May 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] diffence between portfw and mfw
by William Preston 27 May '01

27 May '01

Togan Muftuoglu wrote: > > Hi > > What are the main differences between portfw and mfw in ipmasqadm. For > example Marc prefers mfw in the SuSEfirewall script but on the other > hand I have seen scripts were portfw is used only. The only thing I > saw was im portfw you need the specify the protoc also tcp / udp. > > Sorry until my book arrives there will be more questions coming. Ah > yes when it arrives expect more to come :-) > > Have a nice Sunday > > -- > Togan Muftuoglu > I find the packet marking stuff very useful for simplifying things. e.g. if we want 3 clients to see different webservers, then all we have to do is use the one address for any client and add the following rules; ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTA --dport 80 -m 1 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTB --dport 80 -m 2 ipchains -I $INPUTCHAIN -p tcp -y -s $CLIENTC --dport 80 -m 3 ipmasqadm mfw -I -m 1 -r $WEBSERVER1 80 ipmasqadm mfw -I -m 2 -r $WEBSERVER2 80 ipmasqadm mfw -I -m 3 -r $WEBSERVER2 8080 This doesn't provide much security in itself though... ...you still really need password protection etc. It just makes it easier for the clients to find what they're looking for quickly. William

3 2

SuSEfirewall configuration help
by Matt 27 May '01

27 May '01

SuSEfirewall config... Please could someone send me an example of one with the following settings enabled please.. I use SAMBA, telnet, rlogin, ftp and vnc, ping, traceroute on 3 my machines 192.168.0.2 (SuSE 7.0, 192.168.0.3 (SuSE 6.4) and use my win2000 box to work on (192.168.0.1). these are all on eth0 with win2000 used to dialup on. I would like to set up 192.168.0.2 as my gateway/router but at the moment I have configured my win2000 box. However whilst setting up SuSEfirewall my system hung on the firewall first run initialisation. I can neither login or do anything on reboot. I could login in single user mode but I don't know how to do that ant directions ? Regards Matt

1 0

Download problem
by Luis José Fabbiani B. (SOPORTE) 27 May '01

27 May '01

Hi list, I tried to download for two week the k_deflt-2.2.19-11.i386.rpm kernel and it's impossible. I tried with two path: ftp://ftp.suse.com/pub/suse/i386/update/7.0/kernel/RPMs/ And ftp.suse.com/pub/suse/i386/update/7.0/kernel/2.2.19/ How can I get that ? Are there other way? Thanks! LF

3 2

diffence between portfw and mfw
by Togan Muftuoglu 26 May '01

26 May '01

Hi What are the main differences between portfw and mfw in ipmasqadm. For example Marc prefers mfw in the SuSEfirewall script but on the other hand I have seen scripts were portfw is used only. The only thing I saw was im portfw you need the specify the protoc also tcp / udp. Sorry until my book arrives there will be more questions coming. Ah yes when it arrives expect more to come :-) Have a nice Sunday -- Togan Muftuoglu

2 1

WTF ???
by Bill Jones 26 May '01

26 May '01

In my /var/log/firewall I see - May 24 08:50:18 sneex kernel: \|/ ____ \|/ May 24 08:50:18 sneex kernel: "@'/ .. \`@" May 24 08:50:18 sneex kernel: /_| \__/ |_\ May 24 08:50:18 sneex kernel: \__U_/ What is that ??? I have suse-sparc, 64-bit, Ultra 10; I am running the Standard 2.4.2 kernel. Thx; -Sneex- :] ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

2 1

Finding out what shared libs are used by a programm?
by Thomas Schweikle 26 May '01

26 May '01

Hallo ! How can I fast find out what shared libraries a given program uses? -- Thomas

2 1

convert ips from inet to ip's of my intranet/isp, iptables and nat?
by Ramon Acedo 25 May '01

25 May '01

Hello, we'd like a good way of allowing trusted ip's from the internet to use some services that we have in our intranet. We need to simulate that certain ip's of the inet seem to be ip's assigned by our ISP to access to some services that only are allowed the users conected to our ISP The first idea was to use a gateway with some iptables rules: iptables -t nat -A POSTROUTING -s "trusted_ip" -o eth0 -j SNAT --to 1.2.3.4 for change the incoming ip's and for returning: iptables -t nat -A PREROUTING -s 1.2.3.4 -i eth0 -j DNAT --to "trusted_ip" So if we ping the "trusted_ip" from the intranet we get answer and if we ping the 1.2.3.4 from the trusted ip we get answer too. Note that the intranet is not an actual intranet becuse it has well-known-to-the-internet ip's -we've got a little ISP- But this limit us because the "trusted_ip" must have as default gateway the box that has the iptables rules. As the trusted ips are dynamic addresses from inet wich are trusted just for some time and then removed from the iptables rules, so it is not possible to make everyone to change its default gateway just for access to our intranet for a while. With the system I mentioned before we got some troubles with ftp's, as I said we could ping from each side of the gateway/firewall to each other, but when I connected to a ftp server of my intranet with a client from outside and the ip converted with iptables, we could login but not make data transfers, the ftp after login opens the port 20 with the client to establish the data connection, I think it shouldnt have any problem but the client complains about bind or network reaching or something I cant remenber -sorry :) - May be there is another way of doing it, but we NEED to change the source ip's because in the intranet we have lots of services that validate just for the IP's of the intranet, and it is very difficult to make dynamic ips validations.

1 0

Re: [suse-security] Finding out what shared libs are used by a programm?
by Nick LeRoy 25 May '01

25 May '01

Hello... > Hallo ! > > How can I fast find out what shared libraries a given program uses? Use ldd. For example: $ldd /bin/ls libc.so.6 => /lib/libc.so.6 (0x4001b000) /lib/ld-linux.so.2 => lib/ld-linux.so.2 (0x40000000) -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

Securing 7.1
by Geoffrey T. Sanders 25 May '01

25 May '01

Have noticed that there is not a hardsuse.rpm package for the 'current' sec1 directory, but one exists for the 7.0 version. Have there been changes in 7.1 to negate the need for this package? If not, would I still be able to implement the hardsuse.rpm and seccheck.rpm packages on 7.1? Thanks in advance. G. Sanders San Diego, CA

3 2

weird request from port 53 to 2049
by Togan Muftuoglu 25 May '01

25 May '01

Hi, can someone give me any reason why a nameserver would make a request to 2049 which is nfs Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5423 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5574 F=0x0000 T=27 (#39) Packet log: input DENY ppp0 PROTO=17 212.156.4.20:53 212.156.196.114:2049 L=137 S=0x00 I=5738 F=0x0000 T=27 (#39) -- Togan Muftuoglu

7 14