May 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] suse-firewall?!?
by Armin Schöch 10 May '01

10 May '01

Hei Jesse ! No, this is not my script and I don't deserve any praise for it (and I'm not working for SuSE though I think they are definitely doing a very good job !!). This script is by Marc Heuse from SuSE who is the maintainer of the firewall scripts. It says so at the end of the homepage but only in very small letters. Sorry for not pointing you to the start page of Marc Heuse's homepage: http://www.suse.com/~marc/ Once more, Marc Heuse deserves your thank yous, not me ! Bye, Armin > Hey! Hey! This is great! > Thanks a lot Armin, by the way is this your script? > ...well seems like it from your page, i loved your > page and your buddy's too. Keep up the good work for > SuSE. I'm a die hard fan of SuSE so i'm always > interested in learning anything that's about SuSE... > once again thanks for your help! > > --- Armin_Schöch <armin.schoech(a)mail1.uni-rostock.de> > wrote: > > > > Hello Jesse ! > > > > > I just want to know how to access the > > > suse-firewall. I currently use ipchains and a few > > > other tools. I wonder if SuSE-Firewall is better, > > if > > > so i would like to try it. So if anyone can tell > > me > > > how to access it and put it up or some > > > informaiton/docs/text on it, it would be highly > > > apriciated. > > > > Have a look at http://www.suse.com/~marc/SuSE.html > > There you will find the newest versions of the SuSE > > firewall > > scripts. There is also a link to some documentation. > > > > Good luck ! > > > > Armin ------------------------------------------------------------------------ Armin Schöch at the office: Institut für Atmosphärenphysik Ziolkowskistr. 10 / 63 Schlossstraße 6 D-18059 Rostock D-18225 Kühlungsborn Tel. +49-(0)381-4005781 Tel. +49-(0)38293-68-102

1 0

suse-firewall?!?
by Jesse yep 10 May '01

10 May '01

Hi, all I just want to know how to access the suse-firewall. I currently use ipchains and a few other tools. I wonder if SuSE-Firewall is better, if so i would like to try it. So if anyone can tell me how to access it and put it up or some informaiton/docs/text on it, it would be highly apriciated. __________________________________________________ Do You Yahoo!? Yahoo! Auctions - buy the things you want at great prices http://auctions.yahoo.com/

2 1

tripwire
by schoenborn-boehm＠t-online.de 10 May '01

10 May '01

Hello, can anyone help me, install tripwire_ASR_1.3.1-1 on SuSE 7.1? I just get on the point where to initialize tripwire. Than an error occurs??? like this: "couldn`t open /tripwire/config/tw-config no such file or directory. Permission is just set to 755. In graphical login (KDE2) I can see my files.What`s the matter with this? perhaps OSI 8 ???? schoenborn-boehm(a)t-online.de

1 0

RE: [suse-security] SuSEfirewall2 & port forwarding
by Reckhard, Tobias 10 May '01

10 May '01

> When I´m right, it must be an PREROUTING SNATchain not a POSTROUTING to > forward incomming e.g http to your server. > Better yet, use PREROUTING DNAT. SNAT is POSTROUTING only. Cheers, Tobias

2 1

suse-linux vs commerical firewall
by Guenther Sommer 10 May '01

10 May '01

is suse-linux equipped with squid, free/swan, ... compareable (in security) with an commerical firewall like checkpoint, raptor, ... yes, i know, the question is not very exactly, but i'd be interested in your humble opinion. greetings, guenther sommer.

2 1

Help, please?
by Geordon VanTassle 10 May '01

10 May '01

I know that this is an ICMP packet, but what kind is it? I've got about 75 of these things coming in, and I'd like to know what they are. TIA Geordon Ok, here is the IPChains log bit: May 9 22:50:29 moat kernel: Packet log: input REJECT eth0 PROTO=1 [remoteIP]:12 [localIP]:0 L=56 S=0x00 I=2630 F=0x0000 T=28 (#71)

2 1

SuSEfirewall2 & port forwarding
by Greisberger Christophe 10 May '01

10 May '01

Hi! I have 4 web servers, and want to move them behind a firewall. I want to give their IP to the firewall, and then redirect the incoming requests to the servers, which would have non-official IP addresses (e.g. 192.168.0.x) Is there any possibility to do this with SuSEfirewall2? Backward masquerading doesn't allow to specify interfaces, so that the traffic on one interface would be redirected to an IP, and the traffic on another interface should be redirected to another one. Else, is there any possibility to add user rules to SuSEfirewall? I think that something like this should work, right? iptables -t nat -A POSTROUTING -o eth1 \ --to-source <public_address_1>:80 --to-destination <private_addr_1>:80 -j SNAT Thanks in advance Christophe

3 2

Re: [suse-security] Message Log Question
by Martin Brecher 09 May '01

09 May '01

Dear Mr. Seifried, - I know that you are far more expertised on security related topics than I may ever be, but that's not a reason to flame off people which are new on this list (at least at active posting) and still unexperienced. Apart from the fact that I actually read the howtos and a lot of documents (maybe I've overseen s.th., maybe because English is not my native language), all the howtos do not include the _opinions_ and _tips_ of all those expertised people on this list (which are often quite helpful! - thanks). >I'm not offended by you looking for knowledge. I am offended by you badgerting >the list when many fine documents exist that, oddly enough, are what I used to >learn from. ipmasq howto, firewall howto, you may want to read them. I will no longer reply to this thread, but wanted to make clear what my intention was. Please, if you find me offending, ignore my posts. If someone things I am disturbing the list or am employing wrong means in my mails, please tell me privately and I will quit asking dump questions on this list. Sincerly, Martin Brecher --- And you all know, security Is mortals' chiefest enemy. (Shakespeare, Macbeth)

1 0

Re: [suse-security] Please help for FreesWan VPN script setup on SuSe 7.1
by idallen＠freenet.carleton.ca 09 May '01

09 May '01

>From: Aboubacar Dramé <abodr(a)xchg.medisys.ca> May 9, 10:45 >I use the sample script below (writed for the Red Hat distribution) [...] ># Copyright (C) 1997, 1998, 1999 Robert L. Ziegler Salut! Be careful with the Ziegler scripts. They contain many errors, including typing mistakes in variable names. You will find these by running the scripts using "sh -u" or by changing "#!/bin/sh" to "#!/bin/sh -u". Ziegler's 2000 book on building Linux firewalls had extensive errata that made many (most?) of the tables in the book useless unless you applied all the corrections. I haven't checked the script you posted; but, the firewall script used in his book, posted on his web site (a year old), still hadn't been fixed when I looked in January. -- -IAN! Ian! D. Allen Ottawa, Ontario, Canada idallen(a)ncf.ca Home Page on the Ottawa FreeNet: http://www.ncf.ca/~aa610/ College professor at: http://www.algonquincollege.com/~alleni/ Board Member, TeleCommunities CANADA http://www.tc.ca/

1 0

Re: [suse-security] Message Log Question
by Martin Brecher 09 May '01

09 May '01

On Wed, 9 May 2001 12:20:05 +0200 (CEST), Markus Gaugusch wrote: >> IMHO a packet filter like ipchains can only decide what to do with a >> packet by looking at this very packet. So if you get a packet without >> SYN Flag set from somewhere to , say, port 61500, how can ipchains >> know if it's a response to a masqueraded request or a response to a >> request from al local app using this port ? >It is not decided by ipchains, but the kernel. The kernel knows the >masqueraded connections, and can differ between local and masqueraded >connections therefore. But the input chain will be called, too. If you want to filter masq'd connections and local connections on the firewall box seperately (i.e. to heavily restrict direct access to and from the firewall machine) having them in the same port range makes no sense, or am I wrong somehow? - Martin > >hth >Markus > >-- >_____________________________ /"\ >Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign >markus(a)gaugusch.dhs.org X Against HTML Mail > / \ > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > > --- The Internet was invented as a highly dependable, high-speed, distributed, secure, and powerful network so that in the event of a nuclear crisis, military officials would always have access to pornography.

2 2