May 2001 - openSUSE Security - openSUSE Mailing Lists

iptables simple script, but...
by Pupeno 29 May '01

29 May '01

Yes, I'll use an iptables simple script or not so simple, it doesn't matter, where should I place it and where should I call you (I'm an RH and Mdk experienced user an suse it's a bit diferent, and partialy lost, that's why I'm asking this). -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar

1 0

Openssh + PAM
by José Luis Ledesma 29 May '01

29 May '01

I wanna use pam with openssh using ssh2... openssh version is 2.5.1p1 (Suse 7.1) and pam works when I use ssh1 client, but it does not work using ssh2 as client... Thankyou José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59

1 0

ipx and apache (maybe OT, maybe hole)
by Christian Lox 29 May '01

29 May '01

Hi everyone! Maybe this one is off topic but I am not sure... We have a SuSE box acting as a webserver. Now I noticed during one of our regular nmaps that ipx ports is open. But: gw:/usr/src/linux # grep IPX .config # CONFIG_IPX is not set The other day I noticed somehting like rpc-sometime or similar. I immediately did stop all not 100% necessary processes and this one did vanish. Maybe this belongs to our tests with Sybase?! Any hint appreciated, Christian

3 3

suspicious named-udp-port?
by Daniel Quappe 29 May '01

29 May '01

hi list, today i found an open unprivileged udp-port on my server listening on 0.0.0.0 which i detected to be related to my named-server 8.2.3-REL (update done...;-) if i shut down the named and restart it another (possibly random) high udp-port is used in addition to the privileged udp-port 53 listening on my "real" interfaces. is this something to worry about?! a nervous list-reader...;-) daniel -- Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

application fw or ipchains based ones
by kaldewey 29 May '01

29 May '01

Hallo , I have used ipchains in Suse 7.0 to protect my network but now I want to protect our intranet server safer -more features and more confortable . I read about TIS ,Sinus ,seattle firewall ,firestarter ..... Can someone offert on ? Thanx Frank

2 1

SuSEfirewall and Kernel 2.4.0
by Benjamin Grogg 29 May '01

29 May '01

Hi folks I read that SuSEfirewall on SuSE 7.1 (Kernel 2.4.0 (Standard)) is not supported? Is there any script who supported iptables? Or I have to recompile the 2.4.0 Kernel with ipchains support? Thanks Benny

3 2

IP-alias
by Jussi Jääskeläinen 29 May '01

29 May '01

Hi! I'm not sure is this right area for next question but.. I have defined: ifconfig eth0 10.113.1.211 # main address ifconfig eth0:0 10.113.1.210 #alias address so normaly all outgoing trafic have that .211 as source address. Question is.. Is it possible (when it is needed) to open connection to outside so that source address is .210 (alias-address)... Without changing eth0 address.. -- Jussi Jääskeläinen Email: jussi.jaaskelainen(a)audioriders.fi Audio Riders Oy Tel: +358-9-276 6820 direct: +358-9-276 68212 Järvihaantie 4 Mobile: +358-40-554 3689 FIN-01800 KLAUKKALA Fax: +358-9-879 8045 FINLAND WWW: http://www.audioriders.fi

1 0

Antwort: RE: [suse-security] Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 29 May '01

29 May '01

Hi Matt, hi Pupeno I haven't disabled SuSEfirewall. I haven't installed it. I tried it a long time ago, but it doesn't work at my dsl-router. As I had to reinstall the Distribution (I switch from ISDN-dialup to DSL), I let SuSEfirewall untouched as rpm on the cd's. First I used IPCHAINS because ISDN doesn't want to work with kernel 2.4.x. As I get DSL I switch from IPCHAINS to IPTABLES. First I had to reconfigure the firewall at my firm, then at home. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

PHP, mod_perl, Apache ???
by Bill Jones 29 May '01

29 May '01

Btw: I do not know who the original poster was, but this was recently seen during my studies concerning using both OpenSSL and Apache (SSL/443) on a SuSE 7.1 Ultrasparc (2.4.2) server: http://www.faqts.com/knowledge_base/view.phtml/aid/8223/fid/30 Please forward to original poster if anyone here remembers who. HTH; -Sneex- :] Please see: http://cis4dl.sourceforge.net/ and/or http://sourceforge.net/docman/display_doc.php?docid=4818&group _id=26707 ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Fwd: RE: [suse-security] Orginal firewall.rc.config file ?
by Faessen-Goden Jean-Paul en Rowena 29 May '01

29 May '01

---------- Forwarded Message ---------- Subject: RE: [suse-security] Orginal firewall.rc.config file ? Date: Sun, 27 May 2001 11:35:06 +0100 From: "Matt" <matt(a)import-it.co.uk> Coul I use http://www.linux-firewall-tools.com/cgi-bin/firewall.cgi Would the config there be ok and does SuSE work on the same process ? Regards Matt -----Original Message----- From: Matt [mailto:matt@import-it.co.uk] Sent: 27 May 2001 10:30 To: suse-security(a)suse.com Subject: [suse-security] Orginal firewall.rc.config file ? Hi, Now that I am having all these problems with firewalls etc and maybe messed up my orginal firewall.rc.config file does any one have an orginal one that I could use as a template please ? Regards Matt -----Original Message----- From: Matt [mailto:matt@import-it.co.uk] Sent: 27 May 2001 02:34 To: suse-security(a)suse.com Subject: [suse-security] SuSEfirewall configuration help SuSEfirewall config... Please could someone send me an example of one with the following settings enabled please.. I use SAMBA, telnet, rlogin, ftp and vnc, ping, traceroute on 3 my machines 192.168.0.2 (SuSE 7.0, 192.168.0.3 (SuSE 6.4) and use my win2000 box to work on (192.168.0.1). these are all on eth0 with win2000 used to dialup on. I would like to set up 192.168.0.2 as my gateway/router but at the moment I have configured my win2000 box. However whilst setting up SuSEfirewall my system hung on the firewall first run initialisation. I can neither login or do anything on reboot. I could login in single user mode but I don't know how to do that ant directions ? Regards Matt --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com ------------------------------------------------------- Matt; Never change your system without taking note of what you did. Look into the SuSE Handbook,provided with SuSE professional. The standard configuration is there. Jean-Paul Faessen

1 0

Re: [Re: [suse-security] [Re: Auth]]
by Bill Jones 29 May '01

29 May '01

Hmmm... Don't know about AUTH, but I know that the file /etc/mail/relay-domains should be empty and the file /etc/mail/access should say something like: # Examples: # #cyberspammer.com ERROR:"550 We don't accept mail from spammers" #sendmail.org OK #192.168 RELAY # # Extensions: # # See /usr/share/sendmail/README for the FEATURE `blacklist_recipients'. # # Default for loop back is RELAY 127 RELAY What does your's say??? -Sneex- :] Sp0oKeR <spooker(a)bol.com.br> wrote: > Many times a day, people are using my mail server to do > spam. With auth e intend to stop this. ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Auth
by Sp0oKeR 29 May '01

29 May '01

I'm doing problems with spam in my mail server. I'm using sendmail. Trying to resolve this problem, I will try sendmail auth. Does anybody can help? What program i need to use? Regards .... -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # http://www.nscenter.com.br # # Sao Paulo - SP # #=============================#

1 0

[Re: Auth]
by Bill Jones 29 May '01

29 May '01

Sp0oKeR <spooker(a)bol.com.br> wrote: > I'm doing problems with spam in my mail server. I'm using sendmail. > Trying to resolve this problem, I will try sendmail auth. Does > anybody can help? What program i need to use? > > Regards .... Spam? Do you mean relaying or final delivery? ??? -Sneex- :] ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Newbies, Lists, and helping ( Was: OT ... Rant :/ )
by Bill Jones 29 May '01

29 May '01

In Cyberspace, two entities spake - > The SuSE mailing list is by far the best I've found. I have > not experienced any real derogatory remarks or comments > from the Linux vets. As for the "what the experience user > won't see", I understand this also. > > Help yourself and others by contributing and not just consuming! I agree, and I apologize for the OT rant earlier. I myself should know better as I am IT professional with 22 yrs experience. I even teach Internet related technologies at a local community college and I am always warning my students about how they should spent more time trying to find the answers themselves BEFORE posting what may amount to FAQs to any list... However, as hard as it may be to believe even I am human and sometimes even I find that I just want it to work :) I guess 22 yrs hasn't turned me into a machine yet, Thank GOD! Best; -Sneex- :] ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

self compiled kernel 2.2.19 problems
by Frederik Ferner 28 May '01

28 May '01

Hi All, some time ago I downloaded lx_sus22-2.2.19.SuSE-25.i386.rpm and tried to install it to compile it myself. Everything work fine except that the kernel sometimes freezes my computer completely, ie I have to reset it. There is nothing in the lockfiles, but then it might not be written to the disc :-( This happens on my SuSE 6.3 with all security related updates. I tried to run a precompiled kernel from SuSE (k_i386-2.2.19-12.i386.rpm) and didn't have any problems there so far. But I don't want all the stuff that is in there (like raid, lvm...). I'd really like to have my kernel as small as possible for the machine sitting directly on the web. Any hints how I could get around this problem? Sysrq doesn't seem to work on my computer. At least I haven't managed to get any results with sysrq. Bye, Frederik

2 1

RE: [suse-security] Samba with iptables
by Stefan_Walther＠gehag-dsk.de 28 May '01

28 May '01

samba is using netbios. you have to open the ports from 137 to 139. if you have a dns server in your local lan, you should open port 53 too. because you can find and access the samba-server much faster than without using a nameserver. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0

Samba with iptables
by zonionz＠gmx.net 28 May '01

28 May '01

Hi I´ve got a server with Suse 7.1 and kernel 2.42, samba and iptables and some client machines with win95. Now I want to make rules for iptables to allow a local connection between the clients and the server using Samba, I think Samba uses Port 137,138 and 53 (default police is drop) Has anybody a working filtering rule for that? Thanks! Sylvain -- Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

New security articel on SuSE Knowledge Portal
by Thomas Biege 28 May '01

28 May '01

Hi ppl, just a short note: The first part of my paper about security bugs in source code was released on SuSE's Knowledge Portal. english: http://portal.suse.de/en/content.php?3occccccccccccccccccccmccccccccccocccc… german: http://portal.suse.de/de/content.php?3occccccccccccccccccccmccccccccccocccc… The original paper with all it's typos and in german language can be found on http://www.suse.de/~thomas/papers/index.html I hope you all enjoy reading it. ;-) I would be happy if you report mistakes/errors/typos I made. And again, thanks to the portal team. :-) Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

2 2

iptable and pop3, long response time
by Henri Valeins 28 May '01

28 May '01

Hi, I use iptable with a kernel 2.4.2 with this rules for pop3 and DNS # ---------------------------------------------------------------------------- # DNS client (53) # --------------- iptables -A INPUT -p udp \ -s $NAMESERVER_1 --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER_1 --dport 53 -j ACCEPT iptables -A INPUT -p tcp ! --syn \ -s $NAMESERVER_1 --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -p tcp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER_1 --dport 53 -j ACCEPT # ------------------------------------------------------------------ # POP server (110) # Acces pour : # ---------------- iptables -A INPUT -p tcp \ -s $popclient --sport $UNPRIVPORTS \ -d $IPADDR --dport 110 -j ACCEPT iptables -A OUTPUT -p tcp ! --syn \ -s $IPADDR --sport 110 \ -d $popclient --dport $UNPRIVPORTS -j ACCEPT with $IPADDR = ip adress for localhost $popclient = ip adresse for the pop client $UNPRIVPORTS="1024:65535" $NAMESERVER_1 = ip adress dor the name server -****************************************************************- with this rules I have 10 seconds for the response time, without iptables it's immediatly. WHat is wrong ? -- Henri Valeins Résonance Magnétique des Systèmes Biologiques UMR 5536 CNRS/Université Victor Segalen Bordeaux 2 146 rue Léo-Saignat (case 93) 33076 BORDEAUX cedex tel 33 (0)5 57 57 17 85 fax 33 (0)5 57 57 45 56

2 1

IP Routing based on fwmark
by Mark O. Stitson 28 May '01

28 May '01

Hi there, I have just set up my 2.4 kernel here on our router and I am trying to allocate different services to our two internet connections. I want all of our smtp traffic to go via our normal leased line and all other traffic to go via our faster, but less reliable ADSL line. I have set the default route to go via the ADSL line and added a ip routing table for the mail: popper:~ # ip route list 213.210.21.240/29 dev eth2 proto kernel scope link src 213.210.21.242 213.38.116.168/29 dev eth1 proto kernel scope link src 213.38.116.170 10.0.0.0/16 dev eth0 proto kernel scope link src 10.0.0.2 127.0.0.0/8 dev lo scope link default via 213.210.21.241 dev eth2 popper:~ # ip route list table mail.out default via 213.38.116.170 dev eth1 Then I have set up ip rules: popper:~ # ip rule list 0: from all lookup local ... 32761: from all fwmark 3 lookup mail.out ... 32766: from all lookup main 32767: from all lookup default Then I have added a mangling rule: popper:~ # iptables -A PREROUTING -t mangle -p tcp --dport 25 -j MARK --set-mark 3 All the traffic from the internal network happily obeys the rules and goes via the leased line, but any traffic originating from the router itself on port 25 just goes via the ADSL line and seems not to get marked. Is there a way to implement policy based routing for the router as well? Mark ---------------------------------------------------------------- Dr Mark O. Stitson, Senior Systems Administrator Yospace Ltd, 7 The Courtyard, High Street, Staines, UK, TW18 4DP Tel: +44 1784 466388 Fax: +44 1784 466387 WWW: http://www.yospace.com

1 0

OpenSSH on SuSE 6.3 --> 'PAM adding faulty module: /lib/security/pam_pwcheck.so'
by Alex Liesch 28 May '01

28 May '01

Hi! I've updated one of my older linux servers running SuSE 6.3 to openssh (2.3.0p1) from "the" ssh. Now I have the following entries in messages each time a user logs in: May 27 16:47:25 r100 sshd[16621]: PAM unable to dlopen(/lib/security/pam_pwcheck.so) May 27 16:47:25 r100 sshd[16621]: PAM [dlerror: /lib/security/pam_pwcheck.so: cannot open shared object file: No such file or directory] May 27 16:47:25 r100 sshd[16621]: PAM adding faulty module: /lib/security/pam_pwcheck.so What is 'pam_pwcheck.so' for? My SuSE 7.0 box does have one. Yast did not show any unfulfilled dependencies. Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75

3 3

SuSEFirewall and bridged network
by Norbert Preining 28 May '01

28 May '01

Hi! Is it possible to use SuSEfirewall with a bridged/ipchains network? I use the bridge patches to filter in br0, but the SuSEfirewall always need more interface etc. Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

1 0

configuring firewalls with iptables
by Pupeno 28 May '01

28 May '01

Which is the standard way in SuSE to configure a firewall without using SuSEfirewall, just plain IPtables, or how can I do it (I don't wanna do a dirty script and put it anywhere and run it at anytime). thank you. Carpe diem! -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar

3 2

How to close ports...
by Faessen-Goden Jean-Paul en Rowena 28 May '01

28 May '01

Hi, Using SuSE 7.0 with Suse Firewall. should like to close some ports like port 12345,12346 etc... How to set this in the SuSE Firewall (I use Yast 1 to configure...) and how to test? In windows I had an option in IE to block a sender.How to do this in SuSE?Both konqueror and Netscape... Yhanks Jean-Paul faessen

2 1

Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 28 May '01

28 May '01

You can use a simple script, where you enter the rules you want to have. I have done the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0