftp outbound. #$IPTABLES -A INPUT -i $EXT_IFACE -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT #$IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT # 1) Active ftp. #$IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT # 2) Passive ftp. #$IPTABLES -A INPUT -i $EXT_IFACE -p tcp --sport $UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED -j ACCEPT #$IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp --sport $UP_PORTS --dport $UP_PORTS -m state --state ESTABLISHED,RELATED -j ACCEPT ## SMTP #echo SMTP ##ag Allow smtp outbound to internal lan only. $IPTABLES -A INPUT -i $INT_IFACE -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT $IPTABLES -A OUTPUT -o $INT_IFACE -p tcp --dport 25 -m state --state NEW,ESTABLISHED -j ACCEPT ## TRACEROUTE #echo TRACEROUTE # Outgoing traceroute to internet. $IPTABLES -A OUTPUT -o $EXT_IFACE -p udp --sport $TR_SRC_PORTS --dport $TR_DEST_PORTS -m state --state NEW -j ACCEPT ## ICMP #echo ICMP ##ag This is where netfilter really shines. It is sooo much easier! ##ag rose can ping either interface and accepts pings from internal $IPTABLES -A INPUT -i $EXT_IFACE -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -i $INT_IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A OUTPUT -o $EXT_IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A OUTPUT -o $INT_IFACE -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT ## LOGGING #echo LOGGING ##ag Rate limit the logging # Any udp not already allowed is logged and then dropped. $IPTABLES -A INPUT -i $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p udp -j LOG --log-prefix "DROP UDP-IN: " $IPTABLES -A INPUT -i $EXT_IFACE -p udp -j DROP $IPTABLES -A OUTPUT -o $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p udp -j LOG --log-prefix "DROP UDP-OUT: " $IPTABLES -A OUTPUT -o $EXT_IFACE -p udp -j DROP # Any icmp not already allowed is logged and then dropped. $IPTABLES -A INPUT -i $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p icmp -j LOG --log-prefix "DROP ICMP-IN: " $IPTABLES -A INPUT -i $EXT_IFACE -p icmp -j DROP $IPTABLES -A OUTPUT -o $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p icmp -j LOG --log-prefix "DROP ICMP-OUT: " $IPTABLES -A OUTPUT -o $EXT_IFACE -p icmp -j DROP # Any tcp not already allowed is logged and then dropped. $IPTABLES -A INPUT -i $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p tcp -j LOG --log-prefix "DROP TCP-IN: " $IPTABLES -A INPUT -i $EXT_IFACE -p tcp -j DROP $IPTABLES -A OUTPUT -o $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -p tcp -j LOG --log-prefix "DROP TCP-OUT: " $IPTABLES -A OUTPUT -o $EXT_IFACE -p tcp -j DROP # Anything else not already allowed is logged and then dropped. $IPTABLES -A INPUT -i $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -j LOG --log-prefix "DROP PROTOCOL-X-IN: " $IPTABLES -A INPUT -i $EXT_IFACE -j DROP $IPTABLES -A OUTPUT -o $EXT_IFACE -m limit --limit 6/h --limit-burst 5 -j LOG --log-prefix "DROP PROTOCOL-X-OUT: " $IPTABLES -A OUTPUT -o $EXT_IFACE -j DROP # THE END # ================================================================== -- -ashley One of these days I'm going to completely organize my life.

1 0

Re: [suse-security] How to prevent home-phoning ?
by christian.burri＠synecta.ch 03 May '01

03 May '01

I suggest that you use iptables and snort on the SuSE box and then, additionally go and install something like norton personal firewall or something alike on the internal computers (if they 're win32 as I suppose). The SuSE box divides your LAN from the internet, whereas the (host based) personal firewalls allow you to see which process uses what sockets and connects to where, plus you can allow/disallow individual applications. A drawback however is, that the win32 personal firewalls wont most likely not log to a centralized syslog, plus you will have to configure (and eventually maintain) them all manually. A different approach is presented by NFR (www.nfr.com) They do offer a complete solution for intrusion detection that works with agents, which, once deployed on each host within the LAN, log to the central NFR log repository (afaik). But this is like, costly ;-( hope that helps & cheers Chris Burri jun. Systems- & Network Engineer Synecta Informatik AG 9000 St. Gallen Switzerland .-. /v\ L I N U X // \\ >Phear the Penguin< /( )\ ^^-^^ |--------+-----------------------> | | Andreas | | | Fiesser | | | <fiesser(a)gmx.| | | net> | | | | | | 03.05.01 | | | 18:49 | | | | |--------+-----------------------> >---------------------------------------------------------------------------------------------------------------------------------------------| | | | To: Security SuSE <suse-security(a)suse.com> | | cc: | | Subject: [suse-security] How to prevent home-phoning ? | >---------------------------------------------------------------------------------------------------------------------------------------------| I've got a SuSE 7.0 box sitting between my home LAN and my DSL ISP. Among other services this host acts as a firewall for the LAN. The clients connect by masquerading or JunkBuster (running on the router) to the internet. Theoretically the FW should keep all the bad boys/girls out by stealthing my ports. How can I make sure that only those apps get out where I say it's OK ? I figure that this is no trivial task but maybe there are solutions to do this. Primarily I use Netscape to browse the Net and do my e-mails. Then I need a few programs to ftp outside. I guess it's a bit tricky to know if any other software tries to establish connections ? Sorry, if this sounds a bit naive but I'm wondering if my firewall thingy is actually any good in the days of spyware thrown at us users "to improve the knowledge about the needs of dear customers". --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

How to prevent home-phoning ?
by Andreas Fiesser 03 May '01

03 May '01

I've got a SuSE 7.0 box sitting between my home LAN and my DSL ISP. Among other services this host acts as a firewall for the LAN. The clients connect by masquerading or JunkBuster (running on the router) to the internet. Theoretically the FW should keep all the bad boys/girls out by stealthing my ports. How can I make sure that only those apps get out where I say it's OK ? I figure that this is no trivial task but maybe there are solutions to do this. Primarily I use Netscape to browse the Net and do my e-mails. Then I need a few programs to ftp outside. I guess it's a bit tricky to know if any other software tries to establish connections ? Sorry, if this sounds a bit naive but I'm wondering if my firewall thingy is actually any good in the days of spyware thrown at us users "to improve the knowledge about the needs of dear customers".

2 1

kernel 2.4.2 and (new) IP MasQ configuration
by Harold ! 03 May '01

03 May '01

Has anyone setup Connection sharing with kernel 2.4.2-4suse ?? I use a dialup connection and share it currently with IP Masq. Looking forward to migrating to netfilter's con sharing... I am currently running ManDrake 7.2 on my "server" box, and and to replace it with SuSE (running the updated kernel. I know that IP Masq has been replaced with netfilter. My questions are as follows: 1. Is the neccessary utils bundled with SuSE 7.1 Pro (updated)? 2. Does the SuSEFirewall utility set this up? 3. If not Where can I find Idiot instructions? Thank you for your time. Ambrosius1972(a)hotmail.com _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

3 2