June 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

PGP keyserv
by jochen mader 18 Jul '01

18 Jul '01

Hey, I've been playing around with GPG for some time now and I'd like to install a keyserver on our server to allow people to exchange their keys easily. Which servers would you suggest to use?

2 1

RE: [suse-security] IPSec system design questions (slightly OT)
by Ed 11 Jul '01

11 Jul '01

I would appreciate comments on some IPSec design issues. A transportation manufacture recently requested proposals for a Linux based system to put Internet and email services on their vehicles. This system would let passengers plug a laptop into the on board network. A number of protocols were specified including IPSec. They also specified Linux kernel 2.4.x. It seemed to me that they intended IPSec to be used from transportation vehicle to satellite to fixed server. The VP of Technology here has recently discussed using IPSec on board vehicle from web server, email server and file server to passenger seats - typically many hundreds of passengers. The transportation manufacture specified: "The file server will not preclude a user from initiating and completing a supported VPN connection from their user device through the transportation manufacturer network using the IPSec and PPTP protocol, as a minimum. The system should allow the user to switch between IPSec VPN and non-VPN without need of rebooting the laptop. The system will only pass IP based protocols between the laptop passenger interface and the file server. Passenger laptops will be assigned default gateway address via DHCP. The default gateway should reside in the server. The system will by default, route user outbound packets to a configurable gateway." Is it feasible to support IPSec from a passenger's laptop when implementations of IPSec vary and either ESP or AH modes might be used? If feasible what performance hit would be involved? I have heard estimates of 40% when encryption is used (mileage may vary I suppose based on CPU speed and resources). I assumed that a "default gateway at the server" implied that the IPSec pipe started or ended there. Since the transportation manufacturer called out other security requirements to the passenger seat, I assumed that IPSec to the seat was not required. Examples of requested security: "Multiple passengers will not be connected to shared physical media. Laptop users will not be permitted to view packets from another user's network session. Each passenger's laptop's user interface will be isolated to its own link layer subnetwork. The passenger laptop will not be able to access unauthorized IP address. The system will be immune to DoS attacks. The server will ensure that passenger laptop's can only pass packets with that user's assigned IP address." My main question are, 1) "Does the transportation manufacturer really want IPSec extended directly to the passenger's laptop?" 2) "Would it even be feasible to automate re configuration of IPSec software running on a passenger laptop to avoid compatibility issues?" 3) "What would the performance cost be of running ESP or AH IPSec on a laptop that might also be viewing an MPEG2 movie, web browsing or playing a game?" I would appreciate any opinions you care to offer. The job you save may be my own. <s> Thanks, Ed

5 6

setting up firewall in 7.1
by twowitchesinthelight＠btinternet.com 03 Jul '01

03 Jul '01

Hi All, Another newbie question. I edited my inetd.conf and commented out ftp, telnet, shell, login, pop3, finger and swat and rebooted. Everything seems to work ok. nmap -sT -v my ip shows these 22 ssh 37 time 111 sunrpc 515 printer 1024 kdm 6000 X11 nmap -sU my ip shows these 37 time 111 sunrpc 517 talk 518 ntalk Questions are these. First, is what I commented out ok? secondly, is it safe to comment out talk, ntalk, and time in inetd.conf as well? Secondly...how about ssh,sunrpc,printer and X11? Is it safe and where do I shut them down at? If you could just give me a site that would explain this to me I would be very grateful. As I said, I am new and just don't want to make any mistakes configuring or to take an unsecured machine out on the net. Thanks in advance, Dallam

3 2

AW: [suse-security] Ipsec + firewall
by Schulz, Wolfgang 03 Jul '01

03 Jul '01

Hi! The problem with the firewall + IPsec is still not solved. To split the setup problems I have tried to configure different test environment: a) Only 2 IPsec gateways b) 2 IPsec gateways with the firewall script - no masquerading c) 2 IPsec gateways with the firewall script with maquerading Setup a) is working but with setup b) I have already problems: The tunnel is established but I still cannot ping to the net on the other side. I checked the firewall.log for denied packets but couldn't find any entry. Also another strange phenomenon: If I boot the machine with the firewall script and stop afterwards the firewall script by hand the ipsec connection doesn't work too. What could be the problem with my setup. Thanks for your help Wolfgang > -----Ursprüngliche Nachricht----- > Von: Tobias Gewinner [mailto:crt@tmt.de] > Gesendet: Dienstag, 19. Juni 2001 23:32 > An: suse-security(a)suse.com > Betreff: Re: [suse-security] Ipsec + firewall > > > On Tue, Jun 19, 2001 at 05:55:09PM +0200, Schulz, Wolfgang wrote: > > Hi list! > > > > As soon as we start the firewall script (Version 4.1) ipsec > doesn't work > > anymore. > > I remember having the same problem in the past. AFAIK the > firewalls must > accept incoming requests from the outside on port 500/UDP. Also the > firewall doesn't know the net behind his partner, so any input from > these IPs to the internal net is denied. > > I remember that I set the following ipchains rules (or something like > that) manually on both machines: > > On firewall A this (may have) looked like > > ipchains -I forward -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I input -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I output -b -s [local net B] -d [local net A] -j ACCEPT > > and on firewall B you must swap the networks, of course ;-) > > After that it worked fine for me. I think you can set these rules > in /etc/rc.config.de/firewall-custom.rc.config > > Greetings! > -- > ----------------------------------------------------------------- > Tobias Gewinner <gewinner(a)tmt.de> > Fachinformatiker i.A. TMT InterNETworks GmbH > Phone: +49921560716-0 Maxstrasse 4 > Fax: +49921560716-18 D-95444 Bayreuth > ----------------------------------------------------------------- > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

Re: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 01 Jul '01

01 Jul '01

DIRK WROTE: Helo Stefan, helo folks, I tried that one but it`s the same thing. Realy curious is, when the firewall script starts I get an error message with reference to "Bad argument squid" even I had declared in /etc/services. The same one, when I use the port nummer."Bad argument 3128" Any idea??? Thanks and regards Dirk Hello Dirk, hello folks, I don't know if it works but you can try this, maybe you can send me your log and the full error listed at you monitor: #SQUID internal lan iptables -A INPUT -i $IF_LAN -p tcp --dport 3128 -j ACCEPT iptables -A OUTPUT -i $IF_LAN -p tcp --sport 3128 -j ACCEPT #HTTP iptables -A INPUT -i $IF_WAN -p tcp --dport 80 -j ACCEPT iptables -A OUTPUT -i $IF_WAN -p tcp --sport 80 -j ACCEPT #DNS iptables -A INPUT -i $IF_WAN -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A OUTPUT -o $IF_WAN -p udp --dport 53 --sport 1024:65535 -j ACCEPT iptables -A INPUT -i $IF_WAN -p tcp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A OUTPUT -o $IF_WAN -p tcp --dport 53 --sport 1024:65535 -j ACCEPT just try this (use the portnumbers not names in /etc/services). if this doesn't work, you should try to install proxy and firewall at to different machines. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

2 1

How to shut down firewall
by Steve Collins 30 Jun '01

30 Jun '01

I have a standard install running SUSE 7.1 on PC hardware. It uses a 56k modem to talk to Earthlink via ppp. I believe it has firewall running since (1) I can see a couple of messages about "personal-firewall" go by during the boot sequence and (2) if I try to telnet or ssh into the box from the internet, I see messages in /var/log/messages about the connect being rejected. I would like to temporarily disable enough of the protection to allow incoming ssh, telnet, and ftp connections. I tried modifying settings in /etc/rc.config.d/firewall.rc.config to allow the desired services, but to no apparent effect. I then tried to disable the firewall completely but found that my rc.config already had the line START_FW ="no" and yet some firewall clearly is running. Any pointers to definitive docs on the SUSE 7.1 firewall setup? I don't seem to be able to figure out what I need from the printed manuals. Haben Sie viel Spa� Steve Collins __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

3 2

Re: [suse-security] SuSEfirewall 2.1 and NetMeeting 3.01
by michael.ryan＠storm.ie 29 Jun '01

29 Jun '01

Ok, I have added the ip_masq_h323.o module and re-started masquerading to load the module. SuSEfirewall is still in place as before. I can now use NetMeeting 3.01 on a PC to connect to a hosted meeting outside the firewall. My question now is how do I allow external NetMeeting clients connect to a NetMeeting host on our internal/private network. Any help much appreciated :) MR Torsten Mueller To: michael.ryan(a)storm.ie <torsten@arch cc: suse-security(a)suse.com esoft.de> Subject: Re: [suse-security] SuSEfirewall 2.1 and NetMeeting 3.01 06/29/2001 12:41 PM Hey, i use a setup with a netmeeting kernel module and portforwarding. Look at the masquearding howto, there's the lnk to the module. Greetings Torsten michael.ryan(a)storm.ie schrieb: > > Trying to allow external sources connect to a machine on our private > network which is acting as a NetMeeting host. > Gateway is a SuSE 6.4 box, ip masquerading up and running SuSE firewall 2.1 > Anyone done this before? any advice on how this can be done securely? > > tnx in advance, > > MR > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com

2 1

NFS problem
by Selcuk Ozturk 29 Jun '01

29 Jun '01

Hi, I just upgraded my Suse 7.0 2.2.16 kernel server to 2.2.19 kernel. Everything seems to be working fine except an NFS quirk. When I try to mount the nfs shares on this machine from my Sun Solaris 7 server with the automounter, I am getting a "Permission denied" error and fail. Looking at the log on the Sun server I see: automountd[5391]: poseidon server not responding: RPC: Pro gram/version mismatch on the Linux log: Jun 28 09:54:33 poseidon mountd[419]: export request from x.x.x.x When I use the mount command like "mount poseidon:/ /mnt/tmp" then it works. But, I see in the Linux servers log: Jun 28 09:58:14 poseidon kernel: svc: unknown program 100227 (me 100003) I am using knfsd. Anybody know any fix? TIA Selcuk

2 3

SuSE Security Announcement: xinetd
by Sebastian Krahmer 29 Jun '01

29 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: xinetd Announcement-ID: SuSE-SA:2001:022 Date: Friday, June 29th 2001, 13:26:55 CEST Affected SuSE versions: (6.0, 6.1, 6.2), 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote code execution Severity (1-10): 7 SuSE default package: yes Other affected systems: All systems using xinetd Content of this advisory: 1) security vulnerability resolved: xinetd buffer-overflows problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Zen-parse has reported a bug to Bugtraq which allows remote attackers to overflow a buffer in the logging routine of xinetd. During investigation we found that more problems exist within xinetd. Xinetd provides its own string-handling (snprintf()-like functions) routines and fails to handle length arguments of 0 properly. Instead of an immediate return it assumes 'no limit' for writing characters to the target-buffer. This can lead to overflows and arbitrary remote code-execution. Additionally xinetd now sets the correct umask before starting other deamons. Please update the packages immediately, kill the old deamon and start the new xinetd deamon with the /etc/rc.d/xinetd start command again if you need it running. Regardless of the bugs in xinetd, please make sure you only run as many services as needed. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/xinetd-2.1.8.8p3-139.i386.rpm a8122710a857e49a356b0786c8aad9eb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/xinetd-2.1.8.8p3-139.src.rpm 90187bd35f931f07ba72b54c16c1549c SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/xinetd-2.1.8.8p3-140.i386.rpm 346868fe76e17d17d87dadbac4c032bb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/xinetd-2.1.8.8p3-140.src.rpm 6656be9789888da5b1b37dc1aa9c69a9 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/xinetd-2.1.8.8p3-140.i386.rpm ff001b856db620213608dac1c88ebfbe source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/xinetd-2.1.8.8p3-140.src.rpm 627d2f09d9d4607f31e1902eee4e0cb5 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/xinetd-2.1.8.8p3-139.i386.rpm ef4697d57a6ceb5e6a55bde51268b92a source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/xinetd-2.1.8.8p3-139.src.rpm 1384b48ed19204324d4a8c2f75d3ea20 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/xinetd-2.1.8.8p3-141.i386.rpm 3c29917f0688aa7509f98b0a00a38eed source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/xinetd-2.1.8.8p3-141.src.rpm b7f8cc1e5a7d3c2f6c56040c327a4b20 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/xinetd-2.1.8.8p3-89.sparc.r… a78dd53e2da211b8822b4ca86359a6e0 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/xinetd-2.1.8.8p3-89.src.rpm 9b0acb0dacee2962f19057de43d9f421 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/xinetd-2.1.8.8p3-96.alpha.rpm bb2b45d56d2cf54733a20561c8a8e440 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/xinetd-2.1.8.8p3-96.src.rpm 60610276aba8c103a43a40ea0366f675 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/xinetd-2.1.8.8p3-96.alpha.rpm 1e4f0685f380db64025837685f8e79c2 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/xinetd-2.1.8.8p3-96.src.rpm addfd497500387b4de4e2c77ff226e01 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/xinetd-2.1.8.8p3-95.alpha.rpm f39287594d3297d2625f3878be6b7d98 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/xinetd-2.1.8.8p3-95.src.rpm ea727667791cd774a5df8bcb5b8b2870 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/xinetd-2.1.8.8p3-95.alpha.rpm 364120a5e0ba13587efba8c082faafa0 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/xinetd-2.1.8.8p3-95.src.rpm 08c540c506809a9a5b080aa21fe97406 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/xinetd-2.1.8.8p3-102.ppc.rpm b73446661fe3f5967acd0242e83fb815 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/xinetd-2.1.8.8p3-102.src.rpm c89cb923d3c837e50e7f2efc2c9708d2 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/xinetd-2.1.8.8p3-101.ppc.rpm 01fec52a269c456636bcda0d8401b639 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/xinetd-2.1.8.8p3-101.src.rpm f91f365e3cbedc3de52aab7667db97b2 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/xinetd-2.1.8.8p3-101.ppc.rpm ed8e343b428fe812502195a15d9c4219 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/xinetd-2.1.8.8p3-101.src.rpm a340276cec8a5dedcbcd29e199bef6a1 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - rxvt The rxvt program contains a buffer-overflow which allows an attacker to locally execute arbitrary code under a different group-id. Please update to the newest rxvt packages. - dqs The dsh-program, shipped with the dqs package contains a buffer-overflow which allows local attackers to execute arbitrary code as root. Please update to the newest packages. - pcp A /tmp - race has been found in the pcp package which allows a local attacker to escalate his priviledges. Affected versions: 7.1, 7.2. We thank Mark Goodwin and Keith Owens from SGI who quickly responded to SuSE in this issue and who released a fixed version of the SGI Performance Co-Pilot in response to the security problem. Future SuSE Linux releases will include the most recent version of the package. Workaround: chmod a-s `rpm -ql pcp` /nosuchfile update-package does the same. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOzxlG3ey5gA9JdPZAQHe3wf/fyRLvSPGLGV1KQQed4eBqqXSxJgZBskB FVgCYtYFUTbcg0cSRjE7yRp1qBYg0jeKLf1PqNoDt+GcVR2HbsG3cvmyW/8ZZUiP tfgd/7lKqDyYBYMMmSOxf16AqUwHp8sVihmBkE8UGKy/2EIu4UBzlMaD4bkbGB+P /T/L5NjIct/yoTKVbksJmQeEW03XfXLG9a9X1LXS/4oR030Rco1I3dVAjHsGkwj/ Ya9zlwz7DfZCOhdeqD5LiCApbzFcn4fRxofyhp/M2DkTQp3650yp0H2/nGBZJ3fH davxTMzZ7m34oC2cTcOMoDeYDjQRX2eYI3bQKlE50v9x/n5XLbfAmg== =vVay -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

SuSE Security Announcement: samba (SuSE-SA:2001:021)
by Roman Drahtmueller 29 Jun '01

29 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: samba Announcement-ID: SuSE-SA:2001:021 Date: Friday, Jun 29th 2001 14:45 MEST Affected SuSE versions: (6.0, 6.1, 6.2) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: possible remote root compromise Severity (1-10): 7 SuSE default package: yes Other affected systems: systems using samba and the %m macro in the samba main config file Content of this advisory: 1) security vulnerability resolved: samba problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Michal Zalewski discovered that a remote attacker can write to files owned by root if the samba config file /etc/smb.conf contains the %m macro to specify the logfile for logging access to the samba server. The %m macro substitutes the NetBIOS name - improper validation of this name allows an attacker to write to any file in the system. SuSE Linux distributions do not ship a default /etc/smb.conf config file that contains the %m macro. Therefore, SuSE distributions are not vulnerable to the bug in the out-of-the-box state. In addition to the remotely exploitable bug, there exists another vulnerability which is fixed with the update packages we provide below: temporary files are being handled insecurely so that an attacker with local access to the system can increase her privileges. This error was discovered by Marcus Meissner, Caldera. This specific problem has been fixed with the release of the samba-2.0.9 version. samba release version 2.0.8 intended to correct this local problem, but due to an error, 2.0.9 contained the complete fix. Only the 2.0.10 version as offered for the SuSE Linux distributions 6.3, 6.4, 7.0 and 7.1 fixes all known problems in the samba package. For the recently released SuSE-7.2 distribution we provide an update package to the version 2.2.0a. We thank Martin Walter, CC university of Freiburg, for his helpful contribution in debugging the Large File Support (LSF) of the 7.1 package. NOTES: * We have removed the samba packages from the update trees for the 6.0, 6.1 and 6.2 distributions on our ftp-server. These packages would introduce security risks if installed on a host. * The samba source rpm package in distributions after and including 7.0 generates both the samba.rpm and the smbclnt.rpm package. It is recommended to update both packages for these distributions. Please download the update package from locations described below and check the authenticity of the rpm package file using a method as described in section 3 of this security announcement. Use the command 'rpm -Uhv file.rpm' to apply the update. Special installation instructions: =================================== After successful installation of the update package, it is necessary to restart the samba server. To do this, use the following command rcsmb restart as root. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n2/samba-2.2.0a-0.i386.rpm d0cab6f5d34645dc9e41f2ae0aed8a30 ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/smbclnt-2.2.0a-0.i386.rpm aba5da72a8175c2119e82d01184dd320 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/samba-2.2.0a-0.src.rpm 243964fad8bda61039020acf7a13858f SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/samba-2.0.10-0.i386.rpm da1232db9259196a58e7e3b46065e8c8 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/smbclnt-2.0.10-0.i386.rpm a497089893fd375986ab5a031eddaf05 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/samba-2.0.10-0.src.rpm 07705a9cacb7f9f28b434a1e6a6fe3bb SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/samba-2.0.10-0.i386.rpm a20a0241fad9b3381758946e9f9ae16d ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/smbclnt-2.0.10-0.i386.rpm c0194e29ff9f6ae5da8500f6a6250bab source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/samba-2.0.10-0.src.rpm e412b83bbf653023cadbf163a3ec296f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/samba-2.0.10-0.i386.rpm e740834c08f1a91efed8abfe1ffd1fd1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/samba-2.0.10-0.src.rpm ed22708ec5fbc14cfdfc0cd45b3033e0 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/samba-2.0.10-0.i386.rpm da6aeaf7043bc03199e4c1d5c04d3be6 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/samba-2.0.10-0.src.rpm 84e325fc575143a576c42f386c88e44c Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n2/samba-2.0.10-0.sparc.rpm 5b702a797836de3352c96b0b33297d13 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/smbclnt-2.0.10-0.sparc.rpm 00c29e2ff26d00b60a81e095a78623c7 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/samba-2.0.10-0.src.rpm 1d9d41cfeab79ef851cb4666a0259731 SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/samba-2.0.10-0.sparc.rpm 48ef896322723e4247b13db719a6d593 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/smbclnt-2.0.10-0.sparc.rpm fdacfbe34e46919515dc54d288b6e56a source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/samba-2.0.10-0.src.rpm b023db5df4e6b26ed8263d61de3c9915 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/n2/samba-2.0.10-0.alpha.rpm 3302ca10f2e779ff168d44bc4280158a ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/smbclnt-2.0.10-0.alpha.rpm 440ff9a0fefb54ac85977e4598e39eed source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/samba-2.0.10-0.src.rpm 49f109c06957f200cd5112dc872273fc SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/samba-2.0.10-0.alpha.rpm 6e68f4d9156238874755bd9bac59d713 ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/smbclnt-2.0.10-0.alpha.rpm c1935910e75c956ed8b2ce9e4c324d55 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/samba-2.0.10-0.src.rpm 210dde7e938ff7d1d303e80a13d11673 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/samba-2.0.10-0.alpha.rpm 9d6cf089b447ba4aefe1d70cf2771a22 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/samba-2.0.10-0.src.rpm 377b183857e179772481840caffd7db4 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/samba-2.0.10-0.alpha.rpm e4871d1a0423bec9999fde9a9b85ab23 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/samba-2.0.10-0.src.rpm 51cf42a086a4a26619323311660dbfb8 PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n2/samba-2.0.10-0.ppc.rpm dfaa395540e2e01b3ccc7177f0f297c4 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/smbclnt-2.0.10-0.ppc.rpm ca9059bfbafe4553ae6bc79dad70ce31 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/samba-2.0.10-0.src.rpm df603b78073673c7f8988639b1cb2c1e SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/samba-2.0.10-0.ppc.rpm 65b2d0e71902afb4f3cafa67f2d5c628 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/smbclnt-2.0.10-0.ppc.rpm a1de2eb26df810831f65af2feb0f12f9 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/samba-2.0.10-0.src.rpm 17777fa091391825ebd9d90018f950bf SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/samba-2.0.10-0.ppc.rpm 4e44aaab59f3c624e77b83bbbc05bb18 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/samba-2.0.10-0.src.rpm 5893c01a4f1ddf8f8d2e77ac8ee785e9 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - Location of update packages on ftp.suse.de/ftp.suse.com: Licensing problems as well as US crypto-software export regulations keep us from publishing update packages that contain cryptographical software on ftp.suse.com, our US ftp server. Bandwith requirements keep us from moving the server to our German location. For these reasons, crypto-packages for SuSE Linux distributions before SuSE-7.1 can be obtained from the equivalent tree on ftp.suse.de. Distributions after and including SuSE-7.1 have their crypto-packages hosted on ftp.suse.com. This was possible with some efforts to remove all non-free cryptographical algorithms from our packages. - qpopper In our last security announcement (SuSE-SA:2001:020 gpg/gnupg) we announced that we investigate the buffer overflow that has been found in qpopper versions before 4.0.3. SuSE Linux distributions are not affected by this bug because a different version is being used. - dqs dex(a)raza-mexicana.org has found an exploitable buffer overflow bug in the dsh program from the dqs package on SuSE Linux distributions. To workaround the problem, do "chmod -s /usr/bin/dsh" and change the files /etc/permissions* to reflect the change. If you do not need the dqs package, then deinstall it (rpm -e dqs). Packages for most of the supported SuSE Linux distributions are available at the usual location ftp://ftp.suse.com/pub/suse/<arch>/<dist> for download and installation/update. Do not forget to change the files /etc/permissions* to remove the suid-bit from the dsh program. Please note that we will not issue a dedicated security announcement for this specific bug. - pcp Paul Starzetz discovered a security weakness in the setuid root program /usr/share/pcp/bin/pmpost. The common library in pcp trusts the environment that has been supplied by the user, regardless of privileged execution or not. By consequence, a user can specify the configuration file and therefore write to files owned by root. The problem is not based on insecurely following symlinks as stated by Paul Starzetz. The pcp package is not installed by default in SuSE Linux distributions. We have provided update packages for the SuSE Linux distributions version 7.1 and 7.2 that remove the setuid bit from the pmpost binary. Versions before SuSE-7.1 were not affected because the setuid bit was not set. We thank Keith Owens and Mark Goodwin from Silicon Graphics for responding quickly and for publishing a new version of the pcp package which will be included in future releases of the SuSE Linux distribution. For more information see the /usr/share/doc/packages/pcp directory of your SuSE Linux installation after installing the update package, or go to obtained from http://oss.sgi.com/projects/pcp/download . Please note that there will not be a dedicated security announcement for this specific bug. - xinetd A buffer overflow has been found in xinetd, all versions, all SuSE Linux distributions. It may be abused to remotely attack a host running xinetd. The xinetd package is not installed by default in SuSE Linux distributions. Manual interaction must have been applied to run the daemon. Update packages can be found at the usual location on our ftp server. The security announcement for this security problem is underway. - fetchmail (fetchml) New fetchmail packages are available on the ftp server. The packages cure a buffer overflow that can be exploited by sending a victim a specially designed email, waiting for the victim's fetchmail program to pick up the email. We are preparing a security announcement for this problem. - openssh update packages for the openssh package after (and including) SuSE-6.4 are available on our ftp servers ftp.suse.de (for < 7.1) or ftp.suse.com (for >= 7.1). We are currently checking for a non-security related irregularity in sshd's behaviour under faulty setup conditions. - exim SuSE Linux distributions do not contain the exim Mail Transport Agent (See http://www.exim.org/ for details) and are therefore not susceptible to the recently found security-related bugs. - webmin SuSE Linux distributions do not contain the webmin administration web frontend (See http://www.webmin.org/ for details) and are therefore not vulnerable to the recently found security-related problems in the software. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CpkBogQ57vSBEQQAk/GN+ftr7+DBlSoixDDpfRnUk+jApGEt8hCnrnjV nPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45t4E0fKyLVzDerCRFB1swz/mNDxT26DLy sdBV5fwNHTPhxa67goAZVrehQPqJEckkIpYriOaYcKpF3n5fQIZMEfMaHEElQhcX ML8AoJVXDkJYh7vI8EUB8ZURNLZMEECNA/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6T epRdLZhaylwVF/iu7uIn62ZUL4//NTOCDY7V63qg4iba/fUbOsWtEnGaiE7mQuAl sSWvRspwRA9/g9rdVf3/JdLJrLmKBTheyG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQn Jn2euqylHRubEQP/aL53NZK0kBdvrKgff6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+ mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiYI2lTRYT4uMdHuwVC3b4DqAKmoy375FER wHkrMVyKBJslv8QtbAWw5A1CAUseaHo+91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1 U0UgUGFja2FnZSBTaWduaW5nIEtleSA8YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUC Oe70gQUJA8JnAAQLCgMEAxUDAgMWAgECF4AACgkQqE7a6JyACspfLACffAYA+NM8 NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0xY7WbKoXs1+72b2AiEYEEBECAAYFAjpw XlIACgkQnkDjEAAKq6TczgCgi+ddhWb7+FWcfeE6WwPZccqAHowAnjjtRyGwHLQH r5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk /xGJJREt7V12iSafaRzGuH8xWvIz1bb+VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6i JXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq2pudfwljp52lYVM53jgPYEz0q/v3091n lZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU+lDQT2EC6VKaxeWK8pNt6UFDwICRDQxK nlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKNbWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852 Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelx ufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7U VCiSfb9CV38dmeHdPCEEjDUWquFYEnvj3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qT Jzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBEVE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN 89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiU XpRoFCdglMznbcAyCk9C2wqb2j/D1Z2BeSBaGCSFkR6pRLebnE17LWcu72Iy+r0z +JecbPiyDpDZj4apn7IC81aNFGi7fNITsHODbwwjiwADBgf/YPvVdzkc8OC7ztac EWCanwylKvxCdKzTDA+DfES6WUYShyiVJvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/p dGy1aKtJZrAnFEsofpmOj8VoqyyFgp/yAGQBp12+mXek7SCZRhuqalDfEMRiWEJ6 J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxxQqNQXL6Z3NSxS61p+5n6BseiDUI39xxk KTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwbsklszZt6xbU+R0SjFqTvjPWx6eHfqbmN C9WMDdTjGrXDDKXFp2aYlokfN6It9vsbVlGNlOwHt/JjGoPMxW6Xqj0FLA7/Vewg CdXW64hMBBgRAgAMBQI57vSSBQkDwmcAAAoJEKhO2uicgArKSyIAmwUHf/vtKQfc mVg4asR7U6XQl0bAAJ4pO22B5U8UH6IYl2LBCXFqw5+5fA== =rVRn - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOzx3lXey5gA9JdPZAQEOMgf+NtdN7lTA4NKbedQLeZpFNDzZS7LFqDxJ LcKShs5ZA5S7xhGFsBP2yQBHvpaYjXzr805m7hsMUwkOMegRYbXYq5h59Bp9NCoo eB2bzcV2lyPe+N+wGJE7XJso7Xxrk+6s+xN++xLA6ajt1YF6Hm/XpYuX9zSaSpCf E6i6kQGtYa8HUCKZGv7h79z5RqDlDxZfKHZLJWRUvhqkUECFH9f6e1mDayDQu7ah ErIl0y1B11sDaGu/jqVrIqqY7yXzgnDyDUAVlTkm/CoNw9CmLytJUfyGE5fxSsdT 0zJanS/YoRb7thO+XWK0ZRR+s/1xt/2VkhnJf+cML4br0s7HicP5pQ== =5+5p -----END PGP SIGNATURE-----

1 0

SuSEfirewall 2.1 and NetMeeting 3.01
by michael.ryan＠storm.ie 29 Jun '01

29 Jun '01

Trying to allow external sources connect to a machine on our private network which is acting as a NetMeeting host. Gateway is a SuSE 6.4 box, ip masquerading up and running SuSE firewall 2.1 Anyone done this before? any advice on how this can be done securely? tnx in advance, MR

2 1

Nonworking MASQUERADING with SuSE 7.2
by Adrian Stachowski 29 Jun '01

29 Jun '01

Hello Everyone, I configured SuSE 7.2 to use the recent SuSEfirewall2 with iptables. My system: 2 NICs external eth0 : 10.10.127.99 Subnet: 255.255.255.0 external eth1: 10.10.128.99 Subnet: 255.255.0.0 ADSL-Dialup But no MASQUERADING As instructed I set START_FW2 START_PPPOED to "yes". my "firewall2.rc.config" is also properly configured (I hope) ------- FW_DEV_EXT="ppp0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="10.10.0.0/16,0/0,tcp,80" --------- One thing is very odd: even after deactivating SuSEfirewall2, flushing all IPTABLES and setting them afterwards manually to --------- iptables -P FORWARD ACCEPT iptables -A FORWARD -i ppp0 -m state --state NEW,INVALID -j REJECT iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward --------- no masquerading. I'm desperate! What did I wrong?

1 0

kinternet firewall in SuSE 7.2
by Vitaly Shishakov 28 Jun '01

28 Jun '01

dear all, when i set up a dial_up connection for kinternet using YaST2, there is a flag about startng firewall. what firewall does it start (i mean is it built in SuSEfirewall), and how should i tune it. (for example to allow incoming higports for ftp and icq) tahnx in advance, Vitaly

1 0

personal-firewall and an addon-script.
by Jost Schoeler 28 Jun '01

28 Jun '01

Hello, who can help me? I have Suse7.1 as NAT-Router and PacketFilter. Its running a PersonalFirewall but after the starting the personal-firewall I modified the system with "ipchains-restore < /etc/ipchains-rules to update the rules, I want to use. That's working fine, but when my dynamic-IP-Provider have canceled the Connection (after 24 hours) , I must always restart my script. What can I do after an IP-Change on PPP to do that automatic? Can I put the script in the IP-Up-Script? Sorry, my english isn't very good ;) Bye, Jost Schöler

5 4

SuSEfirewall needs active dhcp connection first?
by hysterion 28 Jun '01

28 Jun '01

Hello, firewall-newbie here. After I posted the following message to suse-ppc, Joss Winn kindly suggested that I also ask for advice here. Thanks in advance for any and all insights... hysterion -------- Original Message -------- Subject: Re: [suse-ppc] Firewall Date: Wed, 27 Jun 2001 22:10:02 -0400 From: hysterion <hysterion(a)mac.com> To: suse-ppc(a)suse.com Joss Winn wrote: > > On Mon, Jun 25, 2001 at 09:26:17AM +0100, Smith, Bradley wrote: > > > > Hi, > > > > What's the easiest way for me to configure a firewall (SuSE 7.1, 2001 iMac)? > > > > I *will* get around to reading up on ipchain etc. but for the moment it's > > most important that I have something protecting me from those nasty hackers! > > > > Cheers > > Brad > > You can (I think it is turned on by default anyway), use the > Personal Firewall. It uses the 2.2 ipchains. I just got cable access and set up SuSEfirewall for masquerading, and I second the recommendation. It's very easy to set up - just a few instructions in the config file, and it automatically generates appropriate ipchain rules (97 of them, in my case) at boot time. Probably the best examples you could study anyway... One caveat I found, however: it seems that I also need to connect to my isp (using dhcp) *at boot time*. Otherwise SuSEfirewall produces a different set of rules, one of which seems to get in the way when I later try to connect and ping: $ /sbin/dhcpcd -d -h CC******-A eth0 produces messages like Jun 26 22:17:12 gris dhcpcd[886]: broadcasting DHCP_DISCOVER Jun 26 22:17:12 gris kernel: Packet log: input DENY eth0 PROTO=17 10.118.32.1:67 *.*.*.*:68 L=576 S=0x00 I=43879 F=0x0000 T=255 (#37) Jun 26 22:17:12 gris dhcpcd[886]: broadcastAddr option is missing in DHCP server response. Assuming *.*.*.255 Jun 26 22:17:12 gris dhcpcd[886]: broadcasting second DHCP_DISCOVER Jun 26 22:17:12 gris kernel: Packet log: input DENY eth0 PROTO=17 10.118.32.1:67 *.*.*.*:68 L=576 S=0x00 I=43881 F=0x0000 T=255 (#37) Jun 26 22:17:12 gris dhcpcd[886]: DHCP_OFFER received from (24.2.0.9) Jun 26 22:17:12 gris dhcpcd[886]: broadcasting DHCP_REQUEST for *.*.*.* Jun 26 22:17:12 gris kernel: Packet log: input DENY eth0 PROTO=17 10.118.32.1:67 *.*.*.*:68 L=576 S=0x00 I=43883 F=0x0000 T=255 (#37) Jun 26 22:17:12 gris dhcpcd[886]: DHCP_ACK received from (24.2.0.9) $ ping www.suse.de then produces (no output and) messages like Jun 26 22:18:14 gris kernel: Packet log: input DENY eth0 PROTO=17 24.2.160.33:53 *.*.*.*:1024 L=246 S=0x00 I=12157 F=0x0000 T=52 (#37) Jun 26 22:18:19 gris kernel: Packet log: input DENY eth0 PROTO=17 24.2.160.34:53 *.*.*.*:1024 L=246 S=0x00 I=8282 F=0x0000 T=52 (#37) Jun 26 22:18:24 gris kernel: Packet log: input DENY eth0 PROTO=17 24.2.160.33:53 *.*.*.*:1024 L=246 S=0x00 I=14064 F=0x0000 T=52 (#37) Jun 26 22:18:29 gris kernel: Packet log: input DENY eth0 PROTO=17 24.2.160.34:53 *.*.*.*:1024 L=246 S=0x00 I=10180 F=0x0000 T=52 (#37) This seems to indicate that the culprit rule (#37) (which reads: -A input -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -p 17 -j DENY -l) gets in the way of dhcp and dns services -- even though I did set FW_SERVICE_DHCLIENT="yes" and FW_INCOMING_HIGHPORTS_UDP="dns". (The "10.118.32.1" seems very strange, too, but that's consistently what I get.) If I let connection happen at boot time, on the other hand, this rule disappears from the list, and everything works fine. Questions: - Is it true that the firewall prevents (dhcp-)connecting to the internet, except at boot time? If yes, I would suggest emphasizing this in the documentation (I couldn't find it). If no, I'll gladly send more details of exactly what I did - the above seems 100% reproducible. - Do later versions of the firewall behave in the same way? (I am using the stock versions from SuSE 7.0 ppc - kernel 2.2.16 and firewall 2.6.) - Any other reason I should upgrade to a later version? (The .rpm updates mentioned at http://www.suse.de/~marc/SuSE.html don't seem to exist on the ppc side.) hysterion

1 0

firewall question
by michael.ryan＠storm.ie 27 Jun '01

27 Jun '01

The SuSE Linux manual recommends http://www.little-idiot.de/firewall for more in-depth information on firewalls. I'm wondering if there exists an english version of this site ... ? tnx, MR

1 0

ODBC and ipchains packet filter
by Andreas Rittershofer 27 Jun '01

27 Jun '01

I have a linux server with mySQL behind a linux packet filter. My users want to update the database with ODBC connects from their windows boxes. Which ports in which directions have to be open to allow this? I opened 3306 already, but this seems not to be enough. mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

2 1

evalution-7.{1,2}
by tom＠surfeu.com 27 Jun '01

27 Jun '01

Hi all, maybe it's little bit out of tipic question but I'd like know when or if will be one-cd Suse Linux 7.1 and 7.2 called evalution-XX on a ftp site. thanks --t0m

4 4

anonymous ftp + firewall
by Joerg Ritter 27 Jun '01

27 Jun '01

Hello, we have installed a SuSEfirewall with packet rules. The connections from inside to the internet are restricted to secure ports only. As a consequence the ftp port 21 is disabled. Now we want allow only anonymous ftp for downloading. Is this possible? We have tried to configure the squid proxy, but have found only restriction for soure/dest IP or time/user restrictions. ciao Jörg

2 1

LinuxTag
by Roman Drahtmueller 27 Jun '01

27 Jun '01

Hi together, who will be at the LinuxTag in Stuttgart from July 5th to July 8th? It may be a nice idea to have lunch together on Saturday, for those who will be there. A good time to talk about stuff, impulses, ideas or just simple questions. I'll be there. Who else? Roman.

4 4

RE: [suse-security] iptables?
by Reckhard, Tobias 27 Jun '01

27 Jun '01

> > You need to load the appropriate kernel module, iptable_nat. > > Shouldn't the kernel daemon take care of this? > I don't know, but it doesn't appear to. It didn't in the ipchains days either, you had to load the masquerading modules explicitly as well. Since iptables is set up with a script, it's hardly much of a problem to load the modules from that. Tobias

1 0

RE: [suse-security] iptables?
by Reckhard, Tobias 27 Jun '01

27 Jun '01

> Doesn't precompiled SuSE 2.4 kernel support iptables? When I run the > command > iptables -t nat ....... I get "can't initialize table nat iptables who? > (do > you need insmod?)... > You need to load the appropriate kernel module, iptable_nat. HTH Tobias

2 1

iptables?
by Oyku Gencay 27 Jun '01

27 Jun '01

Hi, Doesn't precompiled SuSE 2.4 kernel support iptables? When I run the command iptables -t nat ....... I get "can't initialize table nat iptables who? (do you need insmod?)... The iptables coming with 7.1 is 1.1.2 TIA Oyku

1 0

squid and SuSEfirewall2
by Joss Winn 26 Jun '01

26 Jun '01

Hello, I was hoping to work this out on my own but it's been hours and I've gotten nowhere. I just upgraded from a previous version of Marc's firewall2 to the latest one. With the previous firewall2, everything was fine and I was using squid and junkbuster together with the firewall. I am on a 56k dialup and use squid to speed up my own web browsing. I offer no external services at all. I have tried to figure out why this updated firewall isn't working for me, but I really don't understand it. The symptoms are: When I first boot up and dial up to browse the web, I can browse freely using squid and junkbuster. However, the second time I dial up and any time after that, I cannot go anywhere. The browser just keeps looking until it has timed out. I wonder if this has anything to do with the DNS lookup, although I really don't know how to check this. ANY help and advice would be much appreciated. Any settings in the YAST or the firewall config file would be great. Thank you Joss -- http://www.josswinn.org

2 2

Re: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 26 Jun '01

26 Jun '01

DIRK WROTE: Helo Stefan,helo Steffen, helo folks! Well, referable that outgoing port from Squid, I be mistaken. His dport is just 80. But that is not my problem. Masquerading and DNS intern and extern pop,imap,http as mail GUI, all this things working o.k. Only that thing with squid on my collapsed Firewall is my evil. Here my rules exactly: IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN servber01_eth0="IP-WAN" servber01_eth2="IP-LAN" ANY="0/0" #LAN goes way to Proxy $IPTABLES -A INPUT -i $IF_LAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $LAN --sport $p_high -d $servber01_eth2 --dport squid -j ACCEPT #Proxy goes back LAN $IPTABLES -A OUPUT -o $IF_LAN -p tcp -m state --state ESTABLISED,RELATED -s $servber01_eth2 --sport squid -d $LAN --dport $p_high -j ACCEPT #Proxy goes way to Internet $IPTABLES -A OUPUT -o $IF_WAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $servber01_eth0 --sport $p_high -d $ANY --dport http -j ACCEPT #Internet goes wayback to Proxy $IPTABLES -A INPUT -i $IF_WAN -p tcp -m state --state ESTABLISED,RELATED -s $ANY --sport http -d $servber01_eth0 --dport $p_high -j ACCEPT Maybe you can find that trouble. Squid is an lokal service on my collapsed Firewall. So I don`t need FORWARD rules. Transparent Proxy is not good for that one. Thanks a lot and best regards Dirk Hi Dirk, hi folks, as I set up a firewall, I read the iptables-howtos and I think the states NEW, RELATED and ESTABLISHED is more effectable if you use some NAT. I think you need special INPUT and OUTPUT rules at your firewall. We had the same problem as we used bindutil for nameserverquestions at the firewall. We tried to use only states but this doesn't work. At this point I think you have to use simple INPUT and OUTPUT rules. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

2 1

amavis-sendmail
by Björn Engels 26 Jun '01

26 Jun '01

Hi, I just installed amavis-sendmail on a 7.2 box and I'm trying to configure it for my system. If I configure it as as being described in the mail root gets after installing and start amavis and sendmail from /etc/init.d, mails including a virus signature are being mailed normally. After reading /usr/share/doc/packages/amavis-sendmail/* I tried to modify Mlocal in /etc/sendmail.cf with the result that sendmail can't find /usr/sbin/scanmails. I tried to substitute scanmails with /usr/bin/amavis and /usr/bin/amavis-milter with the following result in /var/log/mail: sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 1 or sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 255 Any hints ? Thanks in advance Bjoern

6 15

Listing of "common" ports used for attacks?
by Geordon VanTassle 26 Jun '01

26 Jun '01

Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me... Any suggestions would be appreciated. Thanks, Geordon

5 5

Little problem with /bin/telnet (fwd)
by Fox 26 Jun '01

26 Jun '01

<please,excuse me for my poor english> Hi, i've found a bug in /bin/telnet that arrives with suse 7.1 and 7. I dont know if this bug has been already reported, but others distributions seems to be vulnerables too. Let me give you an example: --- bash-2.04$ DISPLAY=`perl -e 'print "a"x1200'` bash-2.04$ telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Segmentation fault bash-2.04$ --- Telnet gives me seg fault when it checks the enviroment $DISPLAY. Bye.

2 1

RE: [suse-security] Little problem with /bin/telnet (fwd)
by Björn Engels 26 Jun '01

26 Jun '01

Fox wrote on 6/27/01 4:17 AM >Telnet gives me seg fault when it checks the enviroment $DISPLAY. I am using 7.2 and I had to increase the number of chars, the rest is pretty similar: bj@spock:~ > DISPLAY=`perl -e'print "a"x12000'` bj@spock:~ > telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Speicherzugriffsfehler Bjoern

1 0

RE: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 25 Jun '01

25 Jun '01

DIRK WROTE: Helo Folks, I still got a problem to set iptables for my Proxy Squid. All other doing well, but I think with Squid I have an understanding problem. My Gateway has three nic`s. IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN My conception is squid runs as an lokal service on this Gateway. So I have to write a rule with --dport 3128 for an INPUT way to and an OUTPUT way back on Interface eth2, because Squid is running as an lokal service. Squid himself has to leave that Gateway to the Internet on Interface $IF_WAN with --dport 80 to --sport 80 and comes back as it goes. The meens to write a rule with OUTPUT and INPUT on $IF_WAN. But it doesn`t work. I also think about a FORWARD rule but is my conception so wrong?? Dirk ---------------------------------------------------------------------------------------------------------------------------------- Hi Dirk, hi list, I think you have to change the sport from 80 to 1024:65535 because, requests an a http-server doesn't com from the same port where they want to go to. The same the other way around. You should alo enable forward rules. Maybe it works this way. Maybe you should try to enter the rules manually via an simple script. If you use dynamic IP at you dsl-connection try this configuration: <---SNIP--> # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification einschalten for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-Forwarding echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -X iptables -F iptables -t nat -F iptables -t nat -X iptables -A INPUT -p tcp --dport 3128 --sport 1024:65535 -j ACCEPT iptables -A OUTPUT -p tcp --sport 3128 --dport 1024:65535 -j ACCEPT ########################################################################## # NAT (MASQUERADING) ########################################################################## # Special variation of SNAT (SOURCE NAT) iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS ########################################################################## echo "DNS" # send requests to you DNS in the Internet iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # HTTP iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 80 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 80 --dport $UNPRI -j ACCEPT # look at your LOG, enable in /etc/syslog.conf the parameter "kern.* > /var/log/firewall" e.g. iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " <---SNIP--> this should work MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

3 2

Empress?
by James Ogley 25 Jun '01

25 Jun '01

/home/ogley> grep empress /etc/passwd Nothing... jogley:~ # grep empress /etc/shadow empress:*:8902:0:10000:::: What's going on here? Can I happily delete this user? -- James Ogley, Unix Systems Administrator, Pinnacle.Net james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 20 8731 3619 This email was created and sent with: Evolution 0.10 *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

RE: [suse-security] intrusion detector "tripwire"
by Spencer, Ed M. -ND 25 Jun '01

25 Jun '01

I've used Tripwire on other platforms (NT, HP-UX, Solaris, and AIX) and have found it to be wonderful for forensic analysis and enforcing change management policies. It lets you know what's been changed and provides a thorough mechanism to verify important files. I've been using the commercial product and while it's far easier to install and manage (with the management console) than the 'academic' version, it does what it's supposed to do and does it well. The hardest part of setting it up remains the policy files though. Defining exactly what you want monitored and what you don't is the most important (and difficult) part of the setup. If you're watching a single machine it's not that bad if you watch everything, it's bad when you're watching over 300 machines and you're flagged on /etc/shadow every time a user changes a password or you're flagged on every file on the server when your backup software runs and changes the 'c' time. If you filter down the noise you should find Tripwire easy to use and effective. BTW, version 2.4 commercial supports Linux as a client AND runs the management console on X. Ed Spencer MCSE/MCT/CNA/A+/Network+ Security Analyst - IS Security Renaissance Worldwide, Inc. - Walt Disney World This communication is confidential, intended only for the named recipient(s) above and may contain trade secrets or other information that is exempt from disclosure under applicable law. Any use, dissemination, distribution or copying of this communication by anyone other than the named recipient(s) is strictly prohibited. If you have received this communication in error, please immediately notify us by calling (407) 566-5195. The ideas, opinions, and information expressed within the above email are the express sole opinion of the author and are not the opinion of the Walt Disney World Corporation. Thank you. -----Original Message----- From: Jeric [mailto:jeric@mmcable.com] Sent: Sunday, June 24, 2001 12:37 PM To: suse-security(a)suse.com Subject: [suse-security] intrusion detector "tripwire" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

1 0

hardsuse package ???
by Mansel Bell 25 Jun '01

25 Jun '01

All, I had recently moved to SuSE with the 7.1 distro and was going to harden my box via the hardsuse package, but a little investigation revealed that hardsuse hasn't been included in the SuSE distro since 7.0. I got the most recent version of the harden_suse.pl script (harden_suse-3.5.pl) from Marc's SuSE homepage (http://www.suse.de/~marc/) but was wondering why it is no longer included in the SuSE Professional distro. Is no longer going to be supported by SuSE? Is something else taking it's place (a SuSE version of Bastille Linux)? For anyone with experience using both hardsuse and Bastille Linux, which do you prefer? Thanks... -Mansel

3 2

intrusion detector "tripwire"
by Jeric 25 Jun '01

25 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

3 2

Re: [suse-security] intrusion detector "tripwire"
by Thomas Lamy 24 Jun '01

24 Jun '01

> Von: Jeric [mailto:jeric@mmcable.com] > Gesendet: Sonntag, 24. Juni 2001 18:37 > An: suse-security(a)suse.com > Betreff: [suse-security] intrusion detector "tripwire" > > > First off, I just wanted to say hello to everyone, since this is my > first posting here at SuSE. > > I was reading an article in "linux journal" about an intrusion > detection called "tripwire" > (http://sourceforge.net/projects/tripwire). it sounds really great > on paper, but i was wonder if anyone uses this program, and if so, > are there any issues with it on a SuSE system, or in general (i.e. is > it fairly reliable, stable, easy to setup)? > > Thanks in advance > Hi, I used to use tripwire for all of my machines. It's relatively easy to install, configure and run. Some general hints (also for other checksum progs): - You have to keep it's database on a read-only medium, and have to renew it every time you update your system (because tripwired binaries are affected by every update if you configure it well). a write-protected floppy disk will do as long as you disable floppy booting (or you will be unable to remotely reboot your system ). - IMHO, do not put files like /etc/passwd and friends into the same database as your system binaries are, at least not on systems with user fluctuation. Use a different database or a different tool to monitor these. - Think about performance implications on the machines you run it. I had a pretty bad time with users bashing me because of poor web server performance. It was TW, checking all of my binaries (a big list including informix, where one binary has about 11 megs) every 30 minutes. You should also have a look at http://www.securityportal.com/lskb/10000000/kben10000026.html which is a good starting point and overview. Thomas

1 0

RE: [suse-security] Firewall questions
by Björn Engels 24 Jun '01

24 Jun '01

Original Message From: Dallam Wych Sent: 6/24/01 10:58 AM >First, should I use the firewall that came in the distro or is the >firewall2 >Alpha on Marcs page better? Hmm, in my opinion you should use the package that comes with the distro and try to understand the rules, then. If you got it, you could switch to FW2 and start beginning to undesrstand those rules. (It's much more complicated, but has lots of fine new possibilities ;) I guess you will want to rewrite those rules you find there, you can make things lots easier because the FW-Packages are built to cover lots of possible configurations... ) >Should I then use SuSE harden as well? Well, everybody should do it, independently from setting up a firewall ;) >Finally, >I would like to learn more about firewalls so that I don't have to ask >questions like this one :o). So what would be some good books to read on >the subject? I only can tell you the stuff I read, of course, maybe you wish to take a look at http://www2.little-idiot.de/firewall/ for example, at http://www.linuxfirewalls.org and at the book "Building Internet Firewalls", and you should read the manpages of ipchains and iptables, of course. HTH, good luck ;) Bjoern

1 0

ANN: new amavis-perl/amavisd RPMs for sendmail and postfix (SuSE Linux 7.2) available
by Rainer Link 24 Jun '01

24 Jun '01

Hi! During the weekend I've build some new RPMs for SuSE Linux 7.2. You can grab them from ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/postfix/ or ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/sendmail/ Please read the INSTALL.TXT on the ftp server or README.SuSE within the package carefully. Thanks. If your sendmail.cf file is not generated by SuSEconfig, please check /etc/mail/linux.mc to see, which m4 macros are needed to configure sendmail for use with amavis. Postfix users currently always have to configure postfix themselves, but this should not too difficult :-) The amavis-(sendmail|postfix) RPM is an updated version of amavis-perl-11, which fixes some minor issues. The amavisd-(sendmail|postfix) RPM is a recent CVS snapshot, as the official amavisd-snapshot-20010407 has some bugs, which have been already fixed in CVS. amavisd is in general faster than amavis-perl, as forking a child is faster than creating a new perl process for every mail. Feedback, is of course, very welcome. But please do not "spam" suse-security with amavis-related questions ;-) RPM-related issues should be reported to me directly and amavis questions in general should be asked in our amavis-user mailing list (see www.amavis.org). Thank you. best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

Amavis...
by StarTux 24 Jun '01

24 Jun '01

Do I need to do anything in particular to my firewall? (The nice SuSEfirewall2 :-)). amavis-milter: amavis-milter: connect[19459]: inet_pton failed I have RTFM already....By the way if you RTFM you will find out that amavis does indeed support Postfix, Qmail and Exim, but you need to configure/install it yourself. More information at www.amavis.org Thanks for the package! Matt -- "The only thing complex about Linux are the users themselves."

3 3

Firewall questions
by Dallam Wych 24 Jun '01

24 Jun '01

Hi All, I am using SuSE 7.1. Having finally gotten online, I need to learn about using SuSE firewalls. This is new to me so I have the following questions. First, should I use the firewall that came in the distro or is the firewall2 Alpha on Marcs page better? Should I then use SuSE harden as well? Finally, I would like to learn more about firewalls so that I don't have to ask questions like this one :o). So what would be some good books to read on the subject? Thanks, Dallam _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

1 0

iptables and squid
by Dirk Ertl 23 Jun '01

23 Jun '01

Helo Folks, I still got a problem to set iptables for my Proxy Squid. All other doing well, but I think with Squid I have an understanding problem. My Gateway has three nic`s. IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN My conception is squid runs as an lokal service on this Gateway. So I have to write a rule with --dport 3128 for an INPUT way to and an OUTPUT way back on Interface eth2, because Squid is running as an lokal service. Squid himself has to leave that Gateway to the Internet on Interface $IF_WAN with --dport 80 to --sport 80 and comes back as it goes. The meens to write a rule with OUTPUT and INPUT on $IF_WAN. But it doesn`t work. I also think about a FORWARD rule but is my conception so wrong?? Dirk

1 0

RE: [suse-security] open ports, once again...
by McCaffity, Ray 23 Jun '01

23 Jun '01

32785, are you running NFS? is nfsd running? Ray -----Original Message----- From: Markus Kohli [mailto:kohli@dplanet.ch] Sent: Friday, June 22, 2001 10:12 AM To: suse-security(a)suse.com Subject: [suse-security] open ports, once again... Hi list! Once again boggling your mind with an open-ports-question: nmap -ap shows the following ports listening: tcp 0 0 *:8007 *:* LISTEN - tcp 0 0 *:6000 *:* LISTEN - tcp 0 0 *:http-alt *:* LISTEN - tcp 0 0 *:32785 *:* LISTEN 1214/kdeinit: kxmlr tcp 0 0 *:ssh *:* LISTEN - tcp 0 0 *:ipp *:* LISTEN - -- I know what ssh is, what http is, and that 6000 is the X-WindowSystem port. But what about the others? Especially 32785? Btw, just updated my system to 7.2, and those ports weren't there, I think. Plus, nmap -sT reveals an http-proxy open. How do I close that one? Don't need it, I guess.. Thanks a lot markus __________________________________________________________________________ The computer revolution is over. The computers won. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

FW: [suse-security] Amavis...
by McCaffity, Ray 22 Jun '01

22 Jun '01

unsubscribe -----Original Message----- From: Rainer Link [mailto:link@suse.de] Sent: Friday, June 22, 2001 2:42 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Amavis... On Fri, 22 Jun 2001, StarTux wrote: > Do I need to do anything in particular to my firewall? (The nice > SuSEfirewall2 :-)). > amavis-milter: amavis-milter: connect[19459]: inet_pton failed Hum, amavis-milter communicates via unix domain sockets. Does it work if SuSEfirewall2 is stopped? > I have RTFM already....By the way if you RTFM you will find out that > amavis does indeed support Postfix, Qmail and Exim, but you need to > configure/install it yourself. More information at www.amavis.org Well, I know ;-) Did I say anything else? As we do not ship qmail and exim RPMs, I won't create RPMs of amavis for qmail/exim in the near future. There is an amavis RPM for postfix, but it was build for our SuSE eMail Server II (it works with the old version, too). > Thanks for the package! Thanks :-) best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

[suse-security] open ports, once again...
by Markus Kohli 22 Jun '01

22 Jun '01

Hi list! Once again boggling your mind with an open-ports-question: nmap -ap shows the following ports listening: tcp 0 0 *:8007 *:* LISTEN - tcp 0 0 *:6000 *:* LISTEN - tcp 0 0 *:http-alt *:* LISTEN - tcp 0 0 *:32785 *:* LISTEN 1214/kdeinit: kxmlr tcp 0 0 *:ssh *:* LISTEN - tcp 0 0 *:ipp *:* LISTEN - -- I know what ssh is, what http is, and that 6000 is the X-WindowSystem port. But what about the others? Especially 32785? Btw, just updated my system to 7.2, and those ports weren't there, I think. Plus, nmap -sT reveals an http-proxy open. How do I close that one? Don't need it, I guess.. Thanks a lot markus __________________________________________________________________________ The computer revolution is over. The computers won.

2 1

Not really security but deals with admin. Any help appreciated.
by Wade Chandler 22 Jun '01

22 Jun '01

Hello, I'm trying to set up some port forwarding for ftp. I would like to be able to forward port 2021 and 2020 as an ftp service to an internal machine on our network. I don't have any documentation on this. I know how ftp services work with a control connection and a data connection. I have the control connection working fine, but the data connection of course is not working. I am forwarding 2021 to port 21 on the internal machine, but I don't know how to get the server(internal) to use port 2020 for data even if I was forwarding from 2020 -> 2020. I know that I can't just forward an ftp data connection off of a non standard port to 20 and expect that to work right because of the ftp commands to change ports. This seems like one hell of a problem, and any help would be greatly appreciated. Thank you. Please let me know if I need to clarify the issue. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal.

3 3

RE: [suse-security] Not really security but deals with admin. Any help appreciated.
by Wade Chandler 22 Jun '01

22 Jun '01

Bjorn, Not really. The problem you are faced with in ftp is that there are two connections. There is a control connection which is a standard telnet type of connection, and then you have a data connection. This wouldn't be such a problem, but the data connection port can be changed by the server or the client depending on passive or active mode. So, forwarding one port number by itself is impossible for the data connection because of the dynamics it involves. Another group member wrote me about one of the packages called ftp-proxy. He said it looks like it will do the trick. I hope. For now I am just making samba mounts and creating links to them in user accounts as needed to a 2000 machine. Thanks for you time man. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal. -----Original Message----- From: Björn Engels [mailto:BEngels@lanworks.de] Sent: Thursday, June 21, 2001 6:49 PM To: Chandler, Wade - Consultant/Winston-Salem Subject: RE: [suse-security] Not really security but deals with admin. Any help appreciated. Hi It's too late for me now to think about that problem seriously, but could that have to do with passive / active mode ftp ? Bjoern -----Original Message----- From: Wade Chandler To: suse-security(a)suse.com Sent: 6/21/01 11:42 PM Subject: [suse-security] Not really security but deals with admin. Any help appreciated. Hello, I'm trying to set up some port forwarding for ftp. I would like to be able to forward port 2021 and 2020 as an ftp service to an internal machine on our network. I don't have any documentation on this. I know how ftp services work with a control connection and a data connection. I have the control connection working fine, but the data connection of course is not working. I am forwarding 2021 to port 21 on the internal machine, but I don't know how to get the server(internal) to use port 2020 for data even if I was forwarding from 2020 -> 2020. I know that I can't just forward an ftp data connection off of a non standard port to 20 and expect that to work right because of the ftp commands to change ports. This seems like one hell of a problem, and any help would be greatly appreciated. Thank you. Please let me know if I need to clarify the issue. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] PGP keyserv
by jochen mader 22 Jun '01

22 Jun '01

> Why not just use the existing servers? It's for an intranet and a vpn where people should only be allowed to exchange mails internally without access to the internet.

1 0

no security alerts recently
by Bob Vickers 22 Jun '01

22 Jun '01

Hello, Is there something wrong with the security announcement system? If you look on the SuSE web site http://www.suse.de/en/support/security/index.html there have been no alerts since 3rd June, and I don't recall any e-mail alerts either. But if you look at the update area http://www.suse.de/en/support/download/updates/71_i386.html there have been 6 security updates in this period. At least one of these (samba) is a major hole. People should not be expected to subscribe to high-volume technical mailing lists to know about security updates, the security announcement list should be sufficient. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 3

RE: [suse-security] Masquerading or proxy-ing? (general question)
by Reckhard, Tobias 22 Jun '01

22 Jun '01

> If you want to set up a (small) site, with one internet connection, an > internal LAN with windows machines/users, and a linux box to serve as > internet gateway, and you should provide e-mail, dns, and web surfing > (nothing more, not instant messaging, no streaming media downloads, no > fancy > stuff), what would be better to use on the (SuSE) linux box: firewalling + > masquerading, or firewalling + proxy-ing (e.g. squid). I am asking this > from > the security point of view (which setup is "more" secure?). In both cases > the linux box will run an e-mail server and a dns server. > That depends on which applications you trust more to be secure: the proxies or the applications on the user's hosts. I know what I prefer... Tobias

1 0

Masquerading or proxy-ing? (general question)
by Dragos Alexandru Jula 22 Jun '01

22 Jun '01

Hello, (excuse me if this was discussed before) I am writing because I have an (yet unresolved) argument with some computer friends: If you want to set up a (small) site, with one internet connection, an internal LAN with windows machines/users, and a linux box to serve as internet gateway, and you should provide e-mail, dns, and web surfing (nothing more, not instant messaging, no streaming media downloads, no fancy stuff), what would be better to use on the (SuSE) linux box: firewalling + masquerading, or firewalling + proxy-ing (e.g. squid). I am asking this from the security point of view (which setup is "more" secure?). In both cases the linux box will run an e-mail server and a dns server. Thank you in advance, Dragos Jula

1 0

failure notice
by t0m 22 Jun '01

22 Jun '01

Hello, I'm not sure if I understand exactly what you need. If you have something like is on a small scheme... / INTERNET -- box_1 --+-- box_2 \ ... and on the box_1 you want to have open ports 2020 and 2021 through the which all packets you want to forward to the box_2 where is open ftp on 21 port you need to: open both ports 2020 and 2021 on box_1 forward both to 127.0.0.1 to port e.g. 10001 and 10002 after forward from 127.0.0.1:1000{1,2} to the box_2:21 Do I understand you problem good? regards, tom > Hello, > > I'm trying to set up some port forwarding for ftp. I would like to be [snip]

1 0

AW: [suse-security] Ipsec + firewall
by Schulz, Wolfgang 22 Jun '01

22 Jun '01

Thanks for your help! One more question regarding our configuration: I forgot to mention that we have in the internal nets private addresses which are masqueraded at the firewall. Due to different reasons we need the the masquerading (no way to use proxies). Is there any way to use masquerading and ipsec on the same gateway (firewall)? If this is not possible with ipsec - is this maybe possible with cipe (I only know the name till now). Thanks Wolfgang > -----Ursprüngliche Nachricht----- > Von: Tobias Gewinner [mailto:gewinner@tmt.de] > Gesendet: Dienstag, 19. Juni 2001 23:24 > An: Schulz, Wolfgang > Cc: suse-security(a)suse.com > Betreff: Re: [suse-security] Ipsec + firewall > > > On Tue, Jun 19, 2001 at 05:55:09PM +0200, Schulz, Wolfgang wrote: > > Hi list! > > > > As soon as we start the firewall script (Version 4.1) ipsec > doesn't work > > anymore. > > I remember having the same problem in the past. AFAIK the > firewalls must > accept incoming requests from the outside on port 500/UDP. Also the > firewall doesn't know the net behind his partner, so any input from > these IPs to the internal net is denied. > > I remember that I set the following ipchains rules (or something like > that) manually on both machines: > > On firewall A this (may have) looked like > > ipchains -I forward -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I input -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I output -b -s [local net B] -d [local net A] -j ACCEPT > > and on firewall B you must swap the networks, of course ;-) > > After that it worked fine for me. I think you can set these rules > in /etc/rc.config.de/firewall-custom.rc.config > > Greetings! > -- > ----------------------------------------------------------------- > Tobias Gewinner <gewinner(a)tmt.de> > Fachinformatiker i.A. TMT InterNETworks GmbH > Phone: +49921560716-0 Maxstrasse 4 > Fax: +49921560716-18 D-95444 Bayreuth > ----------------------------------------------------------------- >

4 4

RE: Re[2]: Re: [suse-security] FTP over SSH
by Reckhard, Tobias 21 Jun '01

21 Jun '01

> For tunneling a FTP connection via SSH, please have a look at > > http://www.ccp14.ac.uk/ccp14admin/security/secure_tunnelling_ftp.htm > I am under the impression that the solutions provided at the above link do indeed work as I suggested, i.e. the control connection is tunneled via SSH, but the data connection occurs outside of that tunnel, as is indicated by the link to 'SSH Tunneling via ProFTPD' on the page above. Note also that they have active and passive FTP mixed up in the quoted post titles 'Something to keep in mind'. HTH Tobias

6 9

RE: Re: [suse-security] FTP over SSH
by Vitaly Shishakov 21 Jun '01

21 Jun '01

scp is quite familiar to me, but in my case it used to hang up suddenly, especially accessing via dialup from windows putty or cygwin-ported openssh clients. so i need something else. What i want to figure out, is that how should i make it in the way, i saw once in one company. They used usual SSH port forwarding (using Secure CRT client for Windows) to access their web-server via ftp. (so, they just pointed their browsers to localhost:localport). Unfortunately, i do not remember, if they did it in active or passive mode, and i cant contact their former admins to figure out how they did it. sftp is a command line tool, and the solution described above should work with most FTP clients, (like Windows Commander in Windows) bobv(a)cs.rhul.ac.uk, shift(a)cmpd2.phys.msu.su wrote: > >Vitaly, >scp is good if you know exactly what files you want to copy. If you prefer >an interactive line-mode ftp-style mode of working then you can use sftp. >Both server and client are included in the 7.2 openssh package, but some >earlier versions only included the server. >Bob > On Wed, 20 Jun 2001, Vitaly Shishakov wrote: >> Dear all, >> >> How can arrange an FTP_over_SSH solution on my server. >> what server toolswould i need for that? >> >============================================================== >Bob Vickers R.Vickers(a)cs.rhul.ac.uk >Dept of Computer Science, Royal Holloway, University of London >WWW: http://www.cs.rhul.ac.uk/home/bobv >Phone: +44 1784 443691

2 1

FTP over SSH
by Vitaly Shishakov 21 Jun '01

21 Jun '01

Dear all, How can arrange an FTP_over_SSH solution on my server. what server toolswould i need for that? Thanks for help, Vitaly.

6 7

Re: [suse-security] Fetchmail
by Roman Drahtmueller 21 Jun '01

21 Jun '01

> From: Robert Davies <Rob_Davies(a)NTLWorld.Com> > To: Roman Drahtmueller <draht(a)suse.de>, > Rainer Buesching <rainer.buesching(a)autohaus-pickel.de> > Cc: suse-security(a)suse.com > Date: Wed, 20 Jun 2001 15:28:45 +0100 > Subject: Re: [suse-security] Fetchmail [...] > Is there a reason not to go with latest 5.8.x of fetchmail? I'd been > considering it anyway, and some of it allows things like NTLM support which > would be good for folk forced to connect to M$ Exchange. There is: Compatibility. We will try to avoid new versions in applications like this. People tend to have large setups, and whole companies depend on the mail delivery by fetchmail. If a small feature is changed, then the whole construction falls apart. There are many packages that are handled this way here at SuSE. Other packages get update to the newest version (such as crypto stuff, and software with too many changes, or where versioning is important). I can understand why people may not like this, but we don't make an operating system just to play with, you should be able to _work_ with it. If you want to have a bleeding-edge operating system then upgrade to the latest SuSE-release, or recompile the source rpm from the newer distribution on your older dist. > > Rob > > PS. I suspect my use of case has prevented me from sending to the list. > Changed hostname part, though I'm going to try to resubscribe at some point. You should do so... Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

RE: Re: [suse-security] FTP over SSH
by Reckhard, Tobias 21 Jun '01

21 Jun '01

> What i want to figure out, is that how should i make it in the way, i saw > once in > one company. > > They used usual SSH port forwarding (using Secure CRT client for Windows) > to > access their web-server via ftp. (so, they just pointed their browsers to > localhost:localport). Unfortunately, i do not remember, if they did it in > active > or passive mode, and i cant contact their former admins to figure out how > they did > it. sftp is a command line tool, and the solution described above should > work > with most FTP clients, (like Windows Commander in Windows) > I don't see how FTP can work with SSH's port forwarding, as you need to know the destination port beforehand in order to have sshd listen on that port. FTP's data connection setup always involves a dynamically assigned destination port, there's no difference between active and passive FTP there. The direction of the connection setup is different between the two, but the destination port is always dynamic and thus you'll have a hard time anticipating it. However, I suppose it is very possible to tunnel the FTP control connection via SSH and still have data transfer work, albeit *in the clear* outside of the tunnel. SSH does not parse the control connection in any way, so any PORT commands across it will arrive just fine and the data connection will be established outside of the SSH tunnel. This is what I expect happened at the shop you mention. But all of this is completely unproven and I haven't looked in any SSH documentation while writing this, so it's only a hunch. Cheers, Tobias

2 1

Ip Chains.
by Wilhelm Tesnaar 20 Jun '01

20 Jun '01

Hi all, I have a problem with ipchains and the Suse-firewall script. I have more than one IP bound (Through IP Aliasing) to my external interface. However if I run the Script, All traffic passes through for say eth0, but for any of the other "Virtual interfaces", it doesn't allow any traffic through. What would the rule look like for Passing SMTP from the net through to the firewall using an interface called eth0:1 ipaddress 10.0.0.63 and internal net int of 192.168.0.254 Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: Schulz, Wolfgang [mailto:W.Schulz@ove.at] Sent: Tuesday, June 19, 2001 5:55 PM To: SUSE (E-Mail) Subject: [suse-security] Ipsec + firewall Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria -------------------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

6 11

Re: [suse-security] Fetchmail
by Christian Laursen 20 Jun '01

20 Jun '01

Christian Laursen <xi(a)borderworlds.dk> writes: > Roman Drahtmueller <draht(a)suse.de> writes: > > > > Hi, > > > > > > the new version of fetchmail on the SUSE-Server do not work with > > > multidrop !!!! > > > > Very informative, thank you. > > > > As long as this bug report is not followed by just a little bit more > > information, I have to consider it non-existent. > > I can confirm, that the upgraded version has problems. > > I will try to make a useful bugreport when I get home from work. I tracked it down to my pop3 server not supporting the AUTH command. After I fixed that everything works perfectly again. -- Med venlig hilsen Christian Laursen

1 0

Re: [suse-security] FTP over SSH
by Andreas Rittershofer 20 Jun '01

20 Jun '01

> > What solution do you recommend when there are Windows-Clients and > > users with low skills? > > Andreas, > > My favorite is WinSCP. You can find the home page via google. THIS ONE is really good, thanks for this tip!! mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

1 0

SuSEfirewall2 and connect from internal net to extern interface
by Christoph Kiehl 20 Jun '01

20 Jun '01

Hi, topic got a bit long ;). I'm running SuSEfirewall2 version 1.0 and have the problem that i can not reach services on the firewall through the external interface(ppp0). This is not a real problem, except that I run oracle on this machine an it seems like the oracle listener binds the connection to the external ip. This leads the firewall to filter any following packages and the connection times out :(. If anyone has a solution how to tell oracle to use only a specific interface, or how to tell SuSEfirewall to not filter packets from the internal net to the external interface - please let me know ;) Regards Christoph ps: I know it's not a good idea to run oracle on a firewall but it's only for testing purposes

1 0

POP Issue
by Scott Lindstrom 20 Jun '01

20 Jun '01

Hello all, I think I have an authentication problem with my Sparc version of SuSE 7.1 and I am hoping someone can help me with this. I have enabled pop3d in inetd.conf and done the killall -HUP inetd thing. hosts.allow: ALL:172.16.17.3 <-----this is my workstation from which I will be retrieving pop mail from this server <would popd or pop3d work instead?> hosts.deny ALL:ALL /etc/pam.d/pop #%PAM-1.0 auth required /lib/security/pam_unix.so account required /lib/security/pam_unix.so The pop server is not properly authenticating my pop retrieval commands: Here is /var/log/mail: Jun 20 08:13:58 gateway ipop3d[5975]: pop3 service init from 172.16.17.3 Jun 20 08:14:01 gateway ipop3d[5975]: Command stream end of file while reading lin e user=sdl host=riley.slindstrom.net [172.16.17.3] Here is /var/log/messages: Jun 20 08:16:22 gateway ipop3d[6010]: connect from 172.16.17.3 (172.16.17.3) Jun 20 08:16:22 gateway ipop3d[6010]: Login failure user=sdl host=riley.slindstrom .net [172.16.17.3] What am I missing? Do I need to add something to the /etc/pam.d/pop file? Your assistance is greatly appreciated! Thanks a lot! Scott

1 0

sendmail 8.10.x relaying
by Philipp Snizek 20 Jun '01

20 Jun '01

Hi list-users, is there a way how to make mail relaying username/password dependent and not host, domain or subnet dependent? Goal would be: 1. everybody can send mail to the MTA. 2. Only authenticated users with passwords can use the MTA for relaying mail from ANY host / domain / subnet etc. is there a way how to do it with sendmail? Thanx a lot. Philipp

3 2

strange SuSEfirewall configuration delivered in original distribu tion
by Bruenner, Joerg 20 Jun '01

20 Jun '01

Hi everybody, trying to setup the SuSEfirewall I discovered some strange content of the SuSEfirewall_init, -_setup and -_final scripts. I'm using 7.1 as distributed via CD, no patches are installed. Kernel: 2.4.0-4GB. The scripts contains at line 28ff a case statment, marked as comment. It contains at line 52 the return=$rc_done statement, marked as comment too. The firewall does not work with the original script. It worked fine if set the commented lines back in operation. What's the sense of the original comments??? Thanks a lot Joerg -- /*-------------------------------------------------------------------- Joerg Bruenner Commerzbank AG, ZIT D E-Commerce Hafenstrasse 51, D-60327 Frankfurt am Main Tel.: +49 (0)69 136 28289, Fax: +49 (0)69 136 28252 eMail: joerg.bruenner(a)commerzbank.com --------------------------------------------------------------------*/

1 0

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

Hi List, I'm not quite sure, if this means anything, but perhaps somebody could explain to me, what was happening, Tanks in advance. This is, what the log says : sshd[17874]: connect from 61.139.252.156 sshd[17874]: log: Connection from 61.139.252.156 port 2953 sshd[17874]: log: Could not reverse map address 61.139.252.156. sshd[17874]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:2983<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.51 ports 22, 80, 443, 1024, 1080, 1313, 1352, 1433, 1494, ..., ???p?uxy, TTL 39 @11:26:00 sshd[17875]: connect from 61.139.252.156 sshd[17875]: log: Connection from 61.139.252.156 port 3099 sshd[17875]: log: Could not reverse map address 61.139.252.156. sshd[17875]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:3129<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, 1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 sshd[226]: log: Generating new 768 bit RSA key. sshd[226]: log: RSA key generation complete.

2 1

Re: [suse-security] Fetchmail
by Christian Laursen 20 Jun '01

20 Jun '01

Roman Drahtmueller <draht(a)suse.de> writes: > > Hi, > > > > the new version of fetchmail on the SUSE-Server do not work with > > multidrop !!!! > > Very informative, thank you. > > As long as this bug report is not followed by just a little bit more > information, I have to consider it non-existent. I can confirm, that the upgraded version has problems. I will try to make a useful bugreport when I get home from work. -- Best regards Christian Laursen

2 1

ipv 4 and ipv 6
by Joop Boonen 20 Jun '01

20 Jun '01

Dear all, Does someone have some experiance with the use of ipv4 and ipv6 as in. ipv4 on the internet and ipv6 on you internal network? If so which program dit you use for the translation? How can you handle the dns requests as the internet doesn't use ipv6 etc? Regards, Joop Boonen.

1 0

Fetchmail
by Rainer Buesching 20 Jun '01

20 Jun '01

Hi, the new version of fetchmail on the SUSE-Server do not work with multidrop !!!! Thanks Rainer Buesching

3 2

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

>>From: Andreas Meinerzhagen >> >>I'm not quite sure, if this means anything, but perhaps somebody could >>explain to me, what was happening, >> >>This is, what the log says : >[...] >>scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >>1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 >You have been portscanned by 61.139.252.156. I guessed so, but wasn't sure. Now, as I find no further Entry from this guy, it looks, as we would be safe for now. Thanks to all those fine skripts like harden_suse, etc. Thanks to the List, Andreas

1 0

RE: [suse-security] What does this mean ?
by Björn Engels 20 Jun '01

20 Jun '01

>From: Andreas Meinerzhagen > >I'm not quite sure, if this means anything, but perhaps somebody could >explain to me, what was happening, > >This is, what the log says : [...] >scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 You have been portscanned by 61.139.252.156. Bjoern Engels

1 0

Is this config vulnerable?
by ryanm3＠eircom.net 20 Jun '01

20 Jun '01

I am running the following services on my SuSE 6.4 box: Port Service version comments 21 in.ftpd 6.4/OpenBSD/Linux-ftpd-0.16 2 users allowed access strong passwords enforced 25 sendmail 8.9.3 53 named BIND 8.2.3-REL 80 httpd Apache 1.3.12 PHP/3.0.15, mod_perl/1.21 110 rinetd 0.61 POP3 requests redirected to another machine 443 https Apache 1.3.12 According to an nmap port scan, all other ports up to port 1024 are in state filtered. Anything from port 1024 up is closed. My question is whether this box is vulnerable in its current state and if so, what should I be doing to secure it? Tnx, MR

8 14

Snort
by Sp0oKeR 19 Jun '01

19 Jun '01

Can somebody tell, if I can drop packet with snort? Ou I just log and alert? If I can, how I do this? Thanks ... regards! -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # Sao Paulo - SP - Brazil # #=============================#

5 5

RE: [suse-security] Ipsec + firewall
by Stefan_Walther＠gehag-dsk.de 19 Jun '01

19 Jun '01

Hi I don't know the correct ports but, you can resolve the ports if you lock in your firewalllog and in /etc/services MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 "Schulz, Wolfgang" An: "SUSE (E-Mail)" <suse-security(a)suse.de> <W.Schulz@ove Kopie: .at> Thema: [suse-security] Ipsec + firewall 19.06.01 17:55 Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria -------------------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Ipsec + firewall
by Schulz, Wolfgang 19 Jun '01

19 Jun '01

Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria --------------------------------------------------------------------

2 1

Apache + mod_ssl
by Robert Szentmihalyi 19 Jun '01

19 Jun '01

Hi, could someone please point me in the right direction on how to set up Apache with SSL using Apache 1.3.19 / mod_ssl (SuSE rpms) on SuSE Linux 7.1? Do I have to compile from the sources? Kind regards, Robert Szentmihalyi

2 1

fetchmail?
by Christian Erpelding 19 Jun '01

19 Jun '01

Hi! I've recieved a mail from the dfn-cert concerning a remote exploitable buffer overflow in fetchmail when processing emails with very long headers [reported by Debian]. Is the SuSE-package vunerable as well? I think this is quite important 'cause many people (including me) are using fetchmail in a production environment and they don't need a buffer overflow there... ;-) Thanks in advance, Christian

3 2

ssh question
by michael.ryan＠storm.ie 19 Jun '01

19 Jun '01

When I try and install the package ssh-1.2.27-86.i386.rpm on a 6.4 box I get the following message: error: failed dependencies: openssh conflicts with ssh-1.2.27-86 Does this mean that I am already running openssh and NOT ssh (which is what I originally thought) ? Thanks, MR

2 1

Problems with FreeS/Wan and CheckPoint FW1
by Adilson Guilherme Vasconcelos Ribeiro 19 Jun '01

19 Jun '01

Hi everybody, i'm having some problems with a setup using freeswan and fw1... i have 12 nets that i'm accessing through 12 different tunnels passing by 5 fw-1 gateways... everything seems to be all right, but from time to time (1 - 2 hours, normally), some of the links stops the traffic. if I restart the problematic tunnel, everything comes back to normality i'm using suse 7.1 with downgraded kernel and freeswan to match the 7.0 version (the 7.1 freeswan's pluto was dying with segmentation fault some time after starting it) i followed the checkpoint howto to configure the linux side, the fw1 side was configured by someone else (the gateways are in a hosting company in another state). they said they followed the howto instructions, also. does anybody use the combination of freeswan and fw1 ? did anybody have a similar problem (all traffic from the tunnel topping suddenly ?) (with freeswan) Thanks in advance, Adilson RIbeiro

2 1

Freeswan and SuSE 7.0 config help needed badly
by Kiggundu Mukasa 19 Jun '01

19 Jun '01

Hello All, I do not know if this has been asked before but I hope you can help with a configuration. I have the following scenario Leftnet--left--wilressPublicNet----right--rightnet There is no nexthopas lest and right are connected via wireless ethernet. Left and right are running SuSE 7.0 and version 4.7 of the firewall downloaded off Marc's page at SuSE. Leftnet and rightnet are public IP networks (i.e. 192.168.x.x) left and right have eth0 with proper/real Internet IP addresses and eth1 pointing to their respective networks. I have tried runnignt he firewall with and without masqerading but even though "ipsec look" and /var/log/messages confirems everting is up and running, I cannot ping from leftnet to rightnet or vice versa. IP forwarding is turned on in /etc/rc.config, kernel is optimized as router not as host. Can someone help and point me to where I am going wrong? Thanks a million in advance Kiggundu

2 1

Re: [suse-security] private IP on the net ?
by Togan Muftuoglu 19 Jun '01

19 Jun '01

* Steffen Cluver; <sc(a)neweconomist.de> on 18 Jun, 2001 wrote: > Hi > > 212.204.100.1 recieved the host is unreachebal. > If that is the case how can they see it when they traceroute ? -- Togan Muftuoglu

3 2

Re: SuSE-SA:2001:18
by michael.ryan＠storm.ie 18 Jun '01

18 Jun '01

Are kernel modules for freeswan and cipe available for kernel update 2.2.19 (SuSE 6.4) yet ? Tnx, MR

2 1

private IP on the net ?
by Togan Muftuoglu 18 Jun '01

18 Jun '01

Now I did a line quality test at dslreports.com which is bacisly tracerouting and their reports show blabala routes 212.156.7.209 10.14.9.12 and then myip assigned by the isp which is 212.156.xxx.xxx ( so far no big deal since a dynamic ip but the rumor is next week we will be given static IP's) My question is AFAIK 10.0.0.0 class was private IP's and they should not be visible to the internet and hence was the reason for denying packets from the internet with source address of the private address. My understanding is 10.14.9.12 is the IP of my ADSL modem ( I could be wrong) If anyone can ping to the ADSL modem (with a private IP) basicly they can do other things also. I am using Alcatel Ant 1000 DSL modem and the connection is PPPOE. Is their anything I can do or is this ISP side solveable ? TIA -- Togan Muftuoglu

1 0

firewall disables nic
by Bruenner, Joerg 18 Jun '01

18 Jun '01

Hi everybody, I'm using the SuSE 7.1 distribution with 2.2.18 kernel. I tried to use the ipchains firewall (standard version as in CD-distribution delivered). While starting the firewall it disables the last network adapter (eth1 or eth2 if we used 3 cards). With kernel 2.4. everything worked fine. Does anyone has an explaination? Thanks a lot Joerg -- /*-------------------------------------------------------------------- Joerg Bruenner Commerzbank AG, ZIT D E-Commerce Hafenstrasse 51, D-60327 Frankfurt am Main Tel.: +49 (0)69 136 28289, Fax: +49 (0)69 136 28252 eMail: joerg.bruenner(a)commerzbank.com --------------------------------------------------------------------*/

1 0

Squid - secure - installation
by Leitner, Axel 18 Jun '01

18 Jun '01

Hello, we are using a out of the box squid-proxy und now I want to make a new secure installation with the latest binaries, not running with root-permissions and in a chroot environment. I have to use Port 80 for http_port, but if I trust the squid.conf, there is a comment under cache_effective_user, that only root can start squid with http_port lower than 1024. So if anybody out there has a idea of how to make a work around that squid listens on Port 80 with normal user permissions is wellcome, the same as if you have expririence with chroot and installing squid.... Bye Axel > Landratsamt München Tel. > ++49(089) 6221-2363 > EDV und Organisation Fax. > ++49(089) 6221-2424 > Axel Leitner > axel.leitner(a)lra-m.bayern.de > Mariahilfplatz 17 > http://www.landkreis-muenchen.de > 81541 München > <<Leitner, Axel.vcf>>

5 6

SuSE firewall with 3 interfaces == frustration
by gabriel rivera 18 Jun '01

18 Jun '01

Hello all, I am attempting to deploy the following firewall:: eth0-external interface to Cisco IP 1.2.3.62 Mask 255.255.255.248 eth1-DMZ interface IP 10.0.0.1 Mask 255.255.255.0 eth2-internal interface to 192.168.1.0/24. IP 192.168.1.1 Mask 255.255.255.0 The dmz interface has a private IP, but is connected to a switch with my web and mail servers on it, complete with public IP's. I cannot spare two public IP's for the firewall box alone. I have connected a web server to this interface but it is unreachable with ICMP, web requests, etc. I suspect that my routing configuration is incorrect. Despite what I thought was a basic understanding of subnetting and static routing in general, I cannot achieve the proper config!!! Anyone see my errors?? Thanks, Gabriel Rivera -------------------------------------- Output of route -n on firewall: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 1.2.3.46 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 1.2.3.45 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 1.2.3.44 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 1.2.3.43 0.0.0.0 255.255.255.255 UH 0 0 0 eth1 1.2.3.41 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 1.2.3.40 0.0.0.0 255.255.255.248 U 0 0 eth0 10.0.0.0 0.0.0.0 255.255.255.0 U 0 0 eth1 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 eth2 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 1.2.3.41 0.0.0.0 UG 0 0 0 eth0 route.conf from firewall: default 1.2.3.41 1.2.3.41 0.0.0.0 255.255.255.255 eth0 1.2.3.43 0.0.0.0 255.255.255.255 eth1 1.2.3.44 0.0.0.0 255.255.255.255 eth1 1.2.3.45 0.0.0.0 255.255.255.255 eth1 1.2.3.46 0.0.0.0 255.255.255.255 eth1 192.168.1.0 0.0.0.0 255.255.255.0 eth2 Output of route -n on webserver: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 1.2.3.4.0 0.0.0.0 255.255.255.248 U 0 0 0 eth0 route.conf from webserver: default 10.0.0.1 10.0.0.1 0.0.0.0 255.255.255.255 eth0

4 7

i386 hangs on 2.4.x kernels: DSL, reiserfs on md, ipfilter
by Daniel Wirth 17 Jun '01

17 Jun '01

Dear SuSE-Experts, My gateway-system easily crashes while using limewire on a client in the internal network. I've been testing kernels 2.4.3, 2.4.4, 2.4.5 and currently 2.4.5-ac3 on a SuSE 7.1 System. The system is connected to the internet via DSL and to the internal network via eth1. FW and Masq are working fine until starting Limewire on a client in the internal net. At that point, the system hangs without any notice, syslog or console-message. I can easlily reproduce the scenario. I don't know the protocols Limewire uses. I do use some "experimental" features: reiserfs on md and dsl. Please find some info about the system attached below: lspci, ifconfig, uname, interupts, ioports, mount, mdstat, ipfilter I'd be grateful for any ideas and be happy to provide any more information on request. Regards, Daniel P.S.: This is a crosspost, I posted the same question on linux-kernel. (19:05 102 dw@hal:~ ) lspci -v 00:00.0 Host bridge: Intel Corporation 430HX - 82439HX TXC [Triton II] (rev 01) Flags: bus master, medium devsel, latency 32 00:07.0 ISA bridge: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] Flags: bus master, medium devsel, latency 0 00:07.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] (prog-if 80 [Master]) Flags: bus master, medium devsel, latency 32 I/O ports at 9000 [size=16] 00:0f.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8029(AS) Subsystem: Realtek Semiconductor Co., Ltd. RT8029(AS) Flags: medium devsel, IRQ 11 I/O ports at 6000 [size=32] 00:10.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139 (rev 10) Subsystem: Realtek Semiconductor Co., Ltd. RT8139 Flags: bus master, medium devsel, latency 32, IRQ 10 I/O ports at 6100 [size=256] Memory at e4000000 (32-bit, non-prefetchable) [size=256] Capabilities: [50] Power Management version 2 00:14.0 VGA compatible controller: S3 Inc. 86c764/765 [Trio32/64/64V+] (rev 53) (prog-if 00 [VGA]) Flags: medium devsel, IRQ 9 Memory at e0000000 (32-bit, non-prefetchable) [size=64M] Expansion ROM at <unassigned> [disabled] [size=64K] (19:10 103 dw@hal:~ ) ifconfig -a eth0 Link encap:Ethernet HWaddr 00:00:B4:5A:F3:E4 inet addr:10.1.1.1 Bcast:10.1.1.255 Mask:255.255.255.0 inet6 addr: fe80::200:b4ff:fe5a:f3e4/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:310 errors:0 dropped:0 overruns:0 frame:0 TX packets:318 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:11 Base address:0x6000 eth1 Link encap:Ethernet HWaddr 00:48:54:6C:01:81 inet addr:192.168.99.10 Bcast:192.168.99.255 Mask:255.255.255.0 inet6 addr: fe80::248:54ff:fe6c:181/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2957 errors:0 dropped:0 overruns:0 frame:0 TX packets:2205 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 Interrupt:10 ippp0 Link encap:Ethernet HWaddr FC:FC:C0:A8:00:01 inet addr:192.168.0.1 P-t-P:192.168.0.2 Mask:255.255.255.255 inet6 addr: fe80::fefc:c0ff:fea8:1/10 Scope:Link UP POINTOPOINT RUNNING NOARP MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:5024 errors:0 dropped:0 overruns:0 frame:0 TX packets:5024 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 ppp0 Link encap:Point-to-Point Protocol inet addr:213.23.60.38 P-t-P:145.253.1.223 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1490 Metric:1 RX packets:271 errors:0 dropped:0 overruns:0 frame:0 TX packets:277 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 (19:10 104 dw@hal:~ ) uname -a Linux hal 2.4.5-ac3 #2 Mon May 28 21:28:47 MEST 2001 i586 unknown (19:10 105 dw@hal:~ ) free total used free shared buffers cached Mem: 94988 77592 17396 0 23784 23840 -/+ buffers/cache: 29968 65020 Swap: 202528 0 202528 (19:10 106 dw@hal:~ ) cat /proc/interrupts CPU0 0: 44205 XT-PIC timer 1: 4 XT-PIC keyboard 2: 0 XT-PIC cascade 3: 89 XT-PIC 4: 4 XT-PIC 10: 6321 XT-PIC eth1 11: 628 XT-PIC eth0 12: 44 XT-PIC HiSax 14: 29239 XT-PIC ide0 15: 22157 XT-PIC ide1 NMI: 0 ERR: 0 (19:10 108 dw@hal:~ ) cat /proc/ioports 0000-001f : dma1 0020-003f : pic1 0040-005f : timer 0060-006f : keyboard 0080-008f : dma page reg 00a0-00bf : pic2 00c0-00df : dma2 00f0-00ff : fpu 0170-0177 : ide1 01f0-01f7 : ide0 0213-0213 : isapnp read 02f8-02ff : serial(auto) 0300-0300 : HiSax hscx A fifo 0376-0376 : ide1 03c0-03df : vga+ 03f6-03f6 : ide0 03f8-03ff : serial(auto) 0700-071f : HiSax hscx A 0a79-0a79 : isapnp write 0b00-0b00 : HiSax hscx B fifo 0cf8-0cff : PCI conf1 0f00-0f1f : HiSax hscx B 1300-1300 : HiSax isac fifo 1700-171f : HiSax isac 1b00-1b07 : avm cfg 6000-601f : Realtek Semiconductor Co., Ltd. RTL-8029(AS) 6000-601f : ne2k-pci 6100-61ff : Realtek Semiconductor Co., Ltd. RTL-8139 6100-61ff : 8139too 9000-900f : Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] 9000-9007 : ide0 9008-900f : ide1 (19:11 115 dw@hal:~ ) mount /dev/md0 on / type reiserfs (rw) proc on /proc type proc (rw) devpts on /dev/pts type devpts (rw,mode=0620,gid=5) /dev/md1 on /home type reiserfs (rw) /dev/hda1 on /boot type ext2 (ro) shmfs on /dev/shm type shm (rw) automount(pid727) on /misc type autofs (rw,fd=5,pgrp=727,minproto=2,maxproto=4) automount(pid737) on /net type autofs (rw,fd=5,pgrp=737,minproto=2,maxproto=4) (19:20 102 dw@hal:~ ) cat /proc/mdstat Personalities : [raid1] [raid5] read_ahead 1024 sectors md1 : active raid5 hdc3[2] hdb3[1] hda3[0] 2999680 blocks level 5, 32k chunk, algorithm 2 [3/3] [UUU] md0 : active raid1 hdc4[1] hda4[0] 891008 blocks [2/2] [UU] unused devices: <none> (19:23 101 dw@hal:~ ) /etc/init.d/SuSEfirewall status Checking the status of the Firewall: Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 13471 1560K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 14 2915 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpts:137:138 0 0 LOG all -- * * 127.0.0.0/8 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOFING' 0 0 LOG all -- * * 0.0.0.0/0 127.0.0.0/8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOFING' 0 0 DROP all -- * * 127.0.0.0/8 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 127.0.0.0/8 0 0 LOG all -- * * 192.168.99.10 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOFING' 0 0 DROP all -- * * 192.168.99.10 0.0.0.0/0 0 0 LOG all -- * * 213.23.60.38 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOFING' 0 0 DROP all -- * * 213.23.60.38 0.0.0.0/0 428 86043 input_ext all -- ppp0 * 0.0.0.0/0 213.23.60.38 8086 654K input_int all -- eth1 * 0.0.0.0/0 192.168.99.10 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-UNALLOWED-TARGET' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth1 eth1 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- ppp0 ppp0 0.0.0.0/0 0.0.0.0/0 0 0 forward_ext all -- ppp0 * 0.0.0.0/0 0.0.0.0/0 1 62 forward_int all -- eth1 * 0.0.0.0/0 0.0.0.0/0 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-UNALLOWED-ROUTING' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-FORWARD-ERROR' Chain OUTPUT (policy ACCEPT 7 packets, 1051 bytes) pkts bytes target prot opt in out source destination 13471 1560K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 LOG flags 6 level 4 prefix `SuSE-FW-TRACEROUTE-ATTEMPT' 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11 1 176 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 4 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 9 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 10 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 13 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3 6780 1216K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-OUTPUT-ERROR' Chain forward_dmz (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 213.23.60.38 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 213.23.60.38 0.0.0.0/0 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 LOG all -- * * 0.0.0.0/0 192.168.99.10 LOG flags 6 level 4 prefix `SuSE-FW-DROP-CIRCUMVENTION' 0 0 DROP all -- * * 0.0.0.0/0 192.168.99.10 0 0 LOG all -- * * 0.0.0.0/0 213.23.60.38 LOG flags 6 level 4 prefix `SuSE-FW-DROP-CIRCUMVENTION' 0 0 DROP all -- * * 0.0.0.0/0 213.23.60.38 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 0 0 ACCEPT all -- * ppp0 192.168.99.0/24 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 192.168.99.0/24 state RELATED,ESTABLISHED 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain forward_ext (1 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 LOG all -- * * 0.0.0.0/0 192.168.99.10 LOG flags 6 level 4 prefix `SuSE-FW-DROP-CIRCUMVENTION' 0 0 DROP all -- * * 0.0.0.0/0 192.168.99.10 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 0 0 ACCEPT all -- * ppp0 192.168.99.0/24 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 192.168.99.0/24 state RELATED,ESTABLISHED 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain forward_int (1 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 213.23.60.38 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 213.23.60.38 0.0.0.0/0 0 0 LOG all -- * * 0.0.0.0/0 213.23.60.38 LOG flags 6 level 4 prefix `SuSE-FW-DROP-CIRCUMVENTION' 0 0 DROP all -- * * 0.0.0.0/0 213.23.60.38 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 1 62 ACCEPT all -- * ppp0 192.168.99.0/24 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 ACCEPT all -- ppp0 * 0.0.0.0/0 192.168.99.0/24 state RELATED,ESTABLISHED 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain input_dmz (0 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 213.23.60.38 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 213.23.60.38 0.0.0.0/0 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02 reject-with tcp-reset 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:515 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:515 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:979 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:979 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1024 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1024 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3128 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3128 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20011 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20011 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 dpts:1024:65535 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 dpts:1024:65535 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpts:600:65535 flags:!0x16/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpt:20 flags:!0x16/0x02 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:1024 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:25 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:137 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:138 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:139 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:515 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:977 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:979 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1027 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1028 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1035 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:2049 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:3128 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:3130 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:20011 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:53 dpts:1024:65535 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:123 dpts:1024:65535 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain input_ext (1 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 LOG all -- * * 192.168.99.0/24 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 192.168.99.0/24 0.0.0.0/0 0 0 LOG icmp -- * * 213.23.60.38 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT-SOURCEQUENCH' 0 0 ACCEPT icmp -- * * 213.23.60.38 0.0.0.0/0 icmp type 4 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 1 1006 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:22 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:15472 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:15472 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:123 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:123 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02 reject-with tcp-reset 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 dpts:1024:65535 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 dpts:1024:65535 290 58674 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpts:600:65535 flags:!0x16/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpt:20 flags:!0x16/0x02 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:53 13 988 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:123 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:1024 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:22 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:25 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:111 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:123 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:137 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:138 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:139 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:515 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:977 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:979 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1027 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1028 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1035 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:2049 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:3128 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:3130 0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:20011 108 23839 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:53 dpts:1024:65535 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:123 dpts:1024:65535 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED udp dpts:61000:65095 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 16 1536 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain input_int (1 references) pkts bytes target prot opt in out source destination 0 0 LOG all -- * * 213.23.60.38 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ANTI-SPOOF' 0 0 DROP all -- * * 213.23.60.38 0.0.0.0/0 8086 654K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 3 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 11 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 12 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 14 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED icmp type 18 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 2 LOG flags 6 level 4 prefix `SuSE-FW-DROP-ICMP-CRIT' 0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 flags:0x16/0x02 reject-with tcp-reset 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:111 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:515 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:515 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:979 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:979 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1024 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1024 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3128 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:3128 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20011 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP' 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20011 flags:0x16/0x02 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 dpts:1024:65535 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:53 dpts:1024:65535 flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-ACCEPT' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 dpts:1024:65535 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpts:600:65535 flags:!0x16/0x02 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED tcp dpt:20 flags:!0x16/0x02 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:1024 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:53 dpts:1024:65535 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp spt:123 dpts:1024:65535 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 5 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 13 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 17 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT' 0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID LOG flags 6 level 4 prefix `SuSE-FW-DROP-DEFAULT-INVALID' 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain PREROUTING (policy ACCEPT 25 packets, 4542 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 96 packets, 6987 bytes) pkts bytes target prot opt in out source destination 1 62 MASQUERADE all -- * ppp0 192.168.99.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 96 packets, 6987 bytes) pkts bytes target prot opt in out source destination Chain PREROUTING (policy ACCEPT 22158 packets, 2319K bytes) pkts bytes target prot opt in out source destination 22 1939 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:22 TOS set 0x10 7980 637K TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:22 TOS set 0x10 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:20 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:80 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:80 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 TOS set 0x10 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:53 TOS set 0x10 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:161 TOS set 0x04 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:162 TOS set 0x04 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 TOS set 0x04 Chain OUTPUT (policy ACCEPT 20430 packets, 2829K bytes) pkts bytes target prot opt in out source destination 6240 1209K TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:22 TOS set 0x10 21 1916 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:22 TOS set 0x10 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:20 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:20 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:80 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp dpt:80 TOS set 0x08 0 0 TOS tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED tcp spt:53 TOS set 0x10 109 6707 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:53 TOS set 0x10 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:161 TOS set 0x04 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED udp dpt:162 TOS set 0x04 0 0 TOS udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:514 TOS set 0x04

1 0

[PATCH] xinet 2.1.8.8p3 umask and tcpd looping problems
by Matthias Andree 17 Jun '01

17 Jun '01

Hi, I recently sent a problem report to SuSE feedback and reported the second problem to the xinetd mailing list (I presume Mandrake have already reported #1), but haven't got a response from SuSE yet. I'm resending the information so no-one is trapped. In xinetd-2.1.8.8p3, at least as of SuSE Linux 7.0 (didn't check older or newer versions), there are two major problems with xinetd. 1. SECURITY: Mandrake issued a security advisory about the umask being initialized to 0, so some network daemons create world + group writable files. See http://www.securityfocus.com/advisories/3351 NOTE that daemons which don't set a proper umask need to be fixed in the first place, fixing xinetd is only a band-aid. (void)umask(022); or (void)umask(022 | umask(077)); Should be a standard initialization procedure in daemons or their startup scripts. NOTE also that the standard inetd doesn't touch umask at all, but inherits it from its sysvinit script. In contrast, xinetd kills the umask and sets it to 0, so this cannot be fixed in an init script. WORKAROUND: write a wrapper script around the actual network server that looks like this: #! /bin/sh umask 022 exec /path/to/real_server "$@" exit 127 2. RELIABILITY: A service "flags = NAMEINARGS" configuration is killed by the defaults {} section key word "enabled = <service>". Cause is a bug in sconf.h. This does not strike when using disabled or omitting these keywords. Resulting problem: when you're using server = /usr/sbin/tcpd and configure enabled keywords in the defaults section, tcpd will have its own path as argv[0] rather than the first component of server_args, thus it will go into a unterminated loop, exec'ing itself all over again, eating up kernel resources and pids and flooding away log files. WORKAROUND: 1. don't use enabled = keyword 2. to catch looping services, add this to the TOP of your /etc/hosts.allow: tcpd : ALL : twist echo "421 service is looping on tcpd, aborting." This is harmless as long as you have one tcpd start another one in a different path which should be pretty uncommon. Note both bugs also affect 2.1.8.9pre15. I have been told pre16 is due out soon. A patch which remedies these problems, please incorporate these into the xinetd RPMs and provide the updated packages through the standard mechanisms follows: --- xinetd-2.1.8.8p3/xinetd/sconf.h.fix Sat Dec 11 01:07:18 1999 +++ xinetd-2.1.8.8p3/xinetd/sconf.h Sun Jun 17 14:34:02 2001 @@ -185,9 +185,9 @@ #define SC_IS_SPECIAL( scp ) ( M_IS_SET( (scp)->sc_type, ST_SPECIAL ) ) #define SC_IS_UNLISTED( scp ) ( M_IS_SET( (scp)->sc_type, ST_UNLISTED ) ) #define SC_IS_INTERCEPTED( scp ) ( M_IS_SET( (scp)->sc_xflags, SF_INTERCEPT ) ) -#define SC_IS_DISABLED( scp ) ( M_IS_SET( (scp)->sc_xflags, ST_DISABLED ) ) -#define SC_DISABLE(scp) ( M_SET( (scp)->sc_xflags, ST_DISABLED ) ) -#define SC_ENABLE(scp) ( M_CLEAR( (scp)->sc_xflags, ST_DISABLED ) ) +#define SC_IS_DISABLED( scp ) ( M_IS_SET( (scp)->sc_type, ST_DISABLED ) ) +#define SC_DISABLE(scp) ( M_SET( (scp)->sc_type, ST_DISABLED ) ) +#define SC_ENABLE(scp) ( M_CLEAR( (scp)->sc_type, ST_DISABLED ) ) #define LOGS_USERID( scp, flags ) \ ( M_IS_SET( (scp)->flags, LO_USERID ) && SC_ACCEPTS_CONNECTIONS( scp ) ) --- xinetd-2.1.8.8p3/xinetd/init.c.fix Sun Jun 17 14:34:43 2001 +++ xinetd-2.1.8.8p3/xinetd/init.c Sun Jun 17 14:34:53 2001 @@ -210,7 +210,7 @@ "Initialization of %s facility failed. Exiting...", mp->name ) ; exit( 1 ) ; } - (void) umask( 0 ) ; + (void) umask( 022 ) ; } -- Matthias Andree

2 2

different apache-1.3.19-6.i386.rpm on ftp.suse.com
by Thomas Oppel 17 Jun '01

17 Jun '01

Hi, I was just about looking for recent packages and had to notice, that ftp.suse.com carries packages with different sizes to earlier available in i386-update area for 7.1/n2: apache-1.3.19.i386.rpm 1789300 21 Mar apache-1.3.19.i386.rpm 1789388 11 Jun mgetty-1.1.22-25.i386.rpm 517699 12 Mar mgetty-1.1.22-25.i386.rpm 517787 11 Jun postfix-20010228-4.i386.rpm 1883329 08 Mar postfix-20010228-4.i386.rpm 1883417 11 Jun I noticed further that also apache-1.3.19.i386.src.rpm is of June 11th and 88 Bytes bigger, but no source file or spec is different to the on of March 21st. What is it? Greetings from Aachen, Leppo. -- <t.oppel(a)inmedias.de> Thomas Oppel Linux SysOp team in medias, Aachen --

2 1

Fw: [suse-security] Fw: A bug with SuSEfirewall2 ? Or a feature ?
by linux 15 Jun '01

15 Jun '01

I sorry but i forget mention that I have another problem besides which I had already spoken them. The problem numbers 2 it is the following: 1) I have my mail server with SuSe 7.1 and postfix in www.opc.com.uy / 200.61.85.10 2) In order to could read the mail from any pc of the exterior, I configure the address server in accounts of clients mail like www.opc.com.uy and there are no problems. 3) But in order to could read the mail in pc of the internal net, I have to configure the outlook express address server like 172.16.0.1 instead of www.opc.com.uy or 200.61.85.10 I suspect that it is the same problem that doesn't allow to see routed ports to the internal net from pc's of the internal net that I mentioned them in the previous mail . Best regards Alberto ----- Original Message ----- From: "linux" <linux(a)opc.com.uy> To: <andjoh(a)cicada.linux-site.net>; <suse-security(a)suse.com> Sent: Thursday, June 14, 2001 8:16 PM Subject: Re: [suse-security] Fw: A bug with SuSEfirewall2 ? Or a feature ? > > Do you have FW_SERVICES_INT_TCP set as well? > Yes i do. > This is my firewall2.rc.confg file > 2.) > FW_DEV_EXT="eth1" > 3.) > FW_DEV_INT="eth0" > 4.) > FW_DEV_DMZ="" > 5.) > FW_ROUTE="yes" > 6.) > FW_MASQUERADE="yes" > FW_MASQ_DEV="$FW_DEV_EXT" > FW_MASQ_NETS="172.16.0.0/16" > 7.) > FW_PROTECT_FROM_INTERNAL="yes" > 8.) > FW_AUTOPROTECT_SERVICES="yes" > 9.) > FW_SERVICES_EXT_TCP="http-alt ssh smtp pop3 domain ftp www" > FW_SERVICES_EXT_UDP="domain" > FW_SERVICES_EXT_IP="" > FW_SERVICES_DMZ_TCP="" > FW_SERVICES_DMZ_UDP="" > FW_SERVICES_DMZ_IP="" > FW_SERVICES_INT_TCP="ssh ftp smtp domain www telnet pop3 137 138 139 901 > 3128" > FW_SERVICES_INT_UDP="domain 137 138 139" > FW_SERVICES_INT_IP="" > 10.) > FW_TRUSTED_NETS="" > 11.) > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > 12.) > FW_SERVICE_AUTODETECT="yes" > FW_SERVICE_DNS="yes" > FW_SERVICE_DHCLIENT="no" > FW_SERVICE_DHCPD="yes" > FW_SERVICE_SAMBA="no" > 13.) > FW_FORWARD="" > 14.) > FW_FORWARD_MASQ="0/0,172.16.0.3,tcp,8080,80" > 15.) > FW_REDIRECT="172.16.0.0/16,0/0,tcp,80,3128" > 16.) > FW_LOG_DROP_CRIT="yes" > FW_LOG_DROP_ALL="no" > FW_LOG_ACCEPT_CRIT="no" > FW_LOG_ACCEPT_ALL="no" > 17.) > FW_KERNEL_SECURITY="yes" > 18.) > FW_STOP_KEEP_ROUTING_STATE="no" > 19.) > FW_ALLOW_PING_FW="yes" > FW_ALLOW_PING_DMZ="no" > FW_ALLOW_PING_EXT="no" > 20.) > FW_ALLOW_FW_TRACEROUTE="yes" > 21.) > FW_ALLOW_FW_SOURCEQUENCH="yes" > 22.) > FW_ALLOW_FW_BROADCAST="no" > 23.) > FW_ALLOW_CLASS_ROUTING="no" > > Best Regards > Alberto > ...labp > ----- Original Message ----- > From: "Anders Johansson" <andjoh(a)cicada.linux-site.net> > To: "linux" <linux(a)opc.com.uy>; <suse-security(a)suse.com> > Sent: Thursday, June 14, 2001 7:27 PM > Subject: Re: [suse-security] Fw: A bug with SuSEfirewall2 ? Or a feature ? > > > > On Friday 15 June 2001 00:09, linux wrote: > > > Hi, > > > > > > I'm using SuSEfirewall2 1.0 in a SuSE 7.1 kernel 2.4.2, the machine is > > > the firewall for a private lan using masquerading to reach the > internet. > > > > > > The problem is: > > > > > > Internal machines can't connect to ports on the external address of > > > the firewall. If I try these ports from outside, it works ok. > > > > > > Example : > > > firewall > > > eth1 - external ip 1.2.3.4 > > > eth0 - internal ip 172.16.0.1 > > > > > > if I try to get mail from 172.16.0.3 this is the log in > > > /var/log/firewall: > > > SuSE-FW-UNALLOWED-TARGETIN=eth0 OUT= > > > MAC=00:80:ad:09:0b:38:00:48:54:62:d9:ed:08:00 SRC=172.16.0.3 > > > DST=1.2.3.4 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=26274 DF PROTO=TCP > > > SPT=1908 DPT=110 WINDOW=16384 RES=0x00 SYN URGP=0 OPT > (020405B401010402) > > > > > > > > > /etc/rc.config.d/firewall2.rc.config has this line : > > > FW_SERVICES_EXT_TCP="ssh smtp pop3 domain www" > > > > Do you have FW_SERVICES_INT_TCP set as well? This variable defines which > > services should be available on the firewall machine for hosts on the > > internal network > > > > > > > > The masquerading works to any other host without a charm, except for > > > the external ip of the firewall. Previously we were using SuSefirewall > on > > > a SuSE 6.4 and this thing worked. There are laptop users that try to get > > > mail from inside or outside and this problem is very annoying. > > > > > > Is SuSEfirewall2 doing this on purpose ? > > > > > > Thanks, > > > -- > > > > Regards > > Anders > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > >

1 0

Re: [suse-security] Very strange mail
by Nash Hoogwater 15 Jun '01

15 Jun '01

Hi Mike, I'm sorry, but I did include the headers (out of the spoolfile). I contacted kde and they had th explanation below and later talking to my sys admin at my university they concurred. Greetings, Nash ---------------------------------------------------------------------------------------------- ##########<included discussion with kde>################### Great! Thanks for the info! I believe solo.cs.vu.nl is using the UW IMAP pop server homepage http://www.washington.edu/imap/ (yes it does pop as well as imap). We use the same pop server at my workplace (and have many KMail users experiencing no problems), but here we use version v7.64, while solo.cs.vu.nl uses v4.39. In my opinion the version of UW IMAP used at solo.cs.vu.nl (v4.39) is buggy, it sometimes returns bogus data in response to the UIDL command. This bug is fixed in v7.69 of the UW IMAP and if you can convince the sys admin to upgrade your problem should be fixed. Don. On Thursday 14 June 2001 18:49, Nash Hoogwater wrote: > Hi Don, > > I pop 2 servers: my own (postfix 20001212-4), this one > receives mail from pop.planet.nl (ident: iPlanet > Messaging Multiplexor version 5.1) via fetchmail and I > pop solo.cs.vu.nl, but I can't get an identification > string from it. I also use gotmail to get hotmail. The > problem here lies within solo.cs.vu.nl because I have a > filter-rule that places these mails in a separate folder > ("to or CC contains emailadres transfer to foldername"). > This is the place where this mail showes up. So as far I > can see, this must be the troubling server. However, this > is a server from a university and I talked to the systems > administrator there and he thinks it could be a corrupt > mailbox. Strange thing is of course that I do receive the > mail, so there pop server could be misconfigured.... > > Hope I could be of some help. > > Greetings, > > Nash > > On Thursday 14 June 2001 16:38, you wrote: > > This indicates your pop server does not properly > > implement the UIDL command, (rather than a KMail bug > > existing) > > > > If possible please manually telnet to the pop server > > and supply us with the identification string of the pop > > server. > > > > Don. > > > > On Monday 11 June 2001 13:42, nrhoogwater(a)planet.nl wrote: > > > Package: kmail > > > Version: 1.2 (using KDE 2.1.1 ) > > > Severity: normal > > > Installed from: SuSE RPMs > > > Compiler: gcc 2.95.2 19991024 > > > OS: Linux > > > OS/Compiler notes: Not Specified > > > > > > I have received a very strange mail, upon which I > > > couldn't receive mail anymore and when checking > > > manually, kmail crashed. The mail I received looked > > > like this: > > > > > > Content-Type: > > > Status: R > > > X-Status: N > > > > > > > > > > > > 1 3b13ce2000000001 > > > 2 3b13ce2000000002 > > > > > > There were almost no headers as you can see and the > > > body contained only 2 lines of rubbish. The date was > > > 1 january 1970 00:59:59. Someone on a mailinglist > > > confirmed the problem with kmail from KDE 2.0, but he > > > received it after a crash from kmail. > > > > > > (Submitted via bugs.kde.org) > > > > > > _______________________________________________ > > > Kmail Developers mailing list > > > Kmail(a)master.kde.org > > > http://master.kde.org/mailman/listinfo/kmail ##########<end included discussion with kde>################### ---------------------------------------------------------------------------------------------- On Monday 11 June 2001 03:44, you wrote: > Nash Hoogwater wrote: > > Hi list, > > > > I got some very strange mail a few minutes ago and a week ago also. Maybe > > someone can help me with this. > > > > The mail doesn't contain a reply-adres, subject and almost no headers. > > The date is 1 january 1970 00:59:59. I have pasted the headers and text > > below. The text is also very strange as you can see. > > Well, you have provided no headers. the from: to: is not the headers. > > The contents looks like a spammer trying to scope if your email address > can be used as a bcc relay. > Spammers try to find victims that allow bcc spam, i.e. they send you an > email and bcc a couple of hundred others on it. > Your mail server might honor the bcc and help the spammer. > > That's to me a sign that the spammer community is running out of open > relays. Now they try the 'cc' and 'bcc' route. > > To the recipients, it would look as if you had sent an email with them > on the 'cc' or 'bcc' list. That's user level relaying. > > The spammer expects a copy of this email, coming from you, and > containing the pointers as text. > Since they explore thousands of accounts, this return code identifies > your email address. > Then you will get emails with spam contents from them, and cc or bcc > thousands of others, coming from your email address, if your email > server allows for that. > > They look for systems where a user can send email to an unlimited number > of recipients. > > Mike > > > ------------------------------------------------- > > > > Content-Type: > > Status: R > > X-Status: N > > > > 1 3b13ce2000000001 > > 2 3b13ce2000000002 > > > > ---------------------------------------------------- > > > > Someone??? Any idea??? > > > > Greetings, > > > > Nash > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Fw: A bug with SuSEfirewall2 ? Or a feature ?
by linux 14 Jun '01

14 Jun '01

Hi, I'm using SuSEfirewall2 1.0 in a SuSE 7.1 kernel 2.4.2, the machine is the firewall for a private lan using masquerading to reach the internet. The problem is: Internal machines can't connect to ports on the external address of the firewall. If I try these ports from outside, it works ok. Example : firewall eth1 - external ip 1.2.3.4 eth0 - internal ip 172.16.0.1 if I try to get mail from 172.16.0.3 this is the log in /var/log/firewall: SuSE-FW-UNALLOWED-TARGETIN=eth0 OUT= MAC=00:80:ad:09:0b:38:00:48:54:62:d9:ed:08:00 SRC=172.16.0.3 DST=1.2.3.4 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=26274 DF PROTO=TCP SPT=1908 DPT=110 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) /etc/rc.config.d/firewall2.rc.config has this line : FW_SERVICES_EXT_TCP="ssh smtp pop3 domain www" The masquerading works to any other host without a charm, except for the external ip of the firewall. Previously we were using SuSefirewall on a SuSE 6.4 and this thing worked. There are laptop users that try to get mail from inside or outside and this problem is very annoying. Is SuSEfirewall2 doing this on purpose ? Thanks, --

3 3

openssh-2.9p1-7: Protocol 1,2 or Protocol 2,1 ?
by Richard Ems 14 Jun '01

14 Jun '01

Hi list! Why are the default protocols order in /etc/ssh/ssh_config and /etc/ssh/sshd_config 1,2 and not 2,1 ? Manual pages for ssh and sshd state that the default is 2,1. So, why did the guys at SuSE changed it to 1,2? Backward compatibility to older SuSE distro's or keys? Thanks, richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Fachbereich Informatik, Universität Hamburg Unix IS user friendly. It's just selective about who its friends are.

4 5

Re: [suse-security] mounting root read-only
by Martin Peikert 14 Jun '01

14 Jun '01

Markus Kohli <kohli(a)dplanet.ch> wrote: > Hi! > I have the following problem: >>From one boot to the next, I had an ugly message on my screen saying: > *ERROR* cannot fsck, root is not read-only > > So what's wrong with my system, and how can I get back to my root mounted > read-only? 1. man is your friend. Read the manpage of "mount"... 2. Try "mount -oremount,ro /" and try to understand what happens. HTH Martin P.S.: Next time start a new thread instead of posting a follow-up to an existing when you want to ask a question not concerning the old thread. -- martin.peikert(a)innominate.com project manager innominate AG security appliances http://www.innominate.com tel: +49.30.308806-0 fax: -77 gpg: http://innominate.org/gpg/mpe.gpg

1 0

harden_suse-3.5: $perms = "secure paranoid"; $perms = "secure local";
by Richard Ems 14 Jun '01

14 Jun '01

Hi list! After running "harden_suse-3.5.pl YES" I compared my old rc.config file an the new one. One of the differences found was at the variable PERMISSION_SECURITY. The old value was: PERMISSION_SECURITY="secure paranoid local" and the new values is: PERMISSION_SECURITY="secure local" From the harden_suse-3.5.pl script: line 151: $perms = "secure paranoid"; and line 165: $perms = "secure local"; Isn't this a bug? Shouldn't PERMISSION_SECURITY be set to "secure paranoid" or "secure paranoid local" ? Thanks, richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Fachbereich Informatik, Universität Hamburg Unix IS user friendly. It's just selective about who its friends are.

1 0

Yast defaults, editing -
by Maarten van den Berg 14 Jun '01

14 Jun '01

Hi list, If I wanted to change the default shell Yast proposes when adding new users from /bin/bash to /bin/false, where would I tweak that setting, does anyone know ? I need it to be as foolproof as possible, they're got going to add any real users, just pop-accounts, so it makes good sense I think. greetings, Maarten

2 1

pam_pwdb.so & MD5 passwd's
by James Ogley 14 Jun '01

14 Jun '01

Is there a particular reason why the pam package doesn't include /lib/security/pam_pwdb.so? Related - how do you make passwd use MD5 hashes? -- James Ogley, Unix Systems Administrator, Pinnacle.Net james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 20 8731 3619 Listening for the sound of the coming rain... *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

1 0

Tomatoes on the eyes
by Steffen Clüver 13 Jun '01

13 Jun '01

Hi I've got a gateway/firewall-, apache-, samba-Server. Everything from Suse 7.0. All ports are open. That works. So far, so good. The problem is, i can't see the server in my intranet (win-clients). What are my possibilities? Steffen

7 7

Re: [suse-security] Imesh/ICQ/Napster/Ms-Messager ports & protocols to BLOCK ???
by andre.doehn＠econia.com 12 Jun '01

12 Jun '01

ICQ: client -> server uses port udp 4000 client -> client uses portrange tcp 1024 - 65535 Nabster Ports: TCP 8875 - Napster Login TCP 4444 - Napster Server 1 TCP 5555 - Napster Server 2 TCP 6666 - Napster Server 3 TCP 7777 - Napster Server 4 TCP 8888 - Napster Server 5 TCP 6699 - Napster Transfer sugesstion: why you dont lock down all network services at first time (when setting up a firewall) and than open all the services you need? bye andre Linux - User <linux(a)ods.co To: suse-security(a)suse.com .cr> cc: suse-linux-e(a)suse.com Subject: [suse-security] Imesh/ICQ/Napster/Ms-Messager ports & protocols to 12.06.2001 BLOCK ??? 17:17 Hi !! does any one know the protocols or the ports that use: iMesh Napster Ms- Messager ICQ I need URGENT to block all of this software on the network -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [SLE] searching for good WINDOWS security list
by Rick Green 12 Jun '01

12 Jun '01

> >From A_Johnson-SuseML-e to suse-security(a)suse.com, suse-linux-e(a)suse.com,...: > > > PS I know I can set up my linux box to sniff at my windows box... how would > > I do a thing like that. I was hoping to have a direct link from the WIN to > > the LINUX for the task...what do I use on the linux box? nmap? I read about > > that someplace...any other tools? Thaanks... I kinda like 'ethereal'. Not only does it sniff traffic on your local ethernet, but it does a great job of parsing and explaining it as well. It runs under 'X'. One note, a catch-22 I found. In order to put the interface into promiscuous mode, it has to run as root. But since root doesn't 'own' the X server, it couldn't open a window! Somebody finally told me about sux - it works like su, but also allows root to run X applications. -- Rick Green "I have the heart of a little child, and the brain of a genius. ... and I keep them in a jar under my bed"

4 3

No Directory Listing after Firewall installation
by Mark Kessler 12 Jun '01

12 Jun '01

Hi, I have installed a Suse Linux Router with a Firewall and Masquerading . I am using a DSL connection. Everything works fine but I experience a problem when I am connnecting to a Windows 2000 Server through FTP, either from a computer behind the firewall and also direct from router. Connection is no problem but when I try directory listing I encounter problems when I am in the second level of the directory structure (e.g. Root Directory is / then I cannot list the content of directory /Web/Documents). The firewall ist open for both ftp and ftp-data from internal networks and the variables FW_ALLOW_INCOMING_HIGHPORTS_TCP and FW_ALLOW_INCOMING_HIGHPORTS_TCP are also set to "yes". Any Ideas where this problem could originate? Best Regards, Mark Kessler Mark Kessler, R&D Department Ach & Krach Verlag GmbH Friedensallee 7-9, 22765 Hamburg Tel. 040/399077-50, Fax. 040/39907759

1 0

Re: [suse-security] Harden-SuSE 3.4
by Bjoern Engels 12 Jun '01

12 Jun '01

Am Montag, 11. Juni 2001 17:26 schrieb Douglas J. Hunley: > I came into this late.. where can I get this script? thanks! Get it at http://www.suse.de/~marc/SuSE.html > Douglas J. Hunley (Linux User #174778) Bjoern

1 0

Post-attack advice
by Chris Quinn 12 Jun '01

12 Jun '01

Greetings: Last night my oldest (2.2.13) SuSE Linux box was attacked. Ironically, I was shelled in from another machine working on setting up a firewall script on this machine when the attack occurred. I noticed an un usual amount of network traffic and looked over the log files to discover that scanlogd was reporting repeated port scans from 10-15 foreign IPs. I have seen this sort of thing before and was not terribly concerned until text was printed to my terminal console. I then noticed that /etc/motd had been modified and became very concerned. Although a firewall was not running when the attack occurred, most services (except ssh, http, pop3, smtp and ftp) were disabled, tcp wrappers were configured, hosts.deny and hosts.allow were configured, etc. I have been pretty good about updating packages as security announcements were made. I looked at all recently modified files and ran tripwire but could find very little changes. I believe that a directory was created ("/usr/lol" I think) and /etc/motd was changed. Also, ports were open that I don't recall being open before: 6711 and 31965. I don't know what services use these ports. I am a Linux security novice and would appreciate feedback regarding 1) how this attack may have been accomplished and 2) what I should do to secure this box. I am working on configuring a firewall script but am afraid I might miss some security flaws created by the attackers. Any advice would be appreciated. Thanks. Chris Quinn

7 8

Re: [suse-security] Ethernet Gateway from 3Com
by jmars＠sears.com 11 Jun '01

11 Jun '01

I have used the Linksys 4-way with no problems. If you consider it works as a 4 way 10/100 mbit hub in addition to being a firewall it has been rather handy. It saves on space and I suspect power consumption. I set up the Lan with static IP addresses and left the DHCP client up on the WAN side. If you do not have a hub already I would definitely consider it. Rick Green <rtg(a)mich.com To: Markus Kohli <kohli(a)dplanet.ch> > cc: suse-security(a)suse.com Sent by: Subject: Re: [suse-security] Ethernet Gateway from 3Com rtg(a)aapsc.com 06/07/01 10:45 PM On Thu, 7 Jun 2001, Markus Kohli wrote: > Hi people! > > Maybe this is off-topic, but it's although very much security relates, so I > ask this anyway... > Does anybody of you have any experiences with the Ethernet Gateway 3C510 > from 3Com? > It has 4 RJ45 ports, a printer-server (windows) and so on... > They say, it has a firewall built-in, and it is easy to configure. > Would this be the solution to my problem of wanting to connect 3 pc's > (actually 2 desk and 1 lap) to a cable-modem? > An important point is, that the modem remembers the MAC-Adress of a network > device, it is connected to, so if I wanna change PC, I have to reset the > modem :( > > Any help would be greatly appreciated > > > kind regards > > Markus I'm not familiar with the 3Com product you mention, but I have successfully used the Linksys "Etherfast Instant Broadband" router/hub on two different cable systems. It supports DHCP or PPPoe on the WAN side, NAT, a DHCP server on the LAN side, and some minimal port forwarding capabilities. (No print server that I'm aware of...) Of the three installations I am aware, it has been rock-solid reliable. I've used the 4-port model, but I understand it's also available in one-port, eight-port, and 802.11b versions. I've also accomplished the same functionality (and more!) using a surplus 486-66, 16MB of RAM, two NICs, a single floppy drive, and a copy of freesco (www.freesco.org). For my own use, where surplus hardware is available and appearance isn't important, freesco was my choice. For a client who's paying for my time as well as the hardware, the Linksys at $129 was hard to beat. -- Rick Green "I have the heart of a little child, and the brain of a genius. ... and I keep them in a jar under my bed" -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

openssh-2.9
by Roman Drahtmueller 11 Jun '01

11 Jun '01

Hi together, openssh packages will show up on the ftp servers at the usual location (before 7.1 -> ftp.suse.de, after + including 7.1 -> ftp.suse.com). If you like, try them out. The packages contain a fix for the recently found problem that all files called "cookies" can be deleted, in addition to half a ton of more problems that have been corrected. As usual, the packages are gpg-signed. Something administrative: The list currently only operates with the address suse-security(a)suse.com, suse-security(a)suse.de does _NOT_ work. Mads M. Joergensen + Christopher Mahmood will have a look at this. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

5 6

Very strange mail
by Nash Hoogwater 11 Jun '01

11 Jun '01

Hi list, I got some very strange mail a few minutes ago and a week ago also. Maybe someone can help me with this. The mail doesn't contain a reply-adres, subject and almost no headers. The date is 1 january 1970 00:59:59. I have pasted the headers and text below. The text is also very strange as you can see. ------------------------------------------------- Content-Type: Status: R X-Status: N 1 3b13ce2000000001 2 3b13ce2000000002 ---------------------------------------------------- Someone??? Any idea??? Greetings, Nash

3 6

Harden-SuSE 3.4
by Bjoern Engels 11 Jun '01

11 Jun '01

Hi, I just installed 7.2 on my box (very good work, SuSE - as far I can say that after having seen it for 2 hours or so !) and I wanted to harden the box with Marc's script. Unfortunately, I'm having the following problems when executing the script: spock:/home/download/SuSEsec/harden_suse-3.4 # perl -w harden_suse-3.4.pl Bareword found where operator expected at harden_suse-3.4.pl line 284, near "m/IPPL || m/ARGUS" syntax error at harden_suse-3.4.pl line 284, near "m/IPPL || m/ARGUS" syntax error at harden_suse-3.4.pl line 287, near "} else" syntax error at harden_suse-3.4.pl line 291, near "} else" syntax error at harden_suse-3.4.pl line 299, near "}" Execution of harden_suse-3.4.pl aborted due to compilation errors. I'm not good in Perl, so does anybody of you have an idea ? Bjoern

2 2

RE: [suse-security] understanding packet filtering
by Reckhard, Tobias 11 Jun '01

11 Jun '01

Hi Togan, > I am trying to understand packet filtering and I am lost in what I am > reading. Quoting from page 217 of Building Internet firewalls on > allowing inbound and outbound SMTP and nothing else as the example. > > It says as follows > > Rule Direction Source Dest Proto Destport Action > ====================================================================== > A in Ext Int tcp 25 Permit > B out Int Ext tcp >1023 Permit > C out Int Ext tcp 25 Permit > D in Ext Int tcp >1023 Permit > E Either any any any any Deny > You need to understand the tables in the book first. As the enumeration following the tables above in the book, rules A and B apply when you have an internal mail server that accepts SMTP from external networks. Rule A says to permit inbound TCP packets from external sources to port 25 on internal destinations (or one destination in most cases). Rule B allows for the packets flying the other way within one TCP 'session'. You could attempt to apply further qualifiers to the rule outlines in B such as demanding the ACK bit or making it a stateful rule. Rules C and D are necessary when mail is transferred from internal hosts to external servers via SMTP. And rule E specifies to drop anything that isn't handled otherwise. Which combination of rules *you* need depends on your setup. Most private users and SOHO setups don't run an SMTP server that's available to the Internet, their email goes to their ISP, a server of his is specified in the domain's MX record. So they require only rules C and D, but not A and B. They might also use their ISP's SMTP server as a smart host and have their internal mail server be the only internal host sending mail. In a setup like that, 'internal' and 'external' in the rules above equate to 'internal mail server' and 'ISP's mail server' respectively. > Now based on the explanations I came out with this ipchains rule but I > am not sure if it it correct or not > > IPC=/sbin/ipchains > $IPC -P Deny -l > $IPC -A in -s Ext -d Int -p tcp --sport 1023: --dport 25 -j ACCEPT > $IPC -A out -s Int -d Ext -p tcp --sport 25 --dport 1023: -y -j ACCEPT > $IPC -A out -s Int -d Ext -p tcp --sport 1023: --dport 25 -j ACCEPT > $IPC -A in -s Ext -d Int -p tcp --sport 25 --dport 1023: -y -j ACCEPT > $IPC -b -s 0/0 -d 0/0 -j DENY > > Am I on the right track or completely away ? > You're moving in the right direction. Here are the mistakes you're making: * The default policy rule syntax is wrong, as has been pointed out already. It should be: ipchains -P input DENY ; ipchains -P output DENY ; ipchains -P forward DENY or a subset thereof. * The names of the built-in chains are input, output and forward, in and out don't exist. * To specify ports above 1023, use '1024:', not '1023:'. ipchains uses inclusive port ranges. * The last rule won't work, as it doesn't specify a chain. The kernel processes the chains for every packet that enters an interface (input), exits an interface (output) or is moved between interfaces (forward). Note also that the rules above will work when applied on the SMTP server or client respectively, *not* on a packet filter sitting between the internal and external networks, *unless* the default policies for input, output and forward are set to accept. In ipchains (or rather, the kernel code that is configured with ipchains), packets travel in the following manner: Network -> [INPUT] -> [FORWARD] -> [OUTPUT] -> Network | ^ +---> local process-----+ So, any packet entering the box traverses at least the input chain. If the packet needs to go to a different interface than the one it entered on, it goes through the forward chain. If a packet needs to go to the network, it goes through the output chain. So, for a packet filter sitting between two networks, you need to make sure your packets make it through all three chains. Note that this has been modified in the 2.4 kernel packet filtering code, which is configured with the iptables tool. Here, only packets bound to or coming from local processes traverse the input and output chains, while traffic routed by the system only go through the forward chain. This is all disregarding the NAT table, BTW. Hope to have helped a bit, sure to have confused... :-/ Tobias

2 1

SuSEfirewall(1) and SuSEfirewall2
by marc＠suse.de 11 Jun '01

11 Jun '01

Hi folks! I am happy to announce that SuSEfirewall2 is now ready for world-wide realiable beta/gamma testing! The code is much more secure than SuSEfirewall(1) because of the change in code and possibilies, and now with the newest 2.4 kernel version the firewall code seems finally to be reliable. So everyone: now is the best time to change from SuSEfirwall to SuSEfirewall2 for better security and faster rule chains. btw if you sometimes change between SuSEfirewall(1) and 2 because you use both, 2.2 and 2.4 kernels, just install SuSEfirewall-4.7 - and SuSEfirewall will start only in 2.2 mode and if in 2.4 mode SuSEfirewall2 is not configured to run. For harden_suse users: download v3.4 for use with SuSE 7.2. Changelog for SuSEfirewall2 1.0: v1.0 10.06.01 GAMMA -> believe it or not - v1.0 is ready to go and should work perfectly for everyone! :-) * Added the new ip-up script which supports SuSE-personalfirewall, SuSEfirewall(1) and SuSEfirewall2 * Added a patch by <martin.schulz(a)videotron.ca>, which fixes some error checking - thanks! * Added loading of a kernel module which is necessary for active ftp (thanks to christian.ernst(a)informatik.fh-hamburg.de) * Added support for devices with no broadcast address (e.g. ipsec stuff) * Autoprotecting mode supports ipv6 global bindings (:::1) now * Fixed a bug in the UDP autoprotecting mode support * Removed TOS stuff for ICMP - resulted in no ping packets being sent. Seems to be a kernel bug :-( netfilter still sucks ... * Updated the documentation * Added bootp config support for interfaces * Added a small README and a converted EXAMPLES file Changelog for SuSEfirewall 4.7: v4.7 .06.01 (gamma release) * added auto service detection for IPv6 services * added support for ipsec and other devices without a broadcast address * if running with a 2.4 kernel, the boot scripts check if SuSEfirewall2 is installed and won't run if detected. This provides you with optimal security and transparent SuSEfirewall* support! :-) Changelog for harden_suse: v3.4 10.06.01 (gamma release) * wont disable some special SuSE 7.2 stuff: CRYPTO_FILESYSTEMS IDLED, POWERTWEAKD, PPTPD, IJB, IPPL, ARGUS, etc. v3.3 06.05.01 (gamma release) * wont disable SNORT, ADSL, NESSUSD and many many other things now which either do not affect security or are security daemons * added LICENCE file (required by SuSE policy) * added special warning about tcp wrapper setup and it effects on sshd v3.2 07.04.01 (gamma release) * added MD5 passwords * changed the undo script creation, after running undo, the log and undo files are not deleted but renamed Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

RE: [suse-security] Getting apache to stop displaying banner on e rrors.
by Björn Engels 10 Jun '01

10 Jun '01

You should consider to also use this one: ServerTokens This directive controls whether Server response header field which is sent back to clients includes a description of the generic OS-type of the server as well as information about compiled-in modules. ServerTokens Prod[uctOnly] Server sends (e.g.): Server: Apache ServerTokens Min[imal] Server sends (e.g.): Server: Apache/1.3.0 ServerTokens OS Server sends (e.g.): Server: Apache/1.3.0 (Unix) ServerTokens Full (or not specified) Server sends (e.g.): Server: Apache/1.3.0 (Unix) PHP/3.0 MyMod/1.2 Bjoern

1 0

Re: [suse-security] Slow adsm backup with Suse-firewall
by Alexander Grujic 10 Jun '01

10 Jun '01

Am Donnerstag, 7. Juni 2001 09:27 schrieb Robert Davies: > I don't know what adsm backup is but I haven't noticed any respondes, I'll > make some general observations. adsm is a commercial multi-platform backup suite with server and client side. > > I have set up a firewall (susefirwall 4.3) between the internet and our > > internal network. One thing I have noticed is that the backups have > > slowed down by a factor of 10 ! > > With a non-trivial ipchains ruleset I still had an ftp throughput of > 10MByte/s on 100Mb/s network. Can you check your basic ftp throughput? ftp throughput is nominal ( 1-3 Mbyte/s ). Http seems ok too. Thats whats bugging me, it seems specific to the backup. The hardware should be more than up to the task, the computer used is a dual pentium 200Mhz system. The load on the system is never higher than 0.3. > Have your NICs managed to negotiate the network speed down from Fast to > Good ole' Ethernet? Anything new go into a non-switched 100Mb/s Fast > Ethernet network that could cause fallback to 10Mb/s? How could I check that ? (Sorry for this stuipid question ) > > adsm needs port 1500 and uses a tcp buffersize of 16k. One thing I > > noticed > > is > > > the both interfaces show many collisions. This is the output of ifconfig > > By my calculations your collision rate is insignificant (< 0.5%) 11896 * > 100 / 2487098, however to get meaningful results you need to make the > calculation : > > (Cf - Ci) * 100 / (Tf - Ti) <= r% > > Where Cf and Tf are the final collisions and transmissions, Ci and Ti are > initials, and r% is the acceptable collision rate. Note initials at > beginning of backup run, and finals at end. > > Your error rate seems somewhat high, but again as a percentage it is rather > low. One thing i have noticed is that the error rate grows faster (faster as in errors per transmitted packet not error per timeunit) during backup then during normal operation of the firewall. > If your tcp window size is not large, then you may be dependant on the > round trip times, Novell Netware was very prone to this problem in early > versions, whereas a modern TCP/IP implementation will perform fairly well > on a 'long' but 'broad' pipe. > > > the adsm backup machine is in the external network, connected via a > > 100Mbit > > > ethernet card and the machines that are backed up are in the DMZ, also > > connected via a 100Mbit ethernet card. > > This strikes me as being rather peculier, backup is mish critical, I've > often built 'server' backend networks linking machines in the DMZ specially > for backups, to do them to an 'external' network, rather than an internal > one seems strange. The backup of our departments computers are done by a central authority of our university. I have no influence on the location (neither physical or in adress space) of the backup machine :-(. > That said, how are you buffering your tape drive? Many drives slow > considerably if you cannot match their streaming rate, there is a command > 'buffer' in the non-x application series, which allows efficient buffering, > and with a high -p %, and a large size -s 16M, you can ensure the drive > will be driven at it's streaming rate. I have no information on the hardware used to backup the data, but will check on that. But before installation of the firewall the backup speed was approx. 2 Mbyte/s now it has slowed down to a few hundred kbytes/s. Thanks for the help, Alex.

1 0

understanding packet filtering
by Togan Muftuoglu 10 Jun '01

10 Jun '01

Hi, I am trying to understand packet filtering and I am lost in what I am reading. Quoting from page 217 of Building Internet firewalls on allowing inbound and outbound SMTP and nothing else as the example. It says as follows Rule Direction Source Dest Proto Destport Action ====================================================================== A in Ext Int tcp 25 Permit B out Int Ext tcp >1023 Permit C out Int Ext tcp 25 Permit D in Ext Int tcp >1023 Permit E Either any any any any Deny Now based on the explanations I came out with this ipchains rule but I am not sure if it it correct or not IPC=/sbin/ipchains $IPC -P Deny -l $IPC -A in -s Ext -d Int -p tcp --sport 1023: --dport 25 -j ACCEPT $IPC -A out -s Int -d Ext -p tcp --sport 25 --dport 1023: -y -j ACCEPT $IPC -A out -s Int -d Ext -p tcp --sport 1023: --dport 25 -j ACCEPT $IPC -A in -s Ext -d Int -p tcp --sport 25 --dport 1023: -y -j ACCEPT $IPC -b -s 0/0 -d 0/0 -j DENY Am I on the right track or completely away ? TIA -- Togan Muftuoglu

2 2

Getting apache to stop displaying banner on errors.
by JW 09 Jun '01

09 Jun '01

Hello, By default apache shows it's "name and number" on 404 pages (probably others too): Apache/1.3.14 Server at asdf.com Port 80 I'd like to get rid of that. What's the proper way to remove that? I'd like to have it just give the webmaster@ email address without divulging any info ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

6 5

IPv6 und Firewall-Probleme
by Nicolas Keller 09 Jun '01

09 Jun '01

Hallo! Ich hoffe, ich habe mit diesem Problem die richtige Mailingliste (und Sprache?) getroffen - wenn nicht, sorry! Ich habe seit vorgestern SuSE 7.2 installiert und einige Mühe gehabt, unter dem Kernel 2.4 einen Masquarading Server aufzusetzen. Mittlerweile läuft er zufriedenstellend - dank dem SuSEfirewall2 Skript. Trotz allem habe ich noch Probleme: Zuerst einmal die Ausgabe beim Starten von TDSL und der Firewall beim booten: ******************* dmesg ********************* eth1: NE2000 found at 0x340, using IRQ 5. PPP generic driver version 2.4.1 SuSE-FW-UNALLOWED-ROUTINGIN=eth0 OUT=ppp0 SRC=194.127.177.80 DST=212.227.126.138 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=32210 DF PROTO=TCP SPT=2256 DPT=110 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) IPv6 v0.8 for NET4.0 IPv6 over IPv4 tunneling driver Registered PPPoX v0.5 Registered PPPoE v0.6.5 Installing knfsd (copyright (C) 1996 okir(a)monad.swb.de). eth0: no IPv6 routers present eth1: no IPv6 routers present eth0: no IPv6 routers present eth1: no IPv6 routers present SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=194.25.2.129 \ DST=217.84.122.54 LEN=132 TOS=0x00 PREC=0x00 TTL=60 \ ID=6059 PROTO=UDP SPT=53 DPT=1028 LEN=112 SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=217.5.115.7 \ DST=217.84.122.54 LEN=132 TOS=0x00 PREC=0x00 TTL=56 \ ID=1892 PROTO=UDP SPT=53 DPT=1027 LEN=112 SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=64.245.54.152 DST=217.84.122.54 \ LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=46764 DF PROTO=TCP SPT=3718 \ DPT=41178 WINDOW=32120 RES=0x00 SYN URGP=0 \ OPT (020405B40402080A06D425BB0000000001030300) SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=64.245.54.123 DST=217.84.122.54 \ LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=45093 DF PROTO=TCP SPT=4397 \ DPT=41178 WINDOW=32120 RES=0x00 SYN URGP=0 \ OPT (020405B40402080A06E98CE30000000001030300) ******************* dmesg ********************* 1. Warum bekomme ich SuSE-FW-UNALLOWED-ROUTINGIN, SuSE-FW-UNALLOWED-TARGETIN und SuSE-FW-ACCEPTIN Meldungen? Stimmt da etwas nicht? SuSE-FW-ACCEPTIN kenne ich noch von der 1er Version des Firewall-Skripts, aber die zwei anderen Meldungen sagen mir leider nichts. 2. Wie bekomme ich die Meldungen wie "eth0: no IPv6 routers present" weg? Ist das überhaupt "schlimm"? 3. Ich bekomme keine Verbindung zu meinem Apache Server - anscheinend kann der Server den Namen nicht auflösen. Alle Namensauflösungen sind aber korrekt in der hosts Datei eingetragen und die search Variable ist auch gesetzt. (Da ich das schon ein paar mal gemacht habe und mir eigentlich sicher bin, dass es kein einfacher Konfig-Fehler ist tippe ich mal auf das ("eth0: no IPv6 routers present"?) Sorry für die vielen Fragen, aber trotz drei Jahre langer SuSE Erfahrung stehe ich da ziemlich im Regen. Vielleicht noch kurz eine Erklärung zum Szenario: Ich habe einen SuSE 7.2 Server mit zwei Netzwerkkarten (eine Realtek und eine NE2000 komp). eth0 geht ins interne Netz und eth1 zu meinem TDSL Modem. Ich habe bis auf das firewall2 Skript nur Pakete benutzt, die bei SuSE 7.2 dabei waren. Nebenbei läuft auf dem Server noch Apache und Squid (wobei man sich hier natürlich dann streiten kann, ob ich Squid brauche wenn ich Masquarading mache). Als Anhang gibt's noch meine rc.firewall2.conf. Schon mal dank an alle Helfer :) & ein schönes Wochenende! Nicolas Keller ******************* firewall2.rc.config ******************* FW_DEV_EXT="ppp0 eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="194.127.177.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_ALLOW_CLASS_ROUTING="no" #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config"

2 1

The new OpenSSH2
by StarTux 09 Jun '01

09 Jun '01

Hi, Just upgraded to the new OpenSSH 2.9 and encountered what I believe is a problem loading the SSH2 part. I get this when reloading the SSH daemon: Starting SSH daemonDisabling protocol version 2. Could not load host key I assume that is because under /etc/ssh/ I do not have ssh_host_key2 key, if this is the case, how do I generate one? Thanks, Matt -- "The only thing complex about Linux are the users themselves."

4 4

New OpenSSH2 fatal error
by Togan Muftuoglu 09 Jun '01

09 Jun '01

I have installed it via Yast on a machine when harden_suse was applied. when I issue the rcssh start comamnd all I am getting back is fatal: cannot bind any address Where do I check -- Togan Muftuoglu

1 0

administrativa
by Roman Drahtmueller 08 Jun '01

08 Jun '01

Hi together, our mailing list server has been rebuilt by Mads Martin Joergensen and Christopher Mahmood on new hardware. We are expecting more performance on our mailing lists as well as better scalability. The two guys have done a nice job at it. If there are any problems, feel free to report them to suse-security-owner(a)suse.de. As of a few minutes ago, the list address suse-security(a)suse.com was the only one that worked. The German list address (suse-security(a)suse.de) should work now for all, thanks to mmj. In addition to the technical news I wanted to ask the community to stronger adhere to the list purpose: If something is security-related, then feel free to ask, if it is not, then please let it be. There is no need to excuse oneself for posting to the list as long as the message fits the purpose of the list. It may be wise to simply ignore messages that do not target security in general or Linux security in particular. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Re: [suse-security] Ethernet Gateway from 3Com
by Bill Light 08 Jun '01

08 Jun '01

Before going to far......I would check out the following link, apparently 3Com is leaving that business..... that old 486 is looking pretty good..... I'd check out 3Com's own site, a press release entitled: "3Com Discontinues Consumer Cable and DSL Modems, Gives Guidance for Q4, FY01 Results" at: http://www.3com.com/corpinfo/en_US/pressbox/press_release.jsp?INFO_ID=20032… - Bill

1 0

diff between tircproxy and ip_masq_irc
by Togan Muftuoglu 08 Jun '01

08 Jun '01

Hi everyone, I am reading Building Internet Firewalls as my assigned homework by the list (OK studying and taking notes to create more questions for the gurus in this list)for irc they also suggest using "tircproxy". Appreantly this is not in the SuSE 7.1 (maybe I have overlooked). What I would like to know is what are the pros and cons of tircproxy compared to ip_masq_irc from the point of security and ease of configuring and stability TIA -- Togan Muftuoglu

1 0

test: ignore
by Christopher Mahmood 08 Jun '01

08 Jun '01

1 0

Cipe and ipchains
by Guido Tschakert 08 Jun '01

08 Jun '01

Hello List: I'am trying to set up a Router with cipe and packetfiltering. "Routing" should be done by using the forward-chain. One question is: where took the cipe-Deamon place? Beetween input- and forward-chain or beetween forward- and output-chain or behind the output-chain or before the input-chain. I believe ciped is beetween forward- and output-chain. but I wouldn't bet on it ;-) Or Do you think it's bad to use ipchains and ciped together on one machine? THX Guido -- ----------------- Guido Tschakert SRC GmbH, SysAd -----------------

1 0

RE: [suse-security] simple gateway
by Stefan_Walther＠gehag-dsk.de 08 Jun '01

08 Jun '01

> hi, > > I have quite a stupid question.... i set a suse 7.0 box as a gateway between a token ring network and a born-and-growing ethernet network.... it's > inside our lan and we're working with private adresses. One of the subnetwork is 192.168.0.x (the token > ring) and the ethernet subnetwork is 192.168.100.x... The gateway hosts 2 nics, one token ring and one ethernet. So far the gateway runs quit good, > but not good enough because i have internet adresses that are visible from a box before my gateway, and not > after my gateway.... > > I used ipchains in order to say "everything that comes and goes can cross", but actually, it does not.... what have I missed ? > > ip_forward is enabled > i added the token ring adress as gateway to the ethernet nic > and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ > > as it is inside our network, I don't want any filter to be active... i just want everything to pass through the gateway back and forth. > > I certainly have missed something important but what ?... > > TIA > Stephane > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com There is some other possibility you can try. We also have a router for tokenring and ethernet. if you dont want to add the route to your ethernet/tokenring (don't know where your internetrouter is connected to) you can have to enable ip-forwarding and add the following line to the ip-chains rules: ipchains -A forward -i <interface where you want to route> -s <sourcenet, where the packets come from> -j MASQ maybe you have to add this in both directions. we did it until we had to reconfigure the router where we add the direct routes. both is working fine, but if you use my suggestion you have problems by using any ftp-connection. the better possibility is given by Andreas Baetz. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

Re: [suse-security] simple gateway
by Andreas Bätz 08 Jun '01

08 Jun '01

On Thursday 07 June 2001 18:31, stephane parenton wrote: > So far the gateway runs quit good, but not good enough because i have > internet adresses that are visible from a box before my gateway, and not > after my gateway.... > > I used ipchains in order to say "everything that comes and goes can cross", > but actually, it does not.... what have I missed ? > > ip_forward is enabled > i added the token ring adress as gateway to the ethernet nic > and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j > MASQ If you don't want masquerading, you probably should do: "ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j ACCEPT" or just "ipchains -P forward ACCEPT" without any further rules > as it is inside our network, I don't want any filter to be active... i just > want everything to pass through the gateway back and forth. If you don't want any filter, you could also do echo 1 > /proc/sys/net/ipv4/ip_forward 2> /dev/null ipchains -P input ACCEPT ipchains -P output ACCEPT ipchains -P forward ACCEPT or completely go without any ipchains rules (forwarding needs to be turned on, though) Also you could check if the routing from and to your ethernet is known by all other routers in your net. (especially, in your case, your router to the internet) Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Re: [suse-security] APOP - help
by Peter Nixon 08 Jun '01

08 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 08:51 PM 7/06/2001, you wrote: >Hi All > >I'm running SuSE 6.4 and I have installed the SuSE 7.0 POP.RPM on my SuSE >6.4 installation. > >I ran "popauth -init" to create the popauth.DB. > >When I try to download pop3 mail using Secure Password Authentication with >Outlook Express 5 as the mail client it fails with the following errors. > >popper[18243]: @warrior.bidorbuy.co.za: -ERR Too few arguments for the auth >command. >popper[18243]: @warrior.bidorbuy.co.za: -ERR POP EOF received > >Q. Do u still need to recompile popper or does it work straight away without >recompiling? SPA != APOP :-( >Q. Can you use "Secure Password Authentication" with POP3s (i.e. PoP3 with >SSL port 995) or > Can you only use one or the other, but not both? See above. >Q. Is the user name and password encrypted when using POP3 with SSLWRAP? Yes.. SSLwrap is very simple to setup in this manner, I have been meaning to add it to the FAQ, but have been too busy. Mail me if you need help with this.. -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBOyAnBQHHbFLfaSY8EQJq6gCg38mBtYVN9BQ0LrEgTIRQzdEZsdAAoKdN PfHwo6CxrnDPT0F+SF2D7noZ =QEjd -----END PGP SIGNATURE-----

1 0

security problem?
by jonathan 08 Jun '01

08 Jun '01

Tonight this popped up in the log file, could someone help me here. Is this someone trying to flood me or is it something else? Thanx! Jun 7 21:11:08 gumby kernel: NET: 1 messages suppressed. Jun 7 21:11:08 gumby kernel: neighbour table overflow Jun 7 21:11:12 gumby kernel: NET: 1 messages suppressed. Jun 7 21:11:12 gumby kernel: neighbour table overflow Jun 7 21:11:20 gumby kernel: NET: 2 messages suppressed. Jun 7 21:11:20 gumby kernel: neighbour table overflow

1 0

Question about security check message
by JW 07 Jun '01

07 Jun '01

Howdy, I was just reading my system mail and saw the following: The following devices were added: + ++ /var/lib/secchk/data/devices.new Mon May 28 01:44:41 2001 - crw--w---- root tty 4, 1 /dev/tty1 + crw-rw---- root tty 4, 1 /dev/tty1 What exactly is that? I've never seen anything like that before. What causes that, a direct login to the console? ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

2 1

APOP - help
by Steven Thompson 07 Jun '01

07 Jun '01

Hi All I'm running SuSE 6.4 and I have installed the SuSE 7.0 POP.RPM on my SuSE 6.4 installation. I ran "popauth -init" to create the popauth.DB. When I try to download pop3 mail using Secure Password Authentication with Outlook Express 5 as the mail client it fails with the following errors. popper[18243]: @warrior.bidorbuy.co.za: -ERR Too few arguments for the auth command. popper[18243]: @warrior.bidorbuy.co.za: -ERR POP EOF received Q. Do u still need to recompile popper or does it work straight away without recompiling? Q. Can you use "Secure Password Authentication" with POP3s (i.e. PoP3 with SSL port 995) or Can you only use one or the other, but not both? Q. Is the user name and password encrypted when using POP3 with SSLWRAP? All tips welcome. Thanks in Advance Steven Thompson

2 1

RE: [suse-security] Post-attack advice
by Chris Quinn 07 Jun '01

07 Jun '01

>It's very common for a box that's been broken into to run some service on a >non-standard port, to allow login to the intruder, preferably without >showing up in records used by w(1) and last(1), or logging via syslog. Robert: Thank you for your reply. You are correct: I did some more snooping and was able to determine that a SSH daemon (an older version than I have running on port 22) is answering on port 31965. I have tried "netstat -anp | grep 31965" but that provides no information. It looks like I have some work to do this weekend. Despite all of the helpful replies from list members, I remain confused about how this occurred. Because this machine is located on my home LAN, I believe that a local compromise is unlikely. Chris Quinn

3 2

simple gateway
by stephane parenton 07 Jun '01

07 Jun '01

hi, I have quite a stupid question.... i set a suse 7.0 box as a gateway between a token ring network and a born-and-growing ethernet network.... it's inside our lan and we're working with private adresses. One of the subnetwork is 192.168.0.x (the token ring) and the ethernet subnetwork is 192.168.100.x... The gateway hosts 2 nics, one token ring and one ethernet. So far the gateway runs quit good, but not good enough because i have internet adresses that are visible from a box before my gateway, and not after my gateway.... I used ipchains in order to say "everything that comes and goes can cross", but actually, it does not.... what have I missed ? ip_forward is enabled i added the token ring adress as gateway to the ethernet nic and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ as it is inside our network, I don't want any filter to be active... i just want everything to pass through the gateway back and forth. I certainly have missed something important but what ?... TIA Stephane

1 0

Probably OT dumb ?
by Mark Hounschell 07 Jun '01

07 Jun '01

The command "last" showed the following entries: ftp ftp cx441045-b.ports Tue Jun 5 00:02 - 00:02 (00:00) ftp ftp adsl-64-222-16-9 Mon Jun 4 21:35 - 21:35 (00:00)] ftp ftp 211.200.28.16 Tue Jun 5 06:33 - 06:33 (00:00) ftp ftp APerpignan-101-1 Tue Jun 5 20:18 - 20:19 (00:00) Does this look like people just accidentally got the wrong ip address when they tried to ftp somewhere??? Or has somebody actually ftp'd into this box. I'm basically ignorant when it comes to security. Thanks -- Mark Hounschell dmarkh(a)cfl.rr.com

2 4

Re: [suse-security] Probably OT dumb ?
by christian.haefke＠econ.upf.es 07 Jun '01

07 Jun '01

Dear Mark, I can assure you it was not accidental. Tonight I had the same IP-address (211.200.28.16) trying to get into my computer and also my notebook and probably quite a few more machines on our network. Sorry for the bad news, Christian dmarkh(a)cfl.rr.com wrote: > > The command "last" showed the following entries: > > ftp ftp cx441045-b.ports Tue Jun 5 00:02 - 00:02 (00:00) > ftp ftp adsl-64-222-16-9 Mon Jun 4 21:35 - 21:35 > (00:00)] > ftp ftp 211.200.28.16 Tue Jun 5 06:33 - 06:33 (00:00) > ftp ftp APerpignan-101-1 Tue Jun 5 20:18 - 20:19 (00:00) > > Does this look like people just accidentally got the wrong ip address > when they tried to ftp somewhere??? Or has somebody actually ftp'd into > this box. I'm basically ignorant when it comes to security. > > Thanks > -- > Mark Hounschell > dmarkh(a)cfl.rr.com >

1 0

Slow adsm backup with Suse-firewall
by Alexander Grujic 07 Jun '01

07 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List ! I have set up a firewall (susefirwall 4.3) between the internet and our internal network. One thing I have noticed is that the backups have slowed down by a factor of 10 ! the adsm backup machine is in the external network, connected via a 100Mbit ethernet card and the machines that are backed up are in the DMZ, also connected via a 100Mbit ethernet card. adsm needs port 1500 and uses a tcp buffersize of 16k. One thing I noticed is the both interfaces show many collisions. This is the output of ifconfig : eth0 Link encap:Ethernet HWaddr 00:80:C8:4C:3F:1F inet addr:134.76.90.254 Bcast:134.76.90.255 Mask:255.255.255.0 inet6 addr: fe80::280:c8ff:fe4c:3f1f/10 Scope:Link inet6 addr: fe80::80:c84c:3f1f/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2573757 errors:0 dropped:0 overruns:0 frame:0 TX packets:2487098 errors:33900 dropped:0 overruns:3 carrier:33897 collisions:11896 txqueuelen:100 Interrupt:12 Base address:0xe000 eth1 Link encap:Ethernet HWaddr 00:80:AD:03:1C:A3 inet addr:134.76.249.89 Bcast:134.76.249.255 Mask:255.255.255.252 inet6 addr: fe80::80:ad03:1ca3/10 Scope:Link inet6 addr: fe80::280:adff:fe03:1ca3/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1925308 errors:8 dropped:0 overruns:8 frame:8 TX packets:2016065 errors:28270 dropped:0 overruns:0 carrier:0 collisions:1373 txqueuelen:100 Interrupt:10 Base address:0xd800 any help would be welcome. thanks, Alex. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7Hj48X1OUiCutGtcRAnGzAJ9/T9bwFK1ro/mDWEvjR2fhXg8LmwCfbRmY VtYswGQpM40ga2Qli652jUc= =SFz0 -----END PGP SIGNATURE-----

2 1

[suse-security]
by Markus Kohli 07 Jun '01

07 Jun '01

Hi People! I had a cable-modem installed yesterday, and now I'm looking for some good and easy tool to put up a firewall on my linux-laptop. Before I used ppp by modem, and I only had the ports for xwindow, ssh and cups open, but now I get the following from nmap: memphis:/home/kohli/downloads/rpms # nmap -sS localhost Starting nmap V. 2.53 by fyodor(a)insecure.org ( www.insecure.org/nmap/ ) Interesting ports on localhost (127.0.0.1): (The 1511 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 37/tcp open time 79/tcp open finger 80/tcp open http 110/tcp open pop-3 513/tcp open login 514/tcp open shell 631/tcp open unknown 901/tcp open samba-swat 6000/tcp open X11 Nmap run completed -- 1 IP address (1 host up) scanned in 1 second Why is that? I already reran harden_suse3.2, started a firewall with firestarter... nothing changes... could anybody help me? tia markus __________________________________________________________________________ The dark ages were caused by the Y1K problem.

2 1

windoze default gw and ie5 proxy config problem
by Philipp Snizek 06 Jun '01

06 Jun '01

Hi all, I have 1 windoze client accessing a squid proxy allwing pasv ftp connections. The client 10.0.0.180 is configured like this: default gw 10.0.0.191 proxy settings in ie5: 10.0.0.191 port 3128 for all protocols. the ftp conneting speed is painful slow. The windoze 2k box first tries to have ftp routed over 10.0.0.191, then it realizes (due to the rejected packtes which produces icmp dest unreachables) it has to use the proxy's port 3128. Then it connects after ages of waiting to the ftp server in pasv mode. Trying to change directory on a ftp server takes up to several minutes of waiting. In case I remove the default gw setting from win2k client's tcp/ip settings the ftp connecting speed is ok. How can I tell windoze 2k or ie5 to first take a look into ie5 proxy settings and if successless try to connect via routing? Anybody got an idea? Thank you Philipp

7 9

mod_ssl in 7.1 problem
by Vitaly Shishakov 06 Jun '01

06 Jun '01

Dear LIST! I have SuSE 7.1 with apache installed, and i desired to add there mod_ssl (package taken from FTP distribution). But when i attempt to launch apache, in ssl_engine log the following appears: [06/Jun/2001 20:23:58 32591] [info] Server: Apache/1.3.17, Interface: mod_ssl/2.8.0, Library: OpenSSL/0.9.6 [06/Jun/2001 20:23:59 32591] [info] Init: 1st startup round (still not detached) [06/Jun/2001 20:23:59 32591] [info] Init: Initializing OpenSSL library [06/Jun/2001 20:23:59 32591] [info] Init: Loading certificate & private key of SSL-aware server cmpd2.phys.msu.su:443 [06/Jun/2001 20:23:59 32591] [error] Init: Unable to read server certificate from file /etc/httpd/ssl.crt/server.crt (OpenSSL library error follows) [06/Jun/2001 20:23:59 32591] [error] OpenSSL: error:0D09F007:asn1 encoding routines:d2i_X509:expecting an asn1 sequence and server becomes unavailable. Could you please help me to solve this problem? Thank you in advance, SHiFT

2 2

Sorry
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Sorry to have sent 4 messages, but I did it from a webmail, and not reply when it pressed the button of send.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Webserver in DMZ
by jjaime＠ticket-accor.com.ar 06 Jun '01

06 Jun '01

Hi List, I have the following configuration : internet I SuseFW--Webserver(DMZ) I Lan That direction I must put in the BindAddress directive ? The one who corresponds to the DMZ or the direction public ? With the private direction it works, but the access from my LAN, with Squid (within the FW)is very slow. Thanks a lot.

1 0

Re: [suse-security] Re: Postdrop binary
by Corvin Russell 06 Jun '01

06 Jun '01

Hi Engelbert, The relevant portion of rpm -V postfix is: .M....G. /usr/sbin/postdrop .M...... /usr/sbin/sendmail .M...UG. /var/spool/postfix/maildrop I believe these changes are accounted for by changing to Maildir type delivery on ~/. IS that right? But that doesn't account for the date change noted earlier. > did you change permissions /etc/permission files and directories > could you run "rpm -V postfix" to verify postfix > or if you have time "rpm -Va" verifies the whole installation > which takes time. > -- Corvin Russell <corvinr(a)sympatico.ca>

2 1

Updated SuSE-Security-FAQ V 0.43
by Peter Nixon 06 Jun '01

06 Jun '01

Hi guys Just a quick note to remind anyone who is new to the List that we have a FAQ doc at http://www.susesecurity.com/faq/ I have also made a few minor changes to it. As usual, if anyone has any new sections, corrections, or updates please mail them to me, and I will add them. Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

1 0

Re: [suse-security] Could need some help to understand logMessage
by Maarten van den Berg 05 Jun '01

05 Jun '01

On Tuesday 05 June 2001 16:51, you wrote: > hello Maarten, > > > "Martian source" means the kernel received a packet that, according to > > routing table / netmask, cannot legally arrive there. This would > > happen, for instance, if you configured your network for 192.168.x.x > > and a packet claiming to be from 10.x.x.x arrived there, etc. Thus; a > > sanity-check. > > [...] > > > So, the message reads something like: > > "Unexpected, illegal packet claiming to be from 195.222.110.11 > > destined for 195.222.110.255 detected on eth0." > > thank you very much for your mail. This was very helpfull. > It kind of makes sense now. > 195.222.110.11_ is my IP if you add one more digit. > > As far as I understand this, there was a problem with an outgoing > packet? > Strange! I'm not sure, I don't know your network-setup. It could be someone is / was trying to do nasty stuff, but it could also be some misconfiguration or a hardware-glitch, or whatever. To find out more we'd need more info, like routingtables, the topology of your network / lan / whatever it is that you have, etc. But I'd prefer it -if you want to find out more- if you post that to the list, not private mail, so others may contribute too. Anyhow, glad to be of help, Cheers, Maarten

2 1

Could need some help to understand logMessage
by Phil Schrettenbrunner 05 Jun '01

05 Jun '01

Hello List, seeing my Windows Firewall (ZoneAlarm) going crazy because of a PingScan, I switched to my Linux PC (SuSE 7.1) and startet ethereal to see whats goging one. Seeing tons of ICMP Echo request packages I took a look at my /var/log/messages (which has grown up to 8 MB so far) and I found the following entries (all the same, each second for about 18 min) Jun 4 16:01:36 <myHost> kernel: martian source 0b6edec3 for ff6edec3, dev eth0 Jun 4 16:01:36 <myHost> kernel: ll header: ff ff ff ff ff ff 00 08 c7 ea 7b 85 08 00 And about every minute this: Jun 4 16:02:10 <myHost> scanlogd: <otherIP> to <myIP> ports 47557, 699, 1059, 387, 714, 1014, 654, ..., fSrpauxy, TOS 00, TTL 46 @16:02:10 (myIP and otherIP are public IPs) Still learing about how networks work, I understand 80% of whats going on here. But what does the "martian source" source mean? Could anyone give me a hint, please? Thank you very much. Regards, phil

6 6

RE: [suse-security] POP3 and SSLWRAP - help question - Fixed
by Steven Thompson 05 Jun '01

05 Jun '01

I got it working -----Original Message----- From: Steven Thompson [mailto:steven@bidorbuy.co.za] Sent: 04 June 2001 10:28 To: SuSE security mailing list (E-mail) Subject: [suse-security] POP3 and SSLWRAP - help question Hi All I have installed the POP.rpm off the SuSE 6.4 with SSLWRAP and OPENSSL. I have Updated the POP.rpm from SuSE site. I have created a normal user account ( no cyrus mail boxes). Pop3 acces is no problem. Retrieving pop3 mail via SSL is the problem. I have created my own Certificate, as shown in the README.SuSE (i.e) openssl req -config /usr/ssl/openssl.cnf -nodes -new -x509 -keyout my_cert.pem -out my_cert.pem -days 365 Inetd.conf setings: pop3s stream tcp nowait cyrus /usr/sbin/tcpd /usr/sbin/sslwrap -nocert 110 Mail Clients: Outlook Express and Outlook 2000. Q1. Do you leave the standard pop3 service running, but only allow connection from the localhost(127.0.0.1) or do u comment it out. Q2. When I try to fetch my pop3 mail via the ssl port there is connection to sslwrap service from the requesting host. Then there is connection to the popper service from the cyrus user to the localhost(127.0.0.1). After the cyrus user connection to localhost the mail client produces an error and is unable to retrieve the mail. Q3. When does my mail client have to have a certificate. In order for ssl to work. Q4. Are there any config files I have to tweak. All tips welcome. Thanks in Advance Steven --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

AW: [suse-security] windoze default gw and ie5 proxy config problem
by Philipp Snizek 05 Jun '01

05 Jun '01

> > Hi all, > > > > I have 1 windoze client accessing a squid proxy allwing pasv ftp > > connections. > > The client 10.0.0.180 is configured like this: > > default gw 10.0.0.191 > > proxy settings in ie5: 10.0.0.191 port 3128 for all protocols. > > > > the ftp conneting speed is painful slow. The windoze 2k box > first tries to > > have ftp routed over 10.0.0.191, then it realizes (due to > the rejected > > packtes which produces icmp dest unreachables) it has to > use the proxy's > > port 3128. Then it connects after ages of waiting to the > ftp server in pasv > > mode. Trying to change directory on a ftp server takes up > to several minutes > > of waiting. > > In case I remove the default gw setting from win2k client's > tcp/ip settings > > the ftp connecting speed is ok. > > > > How can I tell windoze 2k or ie5 to first take a look into ie5 proxy > > settings and if successless try to connect via routing? > Anybody got an idea? > > > Using a private address i think that u will never access by > routing, I don't want ie5 to access through the default gw. ie5 should only use it's proxy settings regardless of the default gw setting. > so it is unusefull taht you try to set the default > gateway, except the router don't have the NAT. NAT is enabled. I need routing for smtp and pop3s.

1 0

For Philipp Snizek
by alancivita＠inwind.it 05 Jun '01

05 Jun '01

thank you very much for answering i've tryied to do as you've suggested me..but it didn't work....:( the proxy is on a client.... and when i try to connect from the server via Netscape or Konqueror to an ftp site the message appears... but the strange is that..if i connect to the same site throught the ftp command using the console..i can reach the site ! this is pretty strange.. i've tryied to reach out in the configurations file but i couldn't find anything that can help me to unlock the problem may some one try to set just for fun the ftp_proxy on netscape on port 21 ? thanks to all

3 2

For Philipp Snizek
by alancivita＠inwind.it 05 Jun '01

05 Jun '01

thank you very much for answering i've tryied to do as you've suggested me..but it didn't work....:( the proxy is on a client.... and when i try to connect from the server via Netscape or Konqueror to an ftp site the message appears... but the strange is that..if i connect to the same site throught the ftp command using the console..i can reach the site ! this is pretty strange.. i've tryied to reach out in the configurations file but i couldn't find anything that can help me to unlock the problem may some one try to set just for fun the ftp_proxy on netscape on port 21 ? thanks to all

1 0

Sorry,access denied,the port number given has been disabled for security reason
by alancivita＠inwind.it 04 Jun '01

04 Jun '01

Hi all I have a Suse 7.1 just installed No firewall is installed at the moment I can surf on the net throught a proxy, ANALOGX proxy, a freeware proxy, on a windows machine The settings for http are 192.168.0.254 port 6588 and for ftp 192.168.0.254 on port 21 When i try to access an ftp site the browser (Netscape) says: Sorry, access to the port number given has been disabled for security reasons. Please really Please can someone help me on solve that problem? Thank you very much By all

2 1

Postdrop binary
by Corvin Russell 04 Jun '01

04 Jun '01

Sorry for these amateur questions. The weekly security check noted the following changes among others: - -rwxr-sr-x 1 root maildrop 77277 May 7 00:08 /usr/sbin/postdrop + -rwxr-sr-x 1 root maildrop 77277 May 31 02:16 /usr/sbin/postdrop I believe the postdrop binary is a postfix binary. I have not updated postfix recently, is this binary associated with anything else? Or is there another benign explanation for the change? + -rwxr-sr-x 1 root tty 14030 May 30 02:24 /opt/gnome/sbin/gnome-pty-helper - -rwxrwxr-x 1 root tty 14030 May 12 19:25 /opt/gnome/sbin/gnome-pty-helper As for the second, I am assuming it is related to the GPG vulnerability, as that is the only GNOME-related package I have updated recently. Does that sound right? But why the permission change? TIA Corvin -- Corvin Russell <corvinr(a)sympatico.ca>

1 1

POP3 and SSLWRAP - help question
by Steven Thompson 04 Jun '01

04 Jun '01

Hi All I have installed the POP.rpm off the SuSE 6.4 with SSLWRAP and OPENSSL. I have Updated the POP.rpm from SuSE site. I have created a normal user account ( no cyrus mail boxes). Pop3 acces is no problem. Retrieving pop3 mail via SSL is the problem. I have created my own Certificate, as shown in the README.SuSE (i.e) openssl req -config /usr/ssl/openssl.cnf -nodes -new -x509 -keyout my_cert.pem -out my_cert.pem -days 365 Inetd.conf setings: pop3s stream tcp nowait cyrus /usr/sbin/tcpd /usr/sbin/sslwrap -nocert 110 Mail Clients: Outlook Express and Outlook 2000. Q1. Do you leave the standard pop3 service running, but only allow connection from the localhost(127.0.0.1) or do u comment it out. Q2. When I try to fetch my pop3 mail via the ssl port there is connection to sslwrap service from the requesting host. Then there is connection to the popper service from the cyrus user to the localhost(127.0.0.1). After the cyrus user connection to localhost the mail client produces an error and is unable to retrieve the mail. Q3. When does my mail client have to have a certificate. In order for ssl to work. Q4. Are there any config files I have to tweak. All tips welcome. Thanks in Advance Steven

1 0

Re: [[suse-security] Nessus complains about sendmail]
by Bill Jones 03 Jun '01

03 Jun '01

Not sendmail per se but I believe the exploit exists in the mail command itself. I also do not believe SuSE is vunerable if you have the lastest mail update rpm listed under updates/7.1 But, I've been wrong before ... -Sneex- :] "J. Mell" <mell(a)www.br-wickelsysteme.de> wrote: > Hi list, > Nessus complained that there might be a buffer overflow if the 'MAIL FROM' > command string becomes too long. ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1

1 0

Nessus complains about sendmail
by J. Mell 03 Jun '01

03 Jun '01

Hi list, today I ran Nessus against our internet server. This server also provides mail services with Sendmail. RPM -q shows Sendmail 8.11.2-4. The system is SuSE 7.1. Nessus complained that there might be a buffer overflow if the 'MAIL FROM' command string becomes too long. As I cannot find anything about this issue in Sendmail's known bugs list and as the running Sendmail did not crash, I wonder if this is some kind of false alarm or a real issue. If it is real, will there be an update? Bye, Jürgen

1 0

SuSE Security Announcement: gpg/GnuPG (SuSE-SA:2001:020)
by Roman Drahtmueller 03 Jun '01

03 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: gpg/GnuPG Announcement-ID: SuSE-SA:2001:020 Date: Sunday, Jun 3rd 2001 14:00 MEST Affected SuSE versions: 6.3, 6.4, 7.0, 7.1, (7.2) Vulnerability Type: local privilege escalation Severity (1-10): 6 SuSE default package: yes Other affected systems: systems shipping the gpg/GnuPG package Content of this advisory: 1) security vulnerability resolved: gpg problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information GnuPG (the SuSE package is named "gpg") is a powerful encryption and signing program with a widespread usership in the free software world. It is designed to be a replacement for PGP and conforms to the OpenPGP standard. A format string vulnerability in versions of GnuPG before 1.0.6 has been found. The error occurs when gpg encounters a filename suffix that is not ".gpg" and prints the filename without the suffix as a default to the terminal. The bug allows an attacker to execute arbitrary code as the user calling gpg. Werner Koch, the author of the GnuPG package, states that when the "--batch" commandline option is used (such as when verifying rpm packages, see Section 3 of this announcement, or when used in MUAs (Mail User Agent)), the error cannot occur since this option supresses the printout of the filename on the terminal. There is no temporary workaround for the problem except for the "--batch" commandline option to gpg. We recommend to update the gpg package on all systems where it is installed. As an additional reason to update the package, it should be noted that gnupg 1.0.5 (packages were available on our ftp server) fixed some security-related problems, where one of them could allow an attacker with access to your key ring to compute the private key in considerably less time. We thank Werner Koch, the author of the GnuPG program, for quickly responding to the problem and fish stiqz, Synnergy Networks, for finding and communicating the problem to Werner Koch and to the security community. Please download the update package from locations described below and check the authenticity of the rpm package file using a method as described in section 3) of this security announcement. Please note that the packages for the 7.1 distribution are located on the ftp.suse.com ftp server, the packages for older distributions are on ftp.suse.de. The upcoming SuSE Linux Distribution 7.2 has been officially announced and will be available for our customers these days. The gpg package in version 1.0.6 did not make it into the 7.2 distribution. The update package will be available in the update directory shortly. Use the command `rpm -Uhv file.rpm' to apply the update. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/sec1/gpg-1.0.6-0.i386.rpm 39153126feeddf43a939c89a9b1a33fd source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/gpg-1.0.6-0.src.rpm 318ebedd094da2063ecaf209a9a686be SuSE-7.0 ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/gpg-1.0.6-0.i386.rpm b78951d79a8c9593a9baf14963c2eb61 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/gpg-1.0.6-0.src.rpm ea2067aacf9fb45d2a94eba066fdc18b SuSE-6.4 ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/gpg-1.0.6-1.i386.rpm 6050bffa597965475a4caf0a5c265c23 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/gpg-1.0.6-1.src.rpm 320eff2cc72cad2bce555993fbc7cb61 SuSE-6.3 ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/gpg-1.0.6-1.i386.rpm 6050bffa597965475a4caf0a5c265c23 source rpm: ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/gpg-1.0.6-1.src.rpm 320eff2cc72cad2bce555993fbc7cb61 Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/sec1/gpg-1.0.6-0.sparc.rpm 20d3a3d7d65aee48f281edf0ae2f162c source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/gpg-1.0.6-0.src.rpm d827d8e68a306c2d7890a5c113d934d3 SuSE-7.0 ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/gpg-1.0.6-0.sparc.rpm fca18e28c3442b16d7aaf614a5bda269 source rpm: ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/gpg-1.0.6-0.src.rpm 797e4f8410e4e4ba159bfc0e3eb7c06c PPC Power PC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/sec1/gpg-1.0.6-0.ppc.rpm 9c4c27fd13e9d27ac712bb37cdbe1972 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/gpg-1.0.6-0.src.rpm f262178a3b3d92c6382a303c3aba728e SuSE-7.0 ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/gpg-1.0.6-0.ppc.rpm 378dea2eb7b63ca376330f10757c042e source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/gpg-1.0.6-0.src.rpm a1815320cc4537bd18f4c361880c9f44 SuSE-6.4 ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/gpg-1.0.5-3.ppc.rpm d76adf2f7ab76454b05202df580a0235 source rpm: ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/gpg-1.0.5-3.src.rpm bc18a284bfee16e96a2ff7f6749b4cd1 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/sec1/gpg-1.0.6-0.alpha.rpm 68f791f8d03e3afbad5ee12b529ecc3c source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/gpg-1.0.6-0.src.rpm 41a50ddce1b16fd91627ac6b155426f6 SuSE-7.0 ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/gpg-1.0.6-0.alpha.rpm 696989a2d730b1dbf3891f6b14c42be3 source rpm: ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/gpg-1.0.6-0.src.rpm c76556d46b5de45349c146cb9b65b526 SuSE-6.4 ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/gpg-1.0.6-1.alpha.rpm e56719ef69aee3a6758f43317cd205cb source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/gpg-1.0.6-1.src.rpm 6e54ae31543db2c70a3b47f4916e7964 SuSE-6.3 ftp://ftp.suse.de/pub/suse/axp/update/6.3/sec1/gpg-1.0.6-2.alpha.rpm 55cb31d055cfaa7e96908391b075550e source rpm: ftp://ftp.suse.de/pub/suse/axp/update/6.3/zq1/gpg-1.0.6-2.src.rpm e19e2ae8c07e813ff00e65a618046974 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - qpopper SuSE Linux distributions after SuSE-7.1 contain the qpopper in version 4.x.y. According to the Changelogs of Qpopper 4.0.3 (See ftp://ftp.qualcomm.com/eudora/servers/unix/popper/), the versions of qpopper before version 4.0.3 contain a buffer overflow. We are currently investigating if this bug is exploitable and which versions of qpopper are affected. We will provide update packages as soon as possible if necessary. Please see our upcoming security announcements (Section 3 of this announcement)! - netscape Netscape before Version 4.77 contains a bug that allows a remote attacker to store JavaScript code in the comment field of GIF files that are contained in a viewed page. This code can be executed. Update packages for the SuSE Linux distributions 6.3, 6.4, 7.0 and 7.1 can be found on our ftp server at ftp://ftp.suse.com/pub/suse/i386/update/7.1/xap1/netscape-4.77-21.i386.rpm 1e2de825b3386d80a3731760b9e7f323 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xap1/netscape-4.77-21.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.4/xap1/netscape-4.77-21.i386.rpm ftp://ftp.suse.com/pub/suse/i386/update/6.3/xap1/netscape-4.77-21.i386.rpm 13f303944c9ac0863591b03c4eb75501 The packages are gpg-signed. See the section above about downloading and verifying rpm packages. The complexity of the netscape browser suggests by nature that more security related problems will be found, we will not issue a dedicated security announcement for the netscape package any more. Security- inclined users may please see the future security announcements in section 2) for information about security related problems with the netscape package. - pine Most of the supported distributions have pine update packages in the update area of the ftp server that update the pine package to version 4.33. Many vulnerabilities have been found in versions before 4.33, and it is recommended to perform the upgrade. Please note that not all packages have been built yet. See the update directory for your distribution (like i386/update/7.0/n1) for pine-4.33 packages. - dqs dex(a)raza-mexicana.org has found an exploitable buffer overflow bug in the dsh program from the dqs package on SuSE Linux distributions. To workaround the problem, do "chmod -s /usr/bin/dsh" and change the files /etc/permissions* to reflect the change. If you do not need the dqs package, then deinstall it (rpm -e dqs). We are working on update packages that fix the problem. - samba Insecure temporary file handling is the cause for a new samba version 2.0.9 that can be found as rpm packages in the n1/ directory of your distribution. It is recommended to install the update package if your users have local shell access to your samba server (this bug is not remotely exploitable). We are currently investigating some oddity in the behaviour of the samba package and will send a security announcement as soon as we have clarified the problems. The problems were present in earlier releases/versions of the samba package as well. By consequence, the installation of the update package is of low risk for the functionality of your system. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.GnuPG/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== Regards, Roman Drahtmueller <draht(a)suse.de>. - - | Roman Drahtmüller <draht(a)suse.de> // "The best way to pay for a | SuSE GmbH - Security Phone: // lovely moment is to enjoy it." | Nürnberg, Germany +49-911-740530 // - Richard Bach | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.GnuPG.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CpkBogQ57vSBEQQAk/GN+ftr7+DBlSoixDDpfRnUk+jApGEt8hCnrnjV nPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45t4E0fKyLVzDerCRFB1swz/mNDxT26DLy sdBV5fwNHTPhxa67goAZVrehQPqJEckkIpYriOaYcKpF3n5fQIZMEfMaHEElQhcX ML8AoJVXDkJYh7vI8EUB8ZURNLZMEECNA/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6T epRdLZhaylwVF/iu7uIn62ZUL4//NTOCDY7V63qg4iba/fUbOsWtEnGaiE7mQuAl sSWvRspwRA9/g9rdVf3/JdLJrLmKBTheyG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQn Jn2euqylHRubEQP/aL53NZK0kBdvrKgff6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+ mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiYI2lTRYT4uMdHuwVC3b4DqAKmoy375FER wHkrMVyKBJslv8QtbAWw5A1CAUseaHo+91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1 U0UgUGFja2FnZSBTaWduaW5nIEtleSA8YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUC Oe70gQUJA8JnAAQLCgMEAxUDAgMWAgECF4AACgkQqE7a6JyACspfLACffAYA+NM8 NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0xY7WbKoXs1+72b2AiEYEEBECAAYFAjpw XlIACgkQnkDjEAAKq6TczgCgi+ddhWb7+FWcfeE6WwPZccqAHowAnjjtRyGwHLQH r5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk /xGJJREt7V12iSafaRzGuH8xWvIz1bb+VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6i JXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq2pudfwljp52lYVM53jgPYEz0q/v3091n lZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU+lDQT2EC6VKaxeWK8pNt6UFDwICRDQxK nlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKNbWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852 Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelx ufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7U VCiSfb9CV38dmeHdPCEEjDUWquFYEnvj3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qT Jzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBEVE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN 89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiU XpRoFCdglMznbcAyCk9C2wqb2j/D1Z2BeSBaGCSFkR6pRLebnE17LWcu72Iy+r0z +JecbPiyDpDZj4apn7IC81aNFGi7fNITsHODbwwjiwADBgf/YPvVdzkc8OC7ztac EWCanwylKvxCdKzTDA+DfES6WUYShyiVJvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/p dGy1aKtJZrAnFEsofpmOj8VoqyyFgp/yAGQBp12+mXek7SCZRhuqalDfEMRiWEJ6 J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxxQqNQXL6Z3NSxS61p+5n6BseiDUI39xxk KTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwbsklszZt6xbU+R0SjFqTvjPWx6eHfqbmN C9WMDdTjGrXDDKXFp2aYlokfN6It9vsbVlGNlOwHt/JjGoPMxW6Xqj0FLA7/Vewg CdXW64hMBBgRAgAMBQI57vSSBQkDwmcAAAoJEKhO2uicgArKSyIAmwUHf/vtKQfc mVg4asR7U6XQl0bAAJ4pO22B5U8UH6IYl2LBCXFqw5+5fA== =rVRn - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOxosAHey5gA9JdPZAQHsygf/ZJ/QnjN5LzpQqYqIU4n5Hd8EqWJN1S83 i4tr+kMJxNqL3E1pXjFOpAxzpqcib5gK8bBsCnlVnjZtUro1eZwhvtZyJZTlBVe/ OO/Vp39Y4LTDXQfTmfl5nqjyVFObcBWI6rYvKxpJgl3mmcsH4HGr0UQXFgg3AnVI +J3TVk2j5pcn7br7XzFFyXzcTc//3PZlKWCNZkajD8JHW1uEuN3OIvojaJhFIvRw bWMtFoX9R7UDByekGFnhO4F7wT36QGvGixnYM9V9/PcrAMprRUQfeey+V3gQrPFZ peUzqm3oT/uWVEldyLyyLbUur3GeIRJweLFYs6OvWYj7BAEXpdsv5w== =doZ/ -----END PGP SIGNATURE-----

1 0

Re: [suse-security] Turning off PC Anywhere
by Sundar ＠local 03 Jun '01

03 Jun '01

When I did 'fuser 5632/udp', I did not get anything back on the console. Should I be explicitly turning off the port? If yes, how do I do it. Thanks, sundar ----- Original Message ----- From: "Anders Johansson" <andjoh(a)cicada.linux-site.net> To: "Sundar @local" <sundar(a)esaravana.com> Sent: Saturday, June 02, 2001 6:00 PM Subject: Re: [suse-security] Turning off PC Anywhere > PC Anywhere is a windows program. nessus is reporting it as such, simply > because the port 5632 is listed in /etc/services as belonging to PC Anywhere, > but ports above 1024 can be opened by any process. try running fuser 5632/udp > on the web server to find the id of the process owning the port. > > Regards > Anders > > On Sunday 03 June 2001 02:54, sundar(a)esaravana.com wrote: > > I ran nessus against my web server running (SuSE 7.1-kernel 2.4), it came > > out with a scan that I am running PC Anywhere in port 5632/udp. I want to > > get > > rid of it. How do I do it and from which package did I get this. > > > > Cheers!, > > Sundar > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com >

2 1

Turning off PC Anywhere
by Sundar ＠local 03 Jun '01

03 Jun '01

I ran nessus against my web server running (SuSE 7.1-kernel 2.4), it came out with a scan that I am running PC Anywhere in port 5632/udp. I want to get rid of it. How do I do it and from which package did I get this. Cheers!, Sundar

1 0

Secmod/secumod? Where can I find it for SuSE 7.1
by A_Johnson-SuseML-e 02 Jun '01

02 Jun '01

Hello again :) I am still searching for secumod or secmod for my 7.1 pro version. As for those whom have been asking me about insmod..well I know that you are right, it is old and I man using the new version included with 7.1 Also where can I find any FAQ on testing my SuSE servers security vulnerabilities and the such? Aaron L. Johnson

2 1

searching for good WINDOWS security list
by A_Johnson-SuseML-e 02 Jun '01

02 Jun '01

I know I may get flamed here but I do use windows as much as I wish not to....so I am searching for a LIST about windows security. I think I may have a Trojan bot on my machine...akkk, they are like harpies (not herpies but harpies the little baby monsters), and Windows seems to be very susceptible to any germ out there..... PS I know I can set up my linux box to sniff at my windows box... how would I do a thing like that. I was hoping to have a direct link from the WIN to the LINUX for the task...what do I use on the linux box? nmap? I read about that someplace...any other tools? Thaanks... This is why I think I have a bot/Trojan, the first 2 lines, tcp port 1080 and 5000 and 139... they are up even when I have no IP assigned to my NIC, they are always there... and I have no idea is what is going on at those ports. I have a fire wall, Zonealarm and a linksys 4 port router that supports NAT...okay okay I am new to this stuff ....lol...but it's fun in some sick and twisted way that I can not figure out. So FLAME ON he he but with a side of help would be greatly appreciated. :) Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:1080 0.0.0.0:0 LISTENING TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING TCP 24.183.224.125:139 0.0.0.0:0 LISTENING UDP 24.183.224.125:1900 *:* UDP 24.183.224.125:137 *:* UDP 24.183.224.125:138 *:* UDP 127.0.0.1:1026 *:* UDP 127.0.0.1:1041 *:* UDP 127.0.0.1:1095 *:* Aaron L Johnson

4 3

RE: [suse-security] Strange apache log entry
by Peer Stefan 02 Jun '01

02 Jun '01

Ok, Microsoft Frontpages has several security flaws, but that does not automatically mean that every request for _vti_<whatever> is done by a hacker or a script-kiddy. Have a look at the browser the client is using, if it's "MSFrontPage/X.Y" then please don't worry. But do worry if it's the only request for a link containing _vti* or if there is only one client (if it's not a proxy) requesting this url. Watch your system, but don't worry to much. regards, Stefan Peer -----Ursprüngliche Nachricht----- Von: Soeren Todt [mailto:sworn@gmx.net] Gesendet: Donnerstag, 31. Mai 2001 15:30 An: suse-security(a)suse.com; Thorsten Marquardt Betreff: Re: [suse-security] Strange apache log entry Hi, ----- Original Message ----- From: "Thorsten Marquardt" <thom(a)kaupp.chemie.uni-oldenburg.de> To: <suse-security(a)suse.com> Sent: Thursday, May 31, 2001 1:45 PM Subject: [suse-security] Strange apache log entry > my logfiles reports 404 requests to /_vti_bin/shtml.exe/_vti_rpc and similar. > > Is this a kind of hacker attack? Maybe you find it out by yourself using a search engine: http://www.google.de/search?q=_vti_bin%2Fshtml.exe%2F_vti_rpc++crack&hl=de&s afe=off then you get results like this: http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html Ciao Sören --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

Firewall2-custom.rc.config
by Shonne Beavers 02 Jun '01

02 Jun '01

My Firewall2-custom.rc.config will not load. What am I doing wrong? Any Dumb User Friendly Answers are appreciated ###Firewall2-custom.rc.config### # Copyright (c) 1999,2000 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Authors: Marc Heuse <marc(a)suse.de>, # Volker Kuhlmann <kuhlmav(a)elec.canterbury.ac.nz> # # /etc/rc.config.d/firewall-custom.rc.config # # ------------------------------------------------------------------------ # # This is file is for SuSEfirewall >= v4.0 and is an example for using # the hooks which are supplied since v4.0 to load customized ipchains rules. # # THERE IS NO HELP FOR USING HOOKS EXCEPT THIS FILE ! SO READ CAREFULLY ! # IT IS USEFUL TO CROSS-READ /sbin/SuSEfirewall TO SEE HOW HOOKS WORK ! # # ------------------------------------------------------------------------ fw_custom_before_antispoofing() { # these rules will be loaded before any anti spoofing rules will be # loaded. Effectively the only filter lists already effective are # 1) allow any traffic via the loopback interface, 2) allow DHCP stuff, # 3) allow SAMBA stuff [2 and 3 only if FW_SERVICE_... are set to "yes"] # You can use this hook to prevent logging of uninteresting broadcast # packets or to allow certain packet through the anti-spoofing mechanism. #example: allow incoming multicast packets for any routing protocol #ipchains -I input -j ACCEPT -d 224.0.0.0/24 true } fw_custom_before_port_handling() { # could also be named "after_antispoofing()" # these rules will be loaded after the anti-spoofing and icmp handling # but before any IP protocol or TCP/UDP port allow/protection rules # will be set. # You can use this hook to allow/deny certain IP protocols or TCP/UDP # ports before the SuSEfirewall generated rules are hit. #example: always filter backorifice/netbus trojan connect requests and log them. iptables -A INPUT -j DROP -p tcp --destination-port 31337 iptables -A INPUT -j DROP -p udp --destination-port 31337 iptables -A INPUT -j DROP -p tcp --destination-port 12345:12346 iptables -A INPUT -j DROP -p udp --destination-port 12345:12346 # Syn-flood protection: iptables -N syn-flood iptables -A INPUT -i eth0 -p tcp --syn -j syn-flood iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j DROP ## Make sure NEW tcp connections are SYN packets iptables -A INPUT -i eth0 -p tcp ! --syn -m state --state NEW -j DROP ## Fragments iptables -A INPUT -i eth0 -f -j LOG --log-prefix "IPTABLES FRAGMENTS: " iptables -A INPUT -i eth0 -f -j DROP ## What if I get spoofed # Refuse packets claiming to be from a Class A private network. iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DROP # Refuse packets claiming to be from a Class B private network. iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DROP # Refuse packets claiming to be from a Class C private network. iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DROP # Refuse Class D multicast addresses. Multicast is illegal as a source address. iptables -A INPUT -i eth0 -s 224.0.0.0/4 -j DROP # Refuse Class E reserved IP addresses. iptables -A INPUT -i eth0 -s 240.0.0.0/5 -j DROP # Furtive port scanner: iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT # Ping of death: iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT # Refuse those that think that they are local, me as well iptables -A INPUT -i eth0 -d 127.0.0.1/8 -j DROP # All you can eat Local traffic iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ## AUTH server # Reject ident probes witha tcp reset iptables -A INPUT -i eth0 -p tcp --dport 113 -j REJECT --reject-with tcp-reset true } fw_custom_before_masq() { # could also be named "after_port_handling()" # these rules will be loaded after the IP protocol and TCP/UDP port # handling, but before any IP forwarding (routing), masquerading # will be done. # NOTE: reverse masquerading is before directly after # fw_custom_before_port_handling !!!! # You can use this hook to ... hmmm ... I'm sure you'll find a use for # this ... true } fw_custom_before_denyall() { # could also be named "after_forwardmasq()" # these are the rules to be loaded after IP forwarding and masquerading # but before the logging and deny all section is set by SuSEfirewall. # You can use this hook to prevent the logging of annoying packets. #example: prevent logging of talk requests from anywhere iptables -A INPUT -j DROP -p udp --destination-port 517:518 true }

1 0

Firewall setup
by Oyku Gencay 01 Jun '01

01 Jun '01

Hi, Has anybody used Linux in a such setup? Firewall box 3 ethernets. eth0: internet (Real IP) eth1: Local (192.168.1.0/24) eth2: DMZ (10.0.0.0/24) My problem is rather conceptual. What I'm trying to do is network address translation (NAT) but it's a wide topic and full of misconceptions and incompatibilities between documents. I specifically would like to translate 1 real IP to 1 unreal IP and 1-1 only. For instance; www.xxx.com is 195.195.195.10 (supposed to be a real IP) in the DNS. www.xxx.com runs on the virtual server 10.0.0.10 so the port 80 request to IP 195.195.195.10 should be routed to eth2 and translated as 10.0.0.10 back and forth. What tools do I need for such a setup in a 2.4 kernel ? Thanks in advance

2 2

RE: [suse-security] searching for good WINDOWS security list
by Dave Gregory 01 Jun '01

01 Jun '01

I am on a ton of security lists for windows, but so far, my favorite one is aspsecurity from www.asplists.com or www.learnasp.com Believe it or not... it is the most active list and it has very competent people advising about many issues, not just asp. I have found it the most helpful of my lists so far. Good luck dave -----Original Message----- From: A_Johnson-SuseML-e [mailto:lj_suse_ml@hotmail.com] Sent: Friday, June 01, 2001 10:32 AM To: suse-security(a)suse.com; suse-linux-e(a)suse.com Cc: suse-security(a)suse.com; suse-linux-e(a)suse.com Subject: [suse-security] searching for good WINDOWS security list I know I may get flamed here but I do use windows as much as I wish not to....so I am searching for a LIST about windows security. I think I may have a Trojan bot on my machine...akkk, they are like harpies (not herpies but harpies the little baby monsters), and Windows seems to be very susceptible to any germ out there..... PS I know I can set up my linux box to sniff at my windows box... how would I do a thing like that. I was hoping to have a direct link from the WIN to the LINUX for the task...what do I use on the linux box? nmap? I read about that someplace...any other tools? Thaanks... This is why I think I have a bot/Trojan, the first 2 lines, tcp port 1080 and 5000 and 139... they are up even when I have no IP assigned to my NIC, they are always there... and I have no idea is what is going on at those ports. I have a fire wall, Zonealarm and a linksys 4 port router that supports NAT...okay okay I am new to this stuff ....lol...but it's fun in some sick and twisted way that I can not figure out. So FLAME ON he he but with a side of help would be greatly appreciated. :) Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:1080 0.0.0.0:0 LISTENING TCP 0.0.0.0:5000 0.0.0.0:0 LISTENING TCP 24.183.224.125:139 0.0.0.0:0 LISTENING UDP 24.183.224.125:1900 *:* UDP 24.183.224.125:137 *:* UDP 24.183.224.125:138 *:* UDP 127.0.0.1:1026 *:* UDP 127.0.0.1:1041 *:* UDP 127.0.0.1:1095 *:* Aaron L Johnson --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

insmod and secmod .... whare can I find them....
by A_Johnson-SuseML-e 01 Jun '01

01 Jun '01

I am searching aimlessly my computer and what not for a place where INSMOD and SECMOD may be hiding from me. I wish to install them, I did find an insmod in /sbin but not a secmod anywhere. I have added them to my boot.local, but since they are not installed I can not use them hence the error message I get that has sent me on the escapade. Thanks again...the leaning one, Aaron L. Johnson

1 0

Re: [SLE] suse 7.2!!
by A_Johnson-SuseML-e 01 Jun '01

01 Jun '01

----- Original Message ----- From: "Lennart Börjeson" <LennartB(a)cinnober.com> To: <suse-linux-e(a)suse.com> Sent: Friday, June 01, 2001 4:20 AM Subject: SV: [SLE] suse 7.2!! The success of Windows rests on three pillars: > 1) The acceptance of Windows as a game console. Which is going to fall because they are finally transitioning over to NT which doesn't support a lot of the "stuff" needed for a good game machine and thier X-BOX a small PC that is cramed into a wierd box to suck up some of the conole maket >This is what most home PCs are used for. The typical Windows >user wants out-of-the-box games compatibility. Just insert the CD! again x-box (@##W%#$) >2) The adoption of Word as a format for the exchange of documents. >How many times have you not received a Word document in mail or via >a web page? And with consistent regularity, it will have been made >with a Word version later than the one you have, which forces you >to upgrade. And the latest version of Word/Excel/etc is only available >on the Windows platform... (This is, BTW, what killed NT on the RISC >platforms (Mips, PowerPC, Alpha). There was ONLY Windows available, no >office applications, which forced every user who needed the extra >muscle offered by RISC to have two workstations at his/her desk.) This I feel is only true if you are an avid M$ user. Plain text is smaller/faster/and more reliable >3) The adoption of Exchange in the business community. no comment ... darrrrrr This immediately forces all clients to use Outlook, which is only available on Windows. Yes, you can use POP3/IMAP/SMTP, but you'll miss out on all the "extra" group-ware utilities bundled with Exchange. (I've heard a rumour that the Web-interface of Exchange2000 can do everything Outlook can, but I'll bet that only applies to users of IE5+ on Windows...) Linux needs to counter Windows on all three fronts by offering 99.9% Windows compatibility + superior features, otherwise the common non-techie person won't stand the hassle of converting. /Lennart -----Ursprungligt meddelande----- Från: yamaska.mail [mailto:yamaska.mail@planet.nl] Skickat: den 31 maj 2001 18:27 Till: j.e.drews(a)worldnet.att.net Kopia: suse-linux-e(a)suse.com Ämne: Re: [SLE] suse 7.2!! Worse yet, you don't even get Visual Basic, they make you buy this as well !!! Greetz Pete (A newbie) >----- Original Message ----- >From: "Jonathan Drews" <j.e.drews(a)worldnet.att.net> >To: "Ben Rosenberg" <ben(a)whack.org> >Cc: <suse-linux-e(a)suse.com> >Sent: Thursday, 31 May, 2001 7:56 AM >Subject: Re: [SLE] suse 7.2!! > On Wednesday 30 May 2001 22:51, Ben wrote: > >I would rather pay $50 every 6 > > months then $300 (W2K Feb 2000) then have to spend another $150-200 for > > XP 18 months later..and when Linux improves..it impoves..it's not just > > cosmetic most of the time. This is just my opinion. > > I would rather pay $300.00 for 3 Linux Distros than be given Microsoft > Windows for free. > > How the hell M$ sold so much software is a mystery to me. It's really > pathetic stuff. The detractors of Linux say it comes with no applications. > Are these people brain dead? All Linux distros come with C, C++, Python and > Perl. All you get with M$ is Visual Basic. I'd rather use my K+E Log-Log > Duplex Decitrig slide rule that that stuff. > > > -- > Cheers, > > Jonathan > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/support/faq and the > archives at http://lists.suse.com > -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/support/faq and the archives at http://lists.suse.com

1 0

Problems with tripwire
by joerg.bogenrieder＠sytech.de 01 Jun '01

01 Jun '01

Hello List, I have problems with tripwire, I try to secure my binarys with tripwire but when I start tripewire to initialize the Database I get this error Message: ---[snip]--- ### Phase 1: Reading configuration file ### Phase 2: Generating file list ### Phase3: Creating file information database Segemtagen fault ---[snap]--- I have SuSE Linux 7.1 for Alpha, Kernel 2.4.4 and tripwire 1.2 (patchlevel 2). Any ideas? Jörg Bogenrieder SyTech Schuler GmbH Im Kammerbrühl 28 88212 Ravensburg www.systech.de joerg.bogenrieder(a)sytech.de Tel.: +49 (0)751/3606-470 Fax: +49 (0)751/3606-490

2 1

gpg-1.0.6
by Roman Drahtmueller 01 Jun '01

01 Jun '01

Hi together, The gpg update packages for most distributions after 6.3 are being transferred to ftp.suse.com right now. Feel free to install and test them - the announcement probably goes out on the weekend, if not today. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

SuSEfirewall doesn't close some ports
by Vadim Kouzmine 01 Jun '01

01 Jun '01

SuSEfirewall 4.3-3 on SuSE 7.1 Zebra 0.91a opens ports for virtual terminals. `netstat -anp` show these ports as (is it IPv6 notation?): ---------- tcp 0 0 :::2604 :::* LISTEN 23643/ospfd tcp 0 0 :::2601 :::* LISTEN 23640/zebra ---------- I guess SuSEfirewall doesn't discover these ports as listening and doesn't close it, although FW_AUTOPROTECT_GLOBAL_SERVICES="yes". Also `SuSEfirewall -check` doesn't show these ports as unprotected. Thank you, Vadim

3 2

Re: [suse-security] forcing use of proxy
by rene marhold 01 Jun '01

01 Jun '01

ok then maybe try the hard way, formide every workstation into lan direct connections to the internet, only allow the proxy to enter the i-net an easy solution with ip tables ----- Original Message ----- From: "Robert Davies" <Rob_Davies(a)NTLWorld.Com> To: "rene marhold" <rene(a)mail.marhold.net> Sent: Friday, June 01, 2001 12:09 AM Subject: Re: [suse-security] forcing use of proxy > > first you can block the port 80,443 from internal network to outside, > > its only allowed for ipadress of the proxy to go outside to port 80,443 > > so the users are forced to use the proxy, because no direct connection is > > allowed any more. > > But an evil user can run a proxy on say port 53, or another port you don't > block on the firewall, then I can browse sites you are blocking. Some > universities have this problem, they only allow Web Access and SMTP, but > clever students use thigns like CIPE and ssh to get to the other stuff they > want. > > If you want to 'force' use of something private networks are the only way, > then they really _do_ have to use the services you offer, through > application level proxies. > > Rob >

2 1

AW: [suse-security] Strange apache log entry
by Peer Stefan 01 Jun '01

01 Jun '01

You're right, a little paranoia is appropriate in order to secure a network. I am worried about security and I would never use IIS or install anything like Frontpage extensions for any other web server. But I wouldn't worry if a logfile entry points to _vti_<something>, which is either a user, who entered the wrong server or, if it's a hacker, a script, scanning a whole bunch of web-servers for known security holes. If it is a real human cracker (!= script kiddy), who tries to crack just this single system, he/she will find a way into it. -----Ursprüngliche Nachricht----- Von: Boris Lorenz [mailto:bolo@lupa.de] Gesendet: Donnerstag, 31. Mai 2001 16:19 An: suse-security(a)suse.com Betreff: RE: [suse-security] Strange apache log entry On 31-May-01 Peer Stefan wrote: > Ok, Microsoft Frontpages has several security flaws, but that does not > automatically mean that every request for _vti_<whatever> is done by a > hacker or a script-kiddy. Well, not *every* request, but there are *some*. That´s enough for being worried, isn´t it. > Have a look at the browser the client is using, if it's "MSFrontPage/X.Y" > then please don't worry. But do worry if it's the only request for a link > containing _vti* or if there is only one client (if it's not a proxy) > requesting this url. > > Watch your system, but don't worry to much. IMHO such suggestions are somewhat misleading. At last, this is a security mailing list we´re posting in, and a certain amount of paranoia seems to be appropriate considering the current lack of (inter)network security we´re confronted with all day. Sometimes I wish some of ´dem (security-)admins would be just a little more agressive towards security incidents of *any* kind, even if they (the incidents) would end up being harmless. Sorry for the rant...;) > regards, > Stefan Peer > > -----Ursprüngliche Nachricht----- > Von: Soeren Todt [mailto:sworn@gmx.net] > Gesendet: Donnerstag, 31. Mai 2001 15:30 > An: suse-security(a)suse.com; Thorsten Marquardt > Betreff: Re: [suse-security] Strange apache log entry > > > Hi, > > ----- Original Message ----- > From: "Thorsten Marquardt" <thom(a)kaupp.chemie.uni-oldenburg.de> > To: <suse-security(a)suse.com> > Sent: Thursday, May 31, 2001 1:45 PM > Subject: [suse-security] Strange apache log entry > > >> my logfiles reports 404 requests to /_vti_bin/shtml.exe/_vti_rpc and > similar. >> >> Is this a kind of hacker attack? [...] --- Boris Lorenz <bolo(a)lupa.de> System Security Admin *nix - *nux --- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] nice ssh-problem...
by Daniel Quappe 01 Jun '01

01 Jun '01

thanks for your response, to all listmembers thinking about my problem...;-) i need to use rsaauthentication with a key to enable secure-script- automation... greets, daniel -- Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

OT: new(?) possib. DoS/DDoS-Attacks (2)
by Dieter Huerten 01 Jun '01

01 Jun '01

Oooops! Wrong thread! <sorry> Hi folks! maybe (at the moment) a little bit OT, but take time to read: http://grc.com/dos/grcdos.htm A well written doc of an DoS/DDoS-Attack by an 13yr. "script-kiddy", using many W&%-Boxes as 'agents'/'bots' against grc.com ! For me (not paranoid <g>!) it shows, that security (and all belonging subjects) is an permanent importance for *everyone* -- best greetings from Solingen /GERMANY Dieter Hürten

1 0

forcing use of proxy
by stephane parenton 01 Jun '01

01 Jun '01

Hi, We're using squid 2.2.stable5 as proxy on a SuSE 7.0 box and i would like ALL users to go through the proxy... I know we have some users that play with internet and disable their proxy parameters.... how can I ban "direct internet access" so only proxy connections pass through (whatever is configure on users win stations) ? Regards Stephane

6 6