May 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Samba with iptables
by Stefan_Walther＠gehag-dsk.de 28 May '01

28 May '01

samba is using netbios. you have to open the ports from 137 to 139. if you have a dns server in your local lan, you should open port 53 too. because you can find and access the samba-server much faster than without using a nameserver. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0

Samba with iptables
by zonionz＠gmx.net 28 May '01

28 May '01

Hi I´ve got a server with Suse 7.1 and kernel 2.42, samba and iptables and some client machines with win95. Now I want to make rules for iptables to allow a local connection between the clients and the server using Samba, I think Samba uses Port 137,138 and 53 (default police is drop) Has anybody a working filtering rule for that? Thanks! Sylvain -- Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

New security articel on SuSE Knowledge Portal
by Thomas Biege 28 May '01

28 May '01

Hi ppl, just a short note: The first part of my paper about security bugs in source code was released on SuSE's Knowledge Portal. english: http://portal.suse.de/en/content.php?3occccccccccccccccccccmccccccccccocccc… german: http://portal.suse.de/de/content.php?3occccccccccccccccccccmccccccccccocccc… The original paper with all it's typos and in german language can be found on http://www.suse.de/~thomas/papers/index.html I hope you all enjoy reading it. ;-) I would be happy if you report mistakes/errors/typos I made. And again, thanks to the portal team. :-) Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

2 2

iptable and pop3, long response time
by Henri Valeins 28 May '01

28 May '01

Hi, I use iptable with a kernel 2.4.2 with this rules for pop3 and DNS # ---------------------------------------------------------------------------- # DNS client (53) # --------------- iptables -A INPUT -p udp \ -s $NAMESERVER_1 --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER_1 --dport 53 -j ACCEPT iptables -A INPUT -p tcp ! --syn \ -s $NAMESERVER_1 --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT iptables -A OUTPUT -p tcp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER_1 --dport 53 -j ACCEPT # ------------------------------------------------------------------ # POP server (110) # Acces pour : # ---------------- iptables -A INPUT -p tcp \ -s $popclient --sport $UNPRIVPORTS \ -d $IPADDR --dport 110 -j ACCEPT iptables -A OUTPUT -p tcp ! --syn \ -s $IPADDR --sport 110 \ -d $popclient --dport $UNPRIVPORTS -j ACCEPT with $IPADDR = ip adress for localhost $popclient = ip adresse for the pop client $UNPRIVPORTS="1024:65535" $NAMESERVER_1 = ip adress dor the name server -****************************************************************- with this rules I have 10 seconds for the response time, without iptables it's immediatly. WHat is wrong ? -- Henri Valeins Résonance Magnétique des Systèmes Biologiques UMR 5536 CNRS/Université Victor Segalen Bordeaux 2 146 rue Léo-Saignat (case 93) 33076 BORDEAUX cedex tel 33 (0)5 57 57 17 85 fax 33 (0)5 57 57 45 56

2 1

IP Routing based on fwmark
by Mark O. Stitson 28 May '01

28 May '01

Hi there, I have just set up my 2.4 kernel here on our router and I am trying to allocate different services to our two internet connections. I want all of our smtp traffic to go via our normal leased line and all other traffic to go via our faster, but less reliable ADSL line. I have set the default route to go via the ADSL line and added a ip routing table for the mail: popper:~ # ip route list 213.210.21.240/29 dev eth2 proto kernel scope link src 213.210.21.242 213.38.116.168/29 dev eth1 proto kernel scope link src 213.38.116.170 10.0.0.0/16 dev eth0 proto kernel scope link src 10.0.0.2 127.0.0.0/8 dev lo scope link default via 213.210.21.241 dev eth2 popper:~ # ip route list table mail.out default via 213.38.116.170 dev eth1 Then I have set up ip rules: popper:~ # ip rule list 0: from all lookup local ... 32761: from all fwmark 3 lookup mail.out ... 32766: from all lookup main 32767: from all lookup default Then I have added a mangling rule: popper:~ # iptables -A PREROUTING -t mangle -p tcp --dport 25 -j MARK --set-mark 3 All the traffic from the internal network happily obeys the rules and goes via the leased line, but any traffic originating from the router itself on port 25 just goes via the ADSL line and seems not to get marked. Is there a way to implement policy based routing for the router as well? Mark ---------------------------------------------------------------- Dr Mark O. Stitson, Senior Systems Administrator Yospace Ltd, 7 The Courtyard, High Street, Staines, UK, TW18 4DP Tel: +44 1784 466388 Fax: +44 1784 466387 WWW: http://www.yospace.com

1 0

OpenSSH on SuSE 6.3 --> 'PAM adding faulty module: /lib/security/pam_pwcheck.so'
by Alex Liesch 28 May '01

28 May '01

Hi! I've updated one of my older linux servers running SuSE 6.3 to openssh (2.3.0p1) from "the" ssh. Now I have the following entries in messages each time a user logs in: May 27 16:47:25 r100 sshd[16621]: PAM unable to dlopen(/lib/security/pam_pwcheck.so) May 27 16:47:25 r100 sshd[16621]: PAM [dlerror: /lib/security/pam_pwcheck.so: cannot open shared object file: No such file or directory] May 27 16:47:25 r100 sshd[16621]: PAM adding faulty module: /lib/security/pam_pwcheck.so What is 'pam_pwcheck.so' for? My SuSE 7.0 box does have one. Yast did not show any unfulfilled dependencies. Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75

3 3

SuSEFirewall and bridged network
by Norbert Preining 28 May '01

28 May '01

Hi! Is it possible to use SuSEfirewall with a bridged/ipchains network? I use the bridge patches to filter in br0, but the SuSEfirewall always need more interface etc. Best wishes Norbert -- ciao norb +-------------------------------------------------------------------+ | Norbert Preining http://www.logic.at/people/preining | | University of Technology Vienna, Austria preining(a)logic.at | | DSA: 0x09C5B094 (RSA: 0xCF1FA165) mail subject: get [DSA|RSA]-key | +-------------------------------------------------------------------+

1 0

configuring firewalls with iptables
by Pupeno 28 May '01

28 May '01

Which is the standard way in SuSE to configure a firewall without using SuSEfirewall, just plain IPtables, or how can I do it (I don't wanna do a dirty script and put it anywhere and run it at anytime). thank you. Carpe diem! -- Pupeno: pupeno(a)pupeno.com.ar http://www.pupeno.com.ar

3 2

How to close ports...
by Faessen-Goden Jean-Paul en Rowena 28 May '01

28 May '01

Hi, Using SuSE 7.0 with Suse Firewall. should like to close some ports like port 12345,12346 etc... How to set this in the SuSE Firewall (I use Yast 1 to configure...) and how to test? In windows I had an option in IE to block a sender.How to do this in SuSE?Both konqueror and Netscape... Yhanks Jean-Paul faessen

2 1

Antwort: [suse-security] configuring firewalls with iptables
by Stefan_Walther＠gehag-dsk.de 28 May '01

28 May '01

You can use a simple script, where you enter the rules you want to have. I have done the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: 030/89786448 Funk: 0172/3943961

1 0