May 2001 - openSUSE Security - openSUSE Mailing Lists

copying users/pwd from one box to another
by stephane parenton 28 May '01

28 May '01

hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton

2 1

RE: [suse-security] copying users/pwd from one box to another
by José Luis Ledesma 28 May '01

28 May '01

Copy /etc/passwd /etc/shadow /etc/group I think that only with that will work, but be careful if your RH6.0 have shadowing or not. Check if in the redhat exists the file /etc/shadow, if doesn't install the shadowing package or put the passwords of shadow in passwd. Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: stephane parenton [mailto:sparenton@experia.com] Sent: lunes 28 de mayo de 2001 12:29 To: suse-security(a)suse.com Subject: [suse-security] copying users/pwd from one box to another hi, I'm running some servers and I would like to change one of the server with another box, that is more "up-to-date" regarding the CPU/Memory/Disk and OS... The old box is run by a RH6.0 and the new one will be a SuSE 7.0... the question is, how can I move all the users if i tell you that i don't want the passwords to be changed... The box existed long before I was here, so i don't know every password (especially our customers password). Is it possible to copy one password file from one box to another in order to keep the same passwords for all the users ?.... and is there a sure way to transfer all users once for all whithout any doubt ?... TIA Stephane Parenton --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

FW: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty mo dule: /lib/security/pam_pwcheck.so'
by José Luis Ledesma 28 May '01

28 May '01

In the /etc/pam.d/ you have the security libs you use for telnet, ftp, and openssh too. Probably you don't have the file /lib/security/pam_pwcheck.so on your linux. You can copy it from SuSE 7.0, or you can try to modify the openssh pam file... Regards José Luis Ledesma Technology Dep. _____________________ COMPETITIVENESS Parque Tecnológico del Vallés 08290 Barcelona - Spain http://www.competitiveness.com Tel.: +34 66 986 55 17 Fax: +34 93 582 01 59 -----Original Message----- From: Alex Liesch [mailto:aliesch@web.de] Sent: domingo 27 de mayo de 2001 16:54 To: suse-security(a)suse.com Subject: [suse-security] OpenSSH on SuSE 6.3 --> 'PAM adding faulty module: /lib/security/pam_pwcheck.so' Hi! I've updated one of my older linux servers running SuSE 6.3 to openssh (2.3.0p1) from "the" ssh. Now I have the following entries in messages each time a user logs in: May 27 16:47:25 r100 sshd[16621]: PAM unable to dlopen(/lib/security/pam_pwcheck.so) May 27 16:47:25 r100 sshd[16621]: PAM [dlerror: /lib/security/pam_pwcheck.so: cannot open shared object file: No such file or directory] May 27 16:47:25 r100 sshd[16621]: PAM adding faulty module: /lib/security/pam_pwcheck.so What is 'pam_pwcheck.so' for? My SuSE 7.0 box does have one. Yast did not show any unfulfilled dependencies. Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75 --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

some kind of attack?
by Daniel Quappe 28 May '01

28 May '01

hi list, got this message some minutes ago May 2 12:25:55 server kernel: Packet log: input DENY eth0 PROTO=1 192.168.0.2:3 this.is.my.ip:1 L=88 S=0x00 I=52687 F=0x000 0 T=243 where eth0 is the outbound-interface which is protected by ipchains from ip-spoofing. some kind of attack?! any ideas are appreciated...;-) many thanks in advance, bye, daniel

5 6

Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 27 May '01

27 May '01

#!/bin/sh echo "starting firewall" # interfaces EXT="ippp+" # external interface (maybe a tokenring-card or anthing else; point to the internet) INT="eth+" # internal interface (point to your lan) LO="lo" # loopbackinterface # IP-adresses INTIP="192.168.0.1" # your local ip for your lan (internal ip) ANY="0.0.0.0/0" # all other ip's (maybe you need it in further times) # ports PRIVP="0:1023" # priviliged ports UNPRI="1024:65535" # unpriviliged ports # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification on for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-forwarding on echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP # drop all incoming packets iptables -P OUTPUT DROP # drop all outcoming packets iptables -P FORWARD DROP # drop all forwarded packets iptables -X # delete all userdefined tables iptables -F # flushing tables iptables -t nat -F # flushing nat-tables iptables -t nat -X # deleting userdefined nat-tables # ignore waste coming from your windowslan # netbios (drop it before writing these messages into your firewall-logfile) iptables -A INPUT -i $EXT -p tcp --sport 137:139 -j DROP iptables -A INPUT -i $EXT -p tcp --dport 137:139 -j DROP # droping bootp and tftp connections (if you have thin clients or some boxes booting from a server via bootrom) iptables -A INPUT -p tcp --sport 67:68 -j DROP iptables -A INPUT -p tcp --dport 67:68 -j DROP # no limits for connections comming from your lan (maybe specify some single rules ex.: SSH, DNS, HTTP...) iptables -A INPUT -i $INT -j ACCEPT iptables -A OUTPUT -o $INT -j ACCEPT # no limits for your LOOPBACK-device iptables -A INPUT -i $LO -j ACCEPT iptables -A OUTPUT -o $LO -j ACCEPT # do want to ping from your firewall iptables -A INPUT -p icmp -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT iptables -A FORWARD -p icmp -j ACCEPT ########################################################################## # NAT (MASQUERADING) # replace your local-ip from lan with the offical Internet-IP you got from your ISP ########################################################################## echo "NAT" iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS # allows you to connect to an DNS-Server of your ISP or other ########################################################################## echo "DNS" iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # LOG anything else with setting som prefixes infront of any message in your firewall-log # you should add one of the following line to your syslog.conf in /etc # kern.* /dev/tty11 # most tty11 is unused and you see a blank screen when switching (same tty12) # or/and # kern.* /var/log/firewall # here you write every message comming from the kernel in the file firewall iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " echo "READY" MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

2 1

cannot ping using firewall
by Pupeno 27 May '01

27 May '01

I download SuSEfirewall 2 because I'm running on kernel 2.4. I installed and configured it (configuration file attached), I don't know why, nobody can ping me and I cannot ping nobody (not even me: 127.0.0.1). >From the internal network, they can telnet me, I can see samba shares on internal computers, fetching mail from internal network works good, but www is very slow!!! Is there any way to just configure iptables, not using this, but using a SuSE compatible way (I know, I can just write a script and put it anywhere and run it at start up, but, when I use a distribution I like doing the things in the distribution way). Thank you. -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com

1 0

[suse-security] iptables-logging
by da_bug 27 May '01

27 May '01

Hi! With ipchains I could have a rule like this: ipchains -A INPUT ... -j DENY -l <- and because of the "-l" I had log-messages of this rule in my /var/log/messages. How can this be done with iptables? Bye.

4 4

how to close "pending" connections: SYN_RECV
by N. Aust 27 May '01

27 May '01

after being syn flooded two weeks ago I still have nearly two hundred of pending connections ( 'netstat' gives the state: SYN_RECV ) on port 80 of my machine from abusive foreign hosts. Is there a way to close just these pending connections without affecting the "proper" ESTABLISHED ones to port 80 ? Regards, Nick

1 0

Re: [suse-security] WTF ???
by Jörg Mayer 27 May '01

27 May '01

You didn't search the kernel sources, did you? When I search my i386 SuSE 2.4.2 source tree, it looks like this: jmayer@alice:/usr/src/linux > grep -r '\\__U_/' . ./arch/sparc/kernel/traps.c:" \\__U_/\n"); ./arch/sparc64/kernel/traps.c:" \\__U_/\n"); > In my /var/log/firewall I see - > > May 24 08:50:18 sneex kernel: \|/ ____ \|/ > May 24 08:50:18 sneex kernel: "@'/ .. \`@" > May 24 08:50:18 sneex kernel: /_| \__/ |_\ > May 24 08:50:18 sneex kernel: \__U_/ > > What is that ??? -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

1 0

Libraries missing pam.rpm (pam_pwdb.so)
by Alexander Topolanek 27 May '01

27 May '01

Hi, I tried to install Samba 2.2 on my SuSE 7.1, but I cannot log in. The system looks for a /lib/security/pam_pwdb.so, which is missing in the pam.rpm from SuSE. Has anyone ideas or a workaround? I dont want to install a generic pam.rpm and find myself locked out... thanks Alexander Topolanek Propst Peitlstr. 85 2103 Langenzersdorf Austria Phone: +43-2244-33633-633 Fax: +43-2244-33633-55 GSM: +43-676-5702852 email: atopo(a)ocv.org

2 2

Re: [suse-security] diffence between portfw and mfw
by William Preston 27 May '01

27 May '01

Togan Muftuoglu wrote: > > Hi > > What are the main differences between portfw and mfw in ipmasqadm. For > example Marc prefers mfw in the SuSEfirewall script but on the other > hand I have seen scripts were portfw is used only. The only thing I > saw was im portfw you need the specify the protoc also tcp / udp. > > Sorry until my book arrives there will be more questions coming. Ah > yes when it arrives expect more to come :-) > > Have a nice Sunday > > -- > Togan Muftuoglu > I find the packet marking stuff very useful for simplifying things. e.g. if we want 3 clients to see different webservers, then all we have to do is use the one address for any client and add the following rules; ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTA --dport 80 -m 1 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTB --dport 80 -m 2 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTC --dport 80 -m 3 ipmasqadm mfw -I -m 1 -r $WEBSERVER1 80 ipmasqadm mfw -I -m 2 -r $WEBSERVER2 80 ipmasqadm mfw -I -m 3 -r $WEBSERVER2 8080 This doesn't provide much security in itself though... ...you still really need password protection etc. It just makes it easier for the clients to find what they're looking for quickly. William

3 2

SuSEfirewall configuration help
by Matt 27 May '01

27 May '01

SuSEfirewall config... Please could someone send me an example of one with the following settings enabled please.. I use SAMBA, telnet, rlogin, ftp and vnc, ping, traceroute on 3 my machines 192.168.0.2 (SuSE 7.0, 192.168.0.3 (SuSE 6.4) and use my win2000 box to work on (192.168.0.1). these are all on eth0 with win2000 used to dialup on. I would like to set up 192.168.0.2 as my gateway/router but at the moment I have configured my win2000 box. However whilst setting up SuSEfirewall my system hung on the firewall first run initialisation. I can neither login or do anything on reboot. I could login in single user mode but I don't know how to do that ant directions ? Regards Matt

1 0

Download problem
by Luis José Fabbiani B. (SOPORTE) 27 May '01

27 May '01

Hi list, I tried to download for two week the k_deflt-2.2.19-11.i386.rpm kernel and it's impossible. I tried with two path: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/RPMs/ And ftp.suse.com/pub/suse/i386/update/7.0/kernel/2.2.19/ How can I get that ? Are there other way? Thanks! LF

3 2

diffence between portfw and mfw
by Togan Muftuoglu 26 May '01

26 May '01

Hi What are the main differences between portfw and mfw in ipmasqadm. For example Marc prefers mfw in the SuSEfirewall script but on the other hand I have seen scripts were portfw is used only. The only thing I saw was im portfw you need the specify the protoc also tcp / udp. Sorry until my book arrives there will be more questions coming. Ah yes when it arrives expect more to come :-) Have a nice Sunday -- Togan Muftuoglu

2 1

WTF ???
by Bill Jones 26 May '01

26 May '01

In my /var/log/firewall I see - May 24 08:50:18 sneex kernel: \|/ ____ \|/ May 24 08:50:18 sneex kernel: "@'/ .. \`@" May 24 08:50:18 sneex kernel: /_| \__/ |_\ May 24 08:50:18 sneex kernel: \__U_/ What is that ??? I have suse-sparc, 64-bit, Ultra 10; I am running the Standard 2.4.2 kernel. Thx; -Sneex- :] ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

2 1

Finding out what shared libs are used by a programm?
by Thomas Schweikle 26 May '01

26 May '01

Hallo ! How can I fast find out what shared libraries a given program uses? -- Thomas

2 1

convert ips from inet to ip's of my intranet/isp, iptables and nat?
by Ramon Acedo 25 May '01

25 May '01

Hello, we'd like a good way of allowing trusted ip's from the internet to use some services that we have in our intranet. We need to simulate that certain ip's of the inet seem to be ip's assigned by our ISP to access to some services that only are allowed the users conected to our ISP The first idea was to use a gateway with some iptables rules: iptables -t nat -A POSTROUTING -s "trusted_ip" -o eth0 -j SNAT --to 1.2.3.4 for change the incoming ip's and for returning: iptables -t nat -A PREROUTING -s 1.2.3.4 -i eth0 -j DNAT --to "trusted_ip" So if we ping the "trusted_ip" from the intranet we get answer and if we ping the 1.2.3.4 from the trusted ip we get answer too. Note that the intranet is not an actual intranet becuse it has well-known-to-the-internet ip's -we've got a little ISP- But this limit us because the "trusted_ip" must have as default gateway the box that has the iptables rules. As the trusted ips are dynamic addresses from inet wich are trusted just for some time and then removed from the iptables rules, so it is not possible to make everyone to change its default gateway just for access to our intranet for a while. With the system I mentioned before we got some troubles with ftp's, as I said we could ping from each side of the gateway/firewall to each other, but when I connected to a ftp server of my intranet with a client from outside and the ip converted with iptables, we could login but not make data transfers, the ftp after login opens the port 20 with the client to establish the data connection, I think it shouldnt have any problem but the client complains about bind or network reaching or something I cant remenber -sorry :) - May be there is another way of doing it, but we NEED to change the source ip's because in the intranet we have lots of services that validate just for the IP's of the intranet, and it is very difficult to make dynamic ips validations.

1 0

Re: [suse-security] Finding out what shared libs are used by a programm?
by Nick LeRoy 25 May '01

25 May '01

Hello... > Hallo ! > > How can I fast find out what shared libraries a given program uses? Use ldd. For example: $ldd /bin/ls libc.so.6 => /lib/libc.so.6 (0x4001b000) /lib/ld-linux.so.2 => lib/ld-linux.so.2 (0x40000000) -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

Securing 7.1
by Geoffrey T. Sanders 25 May '01

25 May '01

Have noticed that there is not a hardsuse.rpm package for the 'current' sec1 directory, but one exists for the 7.0 version. Have there been changes in 7.1 to negate the need for this package? If not, would I still be able to implement the hardsuse.rpm and seccheck.rpm packages on 7.1? Thanks in advance. G. Sanders San Diego, CA

3 2

weird request from port 53 to 2049
by Togan Muftuoglu 25 May '01

25 May '01

Hi, can someone give me any reason why a nameserver would make a request to 2049 which is nfs Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5423 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5574 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5738 F=0x0000 T=27 (#39) -- Togan Muftuoglu

7 14

Detect a portscan attac
by patric illi 25 May '01

25 May '01

Cheers List ! I am thinking about a solution to disallow access to my server for all those who have made a portscan. I would like to insert their IP's into the /etc/host.deny file. Does anybody know a way how to detect whether someone does a portscan ? would be kind ! cheers & thx in advanced patric illi

4 3

Kernel update packages not gpg signed?
by Muralito 25 May '01

25 May '01

Hi. Kernel update packages lx_sus22-2.2.19.SuSE-25.i386.rpm and lx_doc22-2.2.19.SuSE-25.i386.rpm are not gpg signed. Is this right? Thanks, Muralito

2 1

2.4 kernel is dropping tcp connections
by Kaupo Palo 24 May '01

24 May '01

Does anybody have an idea why under kernel 2.4.x I am experiencing dropping of TCP connections. (No packet filters). With packet captures I saw that my computer send out SYN, I get back SYN-ACK and then my computer responds with RST. Some hosts can regularly be connected, some are regularly dropped although occasionally the connection is established. It never happened with 2.2.x kernel. I am using the suse kernel 2.4.2 currently (2.4.0 had the same problem). The packet contents didn't reveal anything suspicious to my mind. The SYN-ACK packets looked quite similar in both cases. Does anybody have an idea? Kaupo -- Kaupo Palo, Evotec OAI, Instituudi tee 11, Harku EE76902, Estonia E-mail: palo(a)ebi.ee______________________Phone & Fax: 372-6560601

2 1

secure connection with IPSEC etc.
by Guido Tschakert 24 May '01

24 May '01

Hello list I have to connect two lan's via ISDN. Certainly the connection should be secure. I think about a linux-box in each lan with ISDN-cards, which act as routers with a VPN-connection beetween them. Now I am looking for some information about these things (ISDN, VPN and how to bring them together). So I want you to ask which kind of VPN-implemantation (CIPE, FREESWAN) would you use or maybe you can tell me some sources of information about this. I've already gone through the HOWTO's and the Manual-pages. TIA Guido PS: I'm sorry that this is not a"real" question. Maybe you can sent me the information directly and not via the list. -- ----------------- Guido Tschakert SRC GmbH, SysAd -----------------

2 1

Question about Local Daily Security check
by Markus Gaugusch 24 May '01

24 May '01

Hello List! I often get these entries in my security check (secchk.rpm): * Changes (+: new entries, -: removed entries): - kerstin:/home on /misc/khome type nfs (rw,Ì×ÿ¿|Øÿ¿¸Øÿ¿kerstin:/home,addr=192.168.10.1) + kerstin:/home on /misc/khome type nfs (rw,¬×ÿ¿\Øÿ¿¸lØÿ¿kerstin:/home,addr=192.168.10.1) I'm using autofs (from /etc/auto.misc): khome -fstype=nfs kerstin:/home Any idea, why I get those weird characters? thank you Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.dhs.org X Against HTML Mail / \

1 0

Certified Information Systems Security Professional (CISSPT) - Qu estion
by Steven Thompson 24 May '01

24 May '01

Hi All Has any one writen the the "Certified Information Systems Security Professional" exam. Would anyone recomend it. The following books are recommended on their site are any of them good or are there better. https://www.isc2.org/cissp_studyguide#reference Thanks in Advance Steven

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Bob Vickers 24 May '01

24 May '01

Dear All, I just thought I would respond to some of the points people made about my scanrpm script. A couple of people mentioned that it ought to handle ranges of vulnerable versions rather than just single ones. This was certainly my intention originally, but then I looked at the possible forms that version strings can take and realised that parsing and comparing them could be tricky. Probably still possible, but difficult to cover all the cases. And the script at present has the great virtue of simplicity (only 55 non-comment lines at present)...more complexibility means more bugs and more unexpected behaviour. A compromise would be to allow regular expressions in the comparison; this should be easy to implement. Another idea is for keys such as "SEVERITY=x" [x=1..10] and "INFO='Remote Root Exploit'" to give you more information about the exploit...good idea. Felix Huber mentioned autoupdate (http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ ), which I see as a useful but complementary tool. In particular autoupdate only helps if a fixed package is already available...sometimes the only solution is to remove a package. The problem this script is trying to address is that it is currently very hard to be confident that you have acted on all the security alerts relevant to a release. You have to plough through a long series of alerts, some of them referring to updates which no longer exist. Any solution to this problem MUST involve SuSE producing a machine-readable list of either vulnerabilities or security fixes or (preferably) both. Bob -- ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Re: [suse-security] scanrpm: script to check system for known vulnerable packages
by Felix Huber 24 May '01

24 May '01

Hi Bob, I mean AutoUpdate from Gerald Teschl - you find it here http://www.mat.univie.ac.at/~gerald/ftp/autoupdate/ But I would no recommend this solution. A updated XML with all necessary information would be much better. Regards, Felix Huber ------------------------------------------------------- Felix Huber, Web Application Programmer, Webtopia Guendlinger Str.2, 79241 Ihringen - Germany huberfelix(a)webtopia.de (07668) 951 156 (phone) http://www.webtopia.de (07668) 951 157 (fax) (01792) 205 724 (mobile) ------------------------------------------------------- > Felix, > > Well I thought the idea couldn't be new, but a quick search on the net > didn't find what I wanted. Do you have something specific in mind? > > Bob > > On Wed, 23 May 2001, Felix Huber wrote: > > > > Hi Bob, > > > > this idea is not so new - there is already a similar tool for RPM releases > > on FTP server in general. > > But a XML file with up-to-date information (dependencies etc) would make > > life much easier. > > > > MfG > > Felix Huber

1 0

WG: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 24 May '01

24 May '01

ReHi folks, the Script you've to download is on that page: http://www.suse.de/~marc/SuSE.html You've to download the SuSEfirewall v4.6 - 29th April 2001 <SuSEfirewall-4.6.tar.gz> Script unless you want to work with iptables (I think so...). In my Opinion the failures are a result of the bootup sequence, means that the fw-script (or parts of it) is loaded BEFORE the devices (eth0, ippp0 etc.) have been initialized! Maybe you've to make new symbolic links! Instead of "S01SuSEfirewall....." try "S25SuSEfirewall" or something like that! But remember that there's no protection between initializing the devices and loading the script! I prefer downloading the newest Script! Maybe some people have to deinstall the old Script (but the new script will do that, won't it?). I'm sure it works, I've spent some days before I got rid of that problem! If you can't get rid of it, try the "ipchains -L" command, to see if the rules have been set correctly! Bye, Mario PS: Sorry because of my bad english!

1 0

Re: [suse-security] firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

just for the record, these commands worked in the end :-) thanks to all that helped. nmap still shows the port open, but I guess this is good enough. iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 5680 -i lo -j ACCEPT iptables -A INPUT -d 127.0.0.1 -p tcp --dport 5680 -j DROP -- http://www.josswinn.org

1 0

Re[2]: AW: [suse-security] ipchains masq + active ftp / OR NETFILTER/IPTABLES...
by da_bug 23 May '01

23 May '01

hi! S> You can use ipchains with kernel 2.4 . You should recompile your S> kernel with ipchains support ou for just tests, insmod ipchains. I do S> the second option to tests and my ipchains work very well. I know that I can use ipchains with kernel 2.4.x but it seems to me (right or not?) that I cannot use this special ipchains-module "ip_masq_ftp.o" with kernel 2.4.x ... >> >> Hi! >> >> CU> I think you need the module ip_masq_ftp.o to masquarade active ftp with >> CU> ipchains, aren't you? So it works fine for me. Perhaps take a look at >> CU> http://www.linux-firewall-tools.com/linux/. >> >> CU> Hope thats you are looking for! >> >> CU> Christian >> >> ..ip_masq_ftp.o would be a good solution, but it seems to me that it >> just works with kernel 2.2.x and not with 2.4.x .. !? >> If there is a possibilty to use it with 2.4.x (ipchains-compatibility) I >> would like to know about... >> Meanwhile I also took a look at Netfilter/Iptables and set up a >> masquerading-rule that works fine so far... but I have the same >> ftp-problem: ;-) >> How can I realize active ftp-connections from the clients behind a >> netfilter/iptables-gateway-pc? >> >> Bye.

1 0

How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

How do I get loopback encryption filesystems working with 2.2.19? I note the .config file created by make xconfig has lines with: CONFIG_BLK_DEV_LOOP CONFIG_CIPHER_TWOFISH ftp.kernel.org does not have a patch listed for 2.2.19 Thank You. -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

4 4

lost in icmp filtering
by Togan Muftuoglu 23 May '01

23 May '01

Hi, I am trying to tighten up my ipchains firewallon my adsl router/firewall box . But looks like I am a litle bit lost. I have read previous mails backing to 2000 May and I am still lost.Maybe too much info is not good) Below is what I have done. Is there anything I should be carefull with if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] then for f in /proc/sys/net/ipv4/conf/*/rp_filter do echo 1 > $f done fi if [ -e /proc/sys/net/ipv4/tcp_syncookies ] then echo 1 > /proc/sys/net/ipv4/tcp_syncookies fi # echo "1" > /proc/sys/net/ipv4/ip_dynaddr echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses for file in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo "0" > $file done for file in /proc/sys/net/ipv4/conf/*/log_martians; do echo "1" > $file done $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-reply -l $IPCHAINSs -A input -j REJECT -i $OUTERIF -p tcp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p udp -s $OUTERNET -d $OUTERIP 33434 -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d OUTERIP --icmp-type destination-unreachable -l IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type destination-unreachable -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type redirect -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type echo-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type time-exceeded -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type parameter-problem -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type timestamp-reply -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-request -l $IPCHAINS -A input -j REJECT -i $OUTERIF -p icmp -s $REMOTENET -d $OUTERIP --icmp-type address-mask-reply -l -- Togan Muftuoglu

1 0

Re: How do I get loopback encryption working with 2.2.19?
by Paul Elliott 23 May '01

23 May '01

On Wed, May 23, 2001 at 01:04:44PM +0200, Hubert Mantel wrote: > Hi, > > On Tue, May 22, Paul Elliott wrote: > > > How do I get loopback encryption filesystems working with 2.2.19? > > It's quite easy. You just need a recent losetup binary. Please note that > losetup as of SuSE Linux 7.1 is recent enough ;) > Does this mean I can just grab a 7.1 binary and use it on a 7.0 2.2.19 system? Will there be library incompatabilities? Do I have to get the source and rebuild? -- Paul Elliott 1(512)837-9345 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

1 0

scanrpm: script to check system for known vulnerable packages
by Bob Vickers 23 May '01

23 May '01

Dear All, I had an idea for a utility to make it easier to check a system is up-to-date with patches. I assumed that someone else must have had the idea already, but I couldn't find it on the web so I wrote the utility myself. For this utility to work it needs someone (and I think that someone really needs to be SuSE) to maintain a machine-readable list of packages known to have security holes. All the utility does is reads such a list and then reports any vulnerable packages it finds on the system. So you would use it something like wget -O - ftp://ftp.suse.com/vulnerabilities.txt | scanrpm The vulnerability file should contain lines like openssh VERSION=8.3.0p2 RELEASE=98 where the uppercase keywords correspond to rpm query tags. Do people think this is useful? If so, are SuSE willing to take it on? Of course, the utility would be useful for bad guys as well as good guys, but we are used to that. Current version of the scanrpm utility can be found at http://www.cs.rhul.ac.uk/home/bobv/utils/scanrpm Nothing in the utility is SuSE-specific, but I guess the database would be. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 2

Re: [suse-security] Rinetd
by Sp0oKeR 23 May '01

23 May '01

Redir is the same tha Redirect4All? Because I'm using this do redirect my ftp. But in my webservers I'm using rinetd. The question is: I have about 6000 hits a day, then, I'm with a interface with 2 ips, this ips were from my NT. And I do the redirects. Can a big number os hits down my rinetd? Do you think a should use redir to webserver too ? Regards ... > > ---------- Início da mensagem original ----------- > De: "Kurt Seifried" <listuser(a)seifried.org> > Para: "Sp0oKeR" <spooker(a)bol.com.br>, <suse- security(a)suse.com> > Cc: > Data: Tue, 22 May 2001 21:01:11 -0600 > Assunto: Re: [suse-security] Rinetd > If you want to do this in user space you can use redir which is pretty > reliable in my experience. If you are willing to muck around with your > kernel/etc you can use ipportforwarding, this is covered in the firewall howto > I believe. > > Kurt Seifried, seifried(a)securityportal.com > Securityportal - your focal point for security on the 'net > > > > ----- Original Message ----- > From: "Sp0oKeR" <spooker(a)bol.com.br> > To: <suse-security(a)suse.com> > Sent: Tuesday, May 22, 2001 8:50 PM > Subject: [suse-security] Rinetd > > > Hi all... > I'm using rinetd to bind de port 80, and redirect > to my NT Servers. But the problem é o seguinte: my > rinetd is going down. I'm using SuSE 7.0 and I have been > instaled rinetd from my cd's. > I'using ipchains and masquerading too. > Can somebody help-me? > > Sp0oKeR - NsC > spooker(a)bol.com.br > Powered By Linux - SuSe > > > _________________________________________________________ _________________ > Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! > ASSINE AGORA! http://www.bol.com.br/acessobol/ > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > > > ------------------------------------------------------- -------------- > To unsubscribe, e-mail: suse-security- unsubscribe(a)suse.com > For additional commands, e-mail: suse-security- help(a)suse.com > > Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe & Slackware __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

Bind Problem
by Sp0oKeR 23 May '01

23 May '01

I'm using SuSE Linux 7.0 with Bind 8.2.3. My problem, is : My bind is always stopping , I don't know way. This occurs about 1 or 2 times a day. Then , I need to restart it everytime. Can somebody help me? Regards -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # http://www.nscenter.com.br # # Sao Paulo - SP # #=============================#

4 3

[suse-security] ipchains masq + active ftp
by da_bug 23 May '01

23 May '01

Hi! I want to use active-ftp with some clients behind my gateway-pc (ipchains-masquerading)... (passive ftp works) How do I configure my ipchains-firewall to allow this? I hope someone can help me... Bye.

4 6

SINUS Firewall on SuSE 7.1?
by Benjamin Grogg 23 May '01

23 May '01

Hi folks, Anyone have experience with Sinus Firewall on SuSE 7.1? How it works on SuSE? Thanks a lot for your comments :) Benny

1 0

firewalling canna port 5680
by Joss Winn 23 May '01

23 May '01

Hello again, well, I have had good feedback from SUSE and other users of the Japanese language server, Canna. As far as security at a software level is concerened, I think it is secure. However, it still shows as an open port 5680 when tested with nmap. I have been told that while the software settings are secure, if I want to make it invisible to nmap, I would need kernel level firewalling. I have Firewall2 set up on my dialup ppp box. Can anyone tell me what settings I need to change in YaST to enable firewalling on port 5680 and make it invisible to the outside? I thought that blocking high ports would do it, but it still shows up on nmap. thanks very much This is more a learning process than a real world security threat, but I appreciate your help all the same. cheers Joss

2 2

Upgrades via mirror and yast2
by Martin Sckopke 23 May '01

23 May '01

Hi all, since version 7.1 YAST2 enables me to automatically update via Internet. I tried to use this feature with a mirror of ftp.suse.com, but YAST2 would not work. What has to be in the mirror directories for YAST2 to work? Thanks for your great support, Martin -- The three golden rules to ensure computer security are: Do not own a computer; do not power it on; and do not use it (Robert (Bob) T.Morris) GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

1 0

RE: [suse-security] Re: OT(?): Apache segfaults after update to 7 .1
by Pini Remo 23 May '01

23 May '01

Updating everything (apache, ssl, mod_php) to the newest version available through ftp (funnily enough NOT through YOU -> why not!?), the problem disappeared... seems to have been a version mismatch. greets and thanx for the help, remo > > After the long due update from 6.4 to 7.1, apache (child-procs only) > > segfaults upon page requests. > > I would say you should try the updated apache 1.3.19

1 0

AW: [suse-security] SuSEFirewall fails on system startup
by Ragucci＠t-online.de 23 May '01

23 May '01

Hi Guys, I had the same problems... But there's no problem, 'cause the Script will produce the ipchain rules! The only thing you've to do ist downloading the newest version of the ipchain script at marcs homepage (www.suse.de/~marc) With that one, there'll be no more failure messages at bootup! Bye, Mario -----Ursprüngliche Nachricht----- Von: Ulrich Schneider [mailto:ulrich_schneider@uni.de] Gesendet: Dienstag, 22. Mai 2001 08:39 An: suse-security(a)suse.com Betreff: [suse-security] SuSEFirewall fails on system startup When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way ! --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Rinetd
by Sp0oKeR 23 May '01

23 May '01

Hi all... I'm using rinetd to bind de port 80, and redirect to my NT Servers. But the problem é o seguinte: my rinetd is going down. I'm using SuSE 7.0 and I have been instaled rinetd from my cd's. I'using ipchains and masquerading too. Can somebody help-me? Sp0oKeR - NsC spooker(a)bol.com.br Powered By Linux - SuSe __________________________________________________________________________ Acesso pelo menor preço do mercado! R$ 14,90 nos 3 primeiros meses! ASSINE AGORA! http://www.bol.com.br/acessobol/

2 1

ftp
by nicemice＠gmx.de 22 May '01

22 May '01

Hi there, Does anybody know how to configure ProFTP to access an internal server = inside a firewall?? The server should be accessible from outside only = with one user ('ftpuser'), but I'd like to use all other user accounts = intern. For this reason at the moment the server is using a different = user and group file. Maybe the problem can also be found in the SUSEfirewall configuration. = Any hints ? Thanx a lot in advance :-)

1 0

gpg
by Roman Drahtmueller 22 May '01

22 May '01

Hi together, the gpg updates to 1.0.5 are available for testing on ftp.suse.de (for SuSE-6.3, 6.4 and 7.0) and ftp.suse.com (7.1 and up). Get the gpgaddon packages as well (for pgp compatibility). All packages are signed using the build(a)suse.de key. Here it is (I've signed it using security(a)suse.de) Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BuQIN BDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUTmIT2iQf07tRUKJJ9v0JX fx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJEpD2hd2f+pMnOWvH2rOO IbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfDqnFDP6L12w3z3F7FFXkz 07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBeRmmoGEKO2JRelGgUJ2CU zOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXstZy7vYjL6vTP4l5xs+LIO kNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3ORzw4LvO1pwRYJqfDKUq /EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5LpC/U6sheLP+l0bLVoq0lm sCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pqUN8QxGJYQnonl0uTJKHJ ENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoGx6INQjf3HGQpMXAWuSBQ hzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M9bHp4d+puY0L1YwN1OMa tcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeqPQUsDv9V7CAJ1dbriEwE GBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCbBQd/++0pB9yZWDhqxHtT pdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =wtNS -----END PGP PUBLIC KEY BLOCK-----

3 4

NetMeeting
by Roland Hilkenbach 22 May '01

22 May '01

Hi list, a coworker of mine needs to work with NetMeeting including audio and video streams. Since we use a T-DSL connection this should be ok. Most of the setup is working fine but there's a catch: her streams are going out but she's not able to _receive_ the other streams. The manual states you have to open UDP transfer to and from the workstation for _every_ other participating computer _and_ port combination! That's since it is not known in advance what IP-adresses the communication partner uses and what ports will be chosen by that software. As far as I've understood the Real-time Transfer Protokol RTP there is an initial connection going to port 1503 and each subsequent datapacket includes the portnumber where to send the next packet. So I figure only stateful firewalls will be able to handle that correctly. My question: Is it possible to archive such a connection with a masquerading Linux-Gateway with a T-DSL connection? Thank you Roland Hilkenbach

1 0

SuSEFirewall2
by Christian Lox 22 May '01

22 May '01

Hi everyone, hope this is the right place (is it, Marc?). I just downloaded SuSEFirewall2 to give it a try. Seems to work great, no serious problems found. One thing annoys me: I did set ping_ext (dont konw the exact name right now) to yes. So ping to the internet should be allowed. But I dont get anything back, not even DENYs in the log. Christian -- we reject: kings, presidents, religions we accept: working code

2 1

SuSEFirewall fails on system startup
by Ulrich Schneider 22 May '01

22 May '01

When switching to runlevel 3 the firewall is going to be initialized. Normally I get the green done message when a service is startet or the red failed message. But the firewall-initalisation-steps 1-3 produce neither the green nor the red message. At the end of system startup the system tells me: Failure services in runlevel 3: SuSEfirewall_init, SuSEfirewall_setup, SuSEfirewall_final. But the file /etc/rc.config.d/firewall.rc.config is cinfigured in the right way !

2 1

closing ports (canna, squid and sendmail)
by Joss Winn 22 May '01

22 May '01

Hello, I am reviewing the security on my home desktop and have a question which I hope is simple to answer. I should say that I am on a 56k dial up PPP connection and offer no services to anyone. I am the only user and root. Simple. In fact, I think my security measures are probably over-the-top, but still it sems like good practice and makes interesting learning. I have hardened the system using Marc's hardening script and have set up Firewall2. Now, when I scan my ports with nmap, I have 'canna', 'smtp' and 'squid' showing open. Canna is my Japanese language server and I have squid running to cache pages for web browsing. I also opened up the smtp/sendmail service so I can use fetchmail to fetch my mail. My questions are: 1. Can I close the canna port and still use canna? I see no reason why it should be sitting open to external connections when I am the only person that needs to use it. How do I close it? 2. Is it necessary for squid to be sitting open, when I do not serve any web pages. Can I close the port and still have squid cache pages for my browsing? 3. I fetch mail with fetchmail which requires sendmail to send the mail to my account. Must I have sendmail running as a daemon or can I invoke sendmail when fetchmail needs it. If I shut down sendmail/smtp, I can sendmail, with sendmail -q but fetchmail fails. Basically, how do I close the smtp port but still use fetchmail? I'd be grateful for any help. And if I appear to be barking up the wrong tree, then please do let me know! :-) thanks Joss

3 4