May 2001 - openSUSE Security - openSUSE Mailing Lists

Certified Information Systems Security Professional (CISSPT) - Qu estion
by Steven Thompson 24 May '01

24 May '01

Hi All Has any one writen the the "Certified Information Systems Security Professional" exam. Would anyone recomend it. The following books are recommended on their site are any of them good or are there better. https://www.isc2.org/cissp_studyguide#reference Thanks in Advance Steven

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Bob Vickers 24 May '01

24 May '01

Dear All, I just thought I would respond to some of the points people made about my scanrpm script. A couple of people mentioned that it ought to handle ranges of vulnerable versions rather than just single ones. This was certainly my intention originally, but then I looked at the possible forms that version strings can take and realised that parsing and comparing them could be tricky. Probably still possible, but difficult to cover all the cases. And the script at present has the great virtue of simplicity (only 55 non-comment lines at present)...more complexibility means more bugs and more unexpected behaviour. A compromise would be to allow regular expressions in the comparison; this should be easy to implement. Another idea is for keys such as "SEVERITY=x" [x=1..10] and "INFO='Remote Root Exploit'" to give you more information about the exploit...good idea. Felix Huber mentioned autoupdate (http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ ), which I see as a useful but complementary tool. In particular autoupdate only helps if a fixed package is already available...sometimes the only solution is to remove a package. The problem this script is trying to address is that it is currently very hard to be confident that you have acted on all the security alerts relevant to a release. You have to plough through a long series of alerts, some of them referring to updates which no longer exist. Any solution to this problem MUST involve SuSE producing a machine-readable list of either vulnerabilities or security fixes or (preferably) both. Bob -- ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Felix Huber 24 May '01

24 May '01

Hi Bob, I mean AutoUpdate from Gerald Teschl - you find it here http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ But I would no recommend this solution. A updated XML with all necessary information would be much better. Regards, Felix Huber ------------------------------------------------------- Felix Huber, Web Application Programmer, Webtopia Guendlinger Str.2, 79241 Ihringen - Germany huberfelix(a)webtopia.de (07668) 951 156 (phone) http://www.webtopia.de (07668) 951 157 (fax) (01792) 205 724 (mobile) ------------------------------------------------------- > Felix, > > Well I thought the idea couldn't be new, but a quick search on the net > didn't find what I wanted. Do you have something specific in mind? > > Bob > > On Wed, 23 May 2001, Felix Huber wrote: > > > > Hi Bob, > > > > this idea is not so new - there is already a similar tool for RPM releases > > on FTP server in general. > > But a XML file with up-to-date information (dependencies etc) would make > > life much easier. > > > > MfG > > Felix Huber

1 0

WG: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 24 May '01

24 May '01

ReHi folks, the Script you've to download is on that page: http://www.suse.de/~marc/SuSE.html You've to download the SuSEfirewall v4.6 - 29th April 2001 <SuSEfirewall-4.6.tar.gz> Script unless you want to work with iptables (I think so...). In my Opinion the failures are a result of the bootup sequence, means that the fw-script (or parts of it) is loaded BEFORE the devices (eth0, ippp0 etc.) have been initialized! Maybe you've to make new symbolic links! Instead of "S01SuSEfirewall....." try "S25SuSEfirewall" or something like that! But remember that there's no protection between initializing the devices and loading the script! I prefer downloading the newest Script! Maybe some people have to deinstall the old Script (but the new script will do that, won't it?). I'm sure it works, I've spent some days before I got rid of that problem! If you can't get rid of it, try the "ipchains -L" command, to see if the rules have been set correctly! Bye, Mario PS: Sorry because of my bad english!

1 0

Re: [suse-security] firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

just for the record, these commands worked in the end :-) thanks to all that helped. nmap still shows the port open, but I guess this is good enough. iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 5680 -i lo -j ACCEPT iptables -A INPUT -d 127.0.0.1 -p tcp --dport 5680 -j DROP -- http://www.josswinn.org

1 0

Re[2]: AW: [suse-security] ipchains masq + active ftp / OR NETFILTER/IPTABLES...
by da_bug 23 May '01

23 May '01

hi! S> You can use ipchains with kernel 2.4 . You should recompile your S> kernel with ipchains support ou for just tests, insmod ipchains. I do S> the second option to tests and my ipchains work very well. I know that I can use ipchains with kernel 2.4.x but it seems to me (right or not?) that I cannot use this special ipchains-module "ip_masq_ftp.o" with kernel 2.4.x ... >> >> Hi! >> >> CU> I think you need the module ip_masq_ftp.o to masquarade active ftp with >> CU> ipchains, aren't you? So it works fine for me. Perhaps take a look at >> CU> http://www.linux-firewall-tools.com/linux/. >> >> CU> Hope thats you are looking for! >> >> CU> Christian >> >> ..ip_masq_ftp.o would be a good solution, but it seems to me that it >> just works with kernel 2.2.x and not with 2.4.x .. !? >> If there is a possibilty to use it with 2.4.x (ipchains-compatibility) I >> would like to know about... >> Meanwhile I also took a look at Netfilter/Iptables and set up a >> masquerading-rule that works fine so far... but I have the same >> ftp-problem: ;-) >> How can I realize active ftp-connections from the clients behind a >> netfilter/iptables-gateway-pc? >> >> Bye.

1 0

How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

How do I get loopback encryption filesystems working with 2.2.19? I note the .config file created by make xconfig has lines with: CONFIG_BLK_DEV_LOOP CONFIG_CIPHER_TWOFISH ftp.kernel.org does not have a patch listed for 2.2.19 Thank You. -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

4 4

lost in icmp filtering
by Togan Muftuoglu 23 May '01

23 May '01

Hi, I am trying to tighten up my ipchains firewallon my adsl router/firewall box . But looks like I am a litle bit lost. I have read previous mails backing to 2000 May and I am still lost.Maybe too much info is not good) Below is what I have done. Is there anything I should be carefull with if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] then for f in /proc/sys/net/ipv4/conf/*/rp_filter do echo 1 > $f done fi if [ -e /proc/sys/net/ipv4/tcp_syncookies ] then echo 1 > /proc/sys/net/ipv4/tcp_syncookies fi # echo "1" > /proc/sys/net/ipv4/ip_dynaddr echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo "0" > $file done for file in /proc/sys/net/ipv4/conf/*/log_martians; do echo "1" > $file done $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-reply -l $IPCHAINSs -A input -j REJECT -i $OUTERIF -p tcp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p udp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d OUTERIP --icmp-type destination-unreachable -l IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type destination-unreachable -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type redirect -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type time-exceeded -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type parameter-problem -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-reply -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-reply -l -- Togan Muftuoglu

1 0

Re: How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

On Wed, May 23, 2001 at 01:04:44PM +0200, Hubert Mantel wrote: > Hi, > > On Tue, May 22, Paul Elliott wrote: > > > How do I get loopback encryption filesystems working with 2.2.19? > > It's quite easy. You just need a recent losetup binary. Please note that > losetup as of SuSE Linux 7.1 is recent enough ;) > Does this mean I can just grab a 7.1 binary and use it on a 7.0 2.2.19 system? Will there be library incompatabilities? Do I have to get the source and rebuild? -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

1 0

scanrpm: script to check system for known vulnerable packages
by Bob Vickers 23 May '01

23 May '01

Dear All, I had an idea for a utility to make it easier to check a system is up-to-date with patches. I assumed that someone else must have had the idea already, but I couldn't find it on the web so I wrote the utility myself. For this utility to work it needs someone (and I think that someone really needs to be SuSE) to maintain a machine-readable list of packages known to have security holes. All the utility does is reads such a list and then reports any vulnerable packages it finds on the system. So you would use it something like wget -O - ftp://ftp.suse.com/vulnerabilities.txt | scanrpm The vulnerability file should contain lines like openssh VERSION=8.3.0p2 RELEASE=98 where the uppercase keywords correspond to rpm query tags. Do people think this is useful? If so, are SuSE willing to take it on? Of course, the utility would be useful for bad guys as well as good guys, but we are used to that. Current version of the scanrpm utility can be found at http://www.cs.rhul.ac.uk/home/bobv/utils/scanrpm Nothing in the utility is SuSE-specific, but I guess the database would be. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 2

Re: [suse-security] Rinetd
by Sp0oKeR 23 May '01

23 May '01

Redir is the same tha Redirect4All? Because I'm using this do redirect my ftp. But in my webservers I'm using rinetd. The question is: I have about 6000 hits a day, then, I'm with a interface with 2 ips, this ips were from my NT. And I do the redirects. Can a big number os hits down my rinetd? Do you think a should use redir to webserver too ? Regards ... > > ---------- Início da mensagem original ----------- > De: "Kurt Seifried" <listuser(a)seifried.org> > Para: "Sp0oKeR" <spooker(a)bol.com.br>, <suse- security(a)suse.com> > Cc: > Data: Tue, 22 May 2001 21:01:11 -0600 > Assunto: Re: [suse-security] Rinetd > If you want to do this in user space you can use redir which is pretty > reliable in my experience. If you are willing to muck around with your > kernel/etc you can use ipportforwarding, this is covered in the firewall howto > I believe. > > Kurt Seifried, seifried(a)securityportal.com > Securityportal - your focal point for security on the 'net > > > > ----- Original Message ----- > From: "Sp0oKeR" <spooker(a)bol.com.br> > To: <suse-security(a)suse.com> > Sent: Tuesday, May 22, 2001 8:50 PM > Subject: [suse-security] Rinetd > > > Hi all... > I'm using rinetd to bind de port 80, and redirect > to my NT Servers. But the problem é o seguinte: my > rinetd is going down. I'm using SuSE 7.0 and I have been > instaled rinetd from my cd's. > I'using ipchains and masquerading too. > Can somebody help-me? > > Sp0oKeR - NsC > spooker(a)bol.com.br > Powered By Linux - SuSe > > > _________________________________________________________ _________________ > Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! > ASSINE AGORA! http://www.bol.com.br/acessobol/ > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe & Slackware __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

Bind Problem
by Sp0oKeR 23 May '01

23 May '01

I'm using SuSE Linux 7.0 with Bind 8.2.3. My problem, is : My bind is always stopping , I don't know way. This occurs about 1 or 2 times a day. Then , I need to restart it everytime. Can somebody help me? Regards -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # http://www.nscenter.com.br # # Sao Paulo - SP # #=============================#

4 3

[suse-security] ipchains masq + active ftp
by da_bug 23 May '01

23 May '01

Hi! I want to use active-ftp with some clients behind my gateway-pc (ipchains-masquerading)... (passive ftp works) How do I configure my ipchains-firewall to allow this? I hope someone can help me... Bye.

4 6

SINUS Firewall on SuSE 7.1?
by Benjamin Grogg 23 May '01

23 May '01

Hi folks, Anyone have experience with Sinus Firewall on SuSE 7.1? How it works on SuSE? Thanks a lot for your comments :) Benny

1 0

firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

Hello again, well, I have had good feedback from SUSE and other users of the Japanese language server, Canna. As far as security at a software level is concerened, I think it is secure. However, it still shows as an open port 5680 when tested with nmap. I have been told that while the software settings are secure, if I want to make it invisible to nmap, I would need kernel level firewalling. I have Firewall2 set up on my dialup ppp box. Can anyone tell me what settings I need to change in YaST to enable firewalling on port 5680 and make it invisible to the outside? I thought that blocking high ports would do it, but it still shows up on nmap. thanks very much This is more a learning process than a real world security threat, but I appreciate your help all the same. cheers Joss

2 2

Upgrades via mirror and yast2
by Martin Sckopke 23 May '01

23 May '01

Hi all, since version 7.1 YAST2 enables me to automatically update via Internet. I tried to use this feature with a mirror of ftp.suse.com, but YAST2 would not work. What has to be in the mirror directories for YAST2 to work? Thanks for your great support, Martin -- The three golden rules to ensure computer security are: Do not own a computer; do not power it on; and do not use it (Robert (Bob) T.Morris) GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

1 0

RE: [suse-security] Re: OT(?): Apache segfaults after update to 7 .1
by Pini Remo 23 May '01

23 May '01

Updating everything (apache, ssl, mod_php) to the newest version available through ftp (funnily enough NOT through YOU -> why not!?), the problem disappeared... seems to have been a version mismatch. greets and thanx for the help, remo > > After the long due update from 6.4 to 7.1, apache (child-procs only) > > segfaults upon page requests. > > I would say you should try the updated apache 1.3.19

1 0

AW: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 23 May '01

23 May '01

Hi Guys, I had the same problems... But there's no problem, 'cause the Script will produce the ipchain rules! The only thing you've to do ist downloading the newest version of the ipchain script at marcs homepage (www.suse.de/~marc) With that one, there'll be no more failure messages at bootup! Bye, Mario -----Ursprüngliche Nachricht----- Von: Ulrich Schneider [mailto:ulrich_schneider@uni.de] Gesendet: Dienstag, 22. Mai 2001 08:39 An: suse-security(a)suse.com Betreff: [suse-security] SuSEFirewall fails on system startup When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way ! --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Rinetd
by Sp0oKeR 23 May '01

23 May '01

Hi all... I'm using rinetd to bind de port 80, and redirect to my NT Servers. But the problem é o seguinte: my rinetd is going down. I'm using SuSE 7.0 and I have been instaled rinetd from my cd's. I'using ipchains and masquerading too. Can somebody help-me? Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

ftp
by nicemice＠gmx.de 22 May '01

22 May '01

Hi there, Does anybody know how to configure ProFTP to access an internal server = inside a firewall?? The server should be accessible from outside only = with one user ('ftpuser'), but I'd like to use all other user accounts = intern. For this reason at the moment the server is using a different = user and group file. Maybe the problem can also be found in the SUSEfirewall configuration. = Any hints ? Thanx a lot in advance :-)

1 0

gpg
by Roman Drahtmueller 22 May '01

22 May '01

Hi together, the gpg updates to 1.0.5 are available for testing on ftp.suse.de (for SuSE-6.3, 6.4 and 7.0) and ftp.suse.com (7.1 and up). Get the gpgaddon packages as well (for pgp compatibility). All packages are signed using the build(a)suse.de key. Here it is (I've signed it using security(a)suse.de) Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BuQIN BDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUTmIT2iQf07tRUKJJ9v0JX fx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJEpD2hd2f+pMnOWvH2rOO IbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfDqnFDP6L12w3z3F7FFXkz 07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBeRmmoGEKO2JRelGgUJ2CU zOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXstZy7vYjL6vTP4l5xs+LIO kNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3ORzw4LvO1pwRYJqfDKUq /EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5LpC/U6sheLP+l0bLVoq0lm sCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pqUN8QxGJYQnonl0uTJKHJ ENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoGx6INQjf3HGQpMXAWuSBQ hzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M9bHp4d+puY0L1YwN1OMa tcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeqPQUsDv9V7CAJ1dbriEwE GBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCbBQd/++0pB9yZWDhqxHtT pdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =wtNS -----END PGP PUBLIC KEY BLOCK-----

3 4

NetMeeting
by Roland Hilkenbach 22 May '01

22 May '01

Hi list, a coworker of mine needs to work with NetMeeting including audio and video streams. Since we use a T-DSL connection this should be ok. Most of the setup is working fine but there's a catch: her streams are going out but she's not able to _receive_ the other streams. The manual states you have to open UDP transfer to and from the workstation for _every_ other participating computer _and_ port combination! That's since it is not known in advance what IP-adresses the communication partner uses and what ports will be chosen by that software. As far as I've understood the Real-time Transfer Protokol RTP there is an initial connection going to port 1503 and each subsequent datapacket includes the portnumber where to send the next packet. So I figure only stateful firewalls will be able to handle that correctly. My question: Is it possible to archive such a connection with a masquerading Linux-Gateway with a T-DSL connection? Thank you Roland Hilkenbach

1 0

SuSEFirewall2
by Christian Lox 22 May '01

22 May '01

Hi everyone, hope this is the right place (is it, Marc?). I just downloaded SuSEFirewall2 to give it a try. Seems to work great, no serious problems found. One thing annoys me: I did set ping_ext (dont konw the exact name right now) to yes. So ping to the internet should be allowed. But I dont get anything back, not even DENYs in the log. Christian -- we reject: kings, presidents, religions we accept: working code

2 1

SuSEFirewall fails on system startup
by Ulrich Schneider 22 May '01

22 May '01

When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way !

2 1

closing ports (canna, squid and sendmail)
by Joss Winn 22 May '01

22 May '01

Hello, I am reviewing the security on my home desktop and have a question which I hope is simple to answer. I should say that I am on a 56k dial up PPP connection and offer no services to anyone. I am the only user and root. Simple. In fact, I think my security measures are probably over-the-top, but still it sems like good practice and makes interesting learning. I have hardened the system using Marc's hardening script and have set up Firewall2. Now, when I scan my ports with nmap, I have 'canna', 'smtp' and 'squid' showing open. Canna is my Japanese language server and I have squid running to cache pages for web browsing. I also opened up the smtp/sendmail service so I can use fetchmail to fetch my mail. My questions are: 1. Can I close the canna port and still use canna? I see no reason why it should be sitting open to external connections when I am the only person that needs to use it. How do I close it? 2. Is it necessary for squid to be sitting open, when I do not serve any web pages. Can I close the port and still have squid cache pages for my browsing? 3. I fetch mail with fetchmail which requires sendmail to send the mail to my account. Must I have sendmail running as a daemon or can I invoke sendmail when fetchmail needs it. If I shut down sendmail/smtp, I can sendmail, with sendmail -q but fetchmail fails. Basically, how do I close the smtp port but still use fetchmail? I'd be grateful for any help. And if I appear to be barking up the wrong tree, then please do let me know! :-) thanks Joss

3 4