June 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 26 Jun '01

26 Jun '01

DIRK WROTE: Helo Stefan,helo Steffen, helo folks! Well, referable that outgoing port from Squid, I be mistaken. His dport is just 80. But that is not my problem. Masquerading and DNS intern and extern pop,imap,http as mail GUI, all this things working o.k. Only that thing with squid on my collapsed Firewall is my evil. Here my rules exactly: IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN servber01_eth0="IP-WAN" servber01_eth2="IP-LAN" ANY="0/0" #LAN goes way to Proxy $IPTABLES -A INPUT -i $IF_LAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $LAN --sport $p_high -d $servber01_eth2 --dport squid -j ACCEPT #Proxy goes back LAN $IPTABLES -A OUPUT -o $IF_LAN -p tcp -m state --state ESTABLISED,RELATED -s $servber01_eth2 --sport squid -d $LAN --dport $p_high -j ACCEPT #Proxy goes way to Internet $IPTABLES -A OUPUT -o $IF_WAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $servber01_eth0 --sport $p_high -d $ANY --dport http -j ACCEPT #Internet goes wayback to Proxy $IPTABLES -A INPUT -i $IF_WAN -p tcp -m state --state ESTABLISED,RELATED -s $ANY --sport http -d $servber01_eth0 --dport $p_high -j ACCEPT Maybe you can find that trouble. Squid is an lokal service on my collapsed Firewall. So I don`t need FORWARD rules. Transparent Proxy is not good for that one. Thanks a lot and best regards Dirk Hi Dirk, hi folks, as I set up a firewall, I read the iptables-howtos and I think the states NEW, RELATED and ESTABLISHED is more effectable if you use some NAT. I think you need special INPUT and OUTPUT rules at your firewall. We had the same problem as we used bindutil for nameserverquestions at the firewall. We tried to use only states but this doesn't work. At this point I think you have to use simple INPUT and OUTPUT rules. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

2 1

amavis-sendmail
by Björn Engels 26 Jun '01

26 Jun '01

Hi, I just installed amavis-sendmail on a 7.2 box and I'm trying to configure it for my system. If I configure it as as being described in the mail root gets after installing and start amavis and sendmail from /etc/init.d, mails including a virus signature are being mailed normally. After reading /usr/share/doc/packages/amavis-sendmail/* I tried to modify Mlocal in /etc/sendmail.cf with the result that sendmail can't find /usr/sbin/scanmails. I tried to substitute scanmails with /usr/bin/amavis and /usr/bin/amavis-milter with the following result in /var/log/mail: sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 1 or sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 255 Any hints ? Thanks in advance Bjoern

6 15

Listing of "common" ports used for attacks?
by Geordon VanTassle 26 Jun '01

26 Jun '01

Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me... Any suggestions would be appreciated. Thanks, Geordon

5 5

Little problem with /bin/telnet (fwd)
by Fox 26 Jun '01

26 Jun '01

<please,excuse me for my poor english> Hi, i've found a bug in /bin/telnet that arrives with suse 7.1 and 7. I dont know if this bug has been already reported, but others distributions seems to be vulnerables too. Let me give you an example: --- bash-2.04$ DISPLAY=`perl -e 'print "a"x1200'` bash-2.04$ telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Segmentation fault bash-2.04$ --- Telnet gives me seg fault when it checks the enviroment $DISPLAY. Bye.

2 1

RE: [suse-security] Little problem with /bin/telnet (fwd)
by Björn Engels 26 Jun '01

26 Jun '01

Fox wrote on 6/27/01 4:17 AM >Telnet gives me seg fault when it checks the enviroment $DISPLAY. I am using 7.2 and I had to increase the number of chars, the rest is pretty similar: bj@spock:~ > DISPLAY=`perl -e'print "a"x12000'` bj@spock:~ > telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Speicherzugriffsfehler Bjoern

1 0

RE: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 25 Jun '01

25 Jun '01

DIRK WROTE: Helo Folks, I still got a problem to set iptables for my Proxy Squid. All other doing well, but I think with Squid I have an understanding problem. My Gateway has three nic`s. IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN My conception is squid runs as an lokal service on this Gateway. So I have to write a rule with --dport 3128 for an INPUT way to and an OUTPUT way back on Interface eth2, because Squid is running as an lokal service. Squid himself has to leave that Gateway to the Internet on Interface $IF_WAN with --dport 80 to --sport 80 and comes back as it goes. The meens to write a rule with OUTPUT and INPUT on $IF_WAN. But it doesn`t work. I also think about a FORWARD rule but is my conception so wrong?? Dirk ---------------------------------------------------------------------------------------------------------------------------------- Hi Dirk, hi list, I think you have to change the sport from 80 to 1024:65535 because, requests an a http-server doesn't com from the same port where they want to go to. The same the other way around. You should alo enable forward rules. Maybe it works this way. Maybe you should try to enter the rules manually via an simple script. If you use dynamic IP at you dsl-connection try this configuration: <---SNIP--> # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification einschalten for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-Forwarding echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -X iptables -F iptables -t nat -F iptables -t nat -X iptables -A INPUT -p tcp --dport 3128 --sport 1024:65535 -j ACCEPT iptables -A OUTPUT -p tcp --sport 3128 --dport 1024:65535 -j ACCEPT ########################################################################## # NAT (MASQUERADING) ########################################################################## # Special variation of SNAT (SOURCE NAT) iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS ########################################################################## echo "DNS" # send requests to you DNS in the Internet iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # HTTP iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 80 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 80 --dport $UNPRI -j ACCEPT # look at your LOG, enable in /etc/syslog.conf the parameter "kern.* > /var/log/firewall" e.g. iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " <---SNIP--> this should work MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

3 2

Empress?
by James Ogley 25 Jun '01

25 Jun '01

/home/ogley> grep empress /etc/passwd Nothing... jogley:~ # grep empress /etc/shadow empress:*:8902:0:10000:::: What's going on here? Can I happily delete this user? -- James Ogley, Unix Systems Administrator, Pinnacle.Net james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 20 8731 3619 This email was created and sent with: Evolution 0.10 *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

RE: [suse-security] intrusion detector "tripwire"
by Spencer, Ed M. -ND 25 Jun '01

25 Jun '01

I've used Tripwire on other platforms (NT, HP-UX, Solaris, and AIX) and have found it to be wonderful for forensic analysis and enforcing change management policies. It lets you know what's been changed and provides a thorough mechanism to verify important files. I've been using the commercial product and while it's far easier to install and manage (with the management console) than the 'academic' version, it does what it's supposed to do and does it well. The hardest part of setting it up remains the policy files though. Defining exactly what you want monitored and what you don't is the most important (and difficult) part of the setup. If you're watching a single machine it's not that bad if you watch everything, it's bad when you're watching over 300 machines and you're flagged on /etc/shadow every time a user changes a password or you're flagged on every file on the server when your backup software runs and changes the 'c' time. If you filter down the noise you should find Tripwire easy to use and effective. BTW, version 2.4 commercial supports Linux as a client AND runs the management console on X. Ed Spencer MCSE/MCT/CNA/A+/Network+ Security Analyst - IS Security Renaissance Worldwide, Inc. - Walt Disney World This communication is confidential, intended only for the named recipient(s) above and may contain trade secrets or other information that is exempt from disclosure under applicable law. Any use, dissemination, distribution or copying of this communication by anyone other than the named recipient(s) is strictly prohibited. If you have received this communication in error, please immediately notify us by calling (407) 566-5195. The ideas, opinions, and information expressed within the above email are the express sole opinion of the author and are not the opinion of the Walt Disney World Corporation. Thank you. -----Original Message----- From: Jeric [mailto:jeric@mmcable.com] Sent: Sunday, June 24, 2001 12:37 PM To: suse-security(a)suse.com Subject: [suse-security] intrusion detector "tripwire" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

1 0

hardsuse package ???
by Mansel Bell 25 Jun '01

25 Jun '01

All, I had recently moved to SuSE with the 7.1 distro and was going to harden my box via the hardsuse package, but a little investigation revealed that hardsuse hasn't been included in the SuSE distro since 7.0. I got the most recent version of the harden_suse.pl script (harden_suse-3.5.pl) from Marc's SuSE homepage (http://www.suse.de/~marc/) but was wondering why it is no longer included in the SuSE Professional distro. Is no longer going to be supported by SuSE? Is something else taking it's place (a SuSE version of Bastille Linux)? For anyone with experience using both hardsuse and Bastille Linux, which do you prefer? Thanks... -Mansel

3 2

intrusion detector "tripwire"
by Jeric 25 Jun '01

25 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

3 2

Re: [suse-security] intrusion detector "tripwire"
by Thomas Lamy 24 Jun '01

24 Jun '01

> Von: Jeric [mailto:jeric@mmcable.com] > Gesendet: Sonntag, 24. Juni 2001 18:37 > An: suse-security(a)suse.com > Betreff: [suse-security] intrusion detector "tripwire" > > > First off, I just wanted to say hello to everyone, since this is my > first posting here at SuSE. > > I was reading an article in "linux journal" about an intrusion > detection called "tripwire" > (http://sourceforge.net/projects/tripwire). it sounds really great > on paper, but i was wonder if anyone uses this program, and if so, > are there any issues with it on a SuSE system, or in general (i.e. is > it fairly reliable, stable, easy to setup)? > > Thanks in advance > Hi, I used to use tripwire for all of my machines. It's relatively easy to install, configure and run. Some general hints (also for other checksum progs): - You have to keep it's database on a read-only medium, and have to renew it every time you update your system (because tripwired binaries are affected by every update if you configure it well). a write-protected floppy disk will do as long as you disable floppy booting (or you will be unable to remotely reboot your system ). - IMHO, do not put files like /etc/passwd and friends into the same database as your system binaries are, at least not on systems with user fluctuation. Use a different database or a different tool to monitor these. - Think about performance implications on the machines you run it. I had a pretty bad time with users bashing me because of poor web server performance. It was TW, checking all of my binaries (a big list including informix, where one binary has about 11 megs) every 30 minutes. You should also have a look at http://www.securityportal.com/lskb/10000000/kben10000026.html which is a good starting point and overview. Thomas

1 0

RE: [suse-security] Firewall questions
by Björn Engels 24 Jun '01

24 Jun '01

Original Message From: Dallam Wych Sent: 6/24/01 10:58 AM >First, should I use the firewall that came in the distro or is the >firewall2 >Alpha on Marcs page better? Hmm, in my opinion you should use the package that comes with the distro and try to understand the rules, then. If you got it, you could switch to FW2 and start beginning to undesrstand those rules. (It's much more complicated, but has lots of fine new possibilities ;) I guess you will want to rewrite those rules you find there, you can make things lots easier because the FW-Packages are built to cover lots of possible configurations... ) >Should I then use SuSE harden as well? Well, everybody should do it, independently from setting up a firewall ;) >Finally, >I would like to learn more about firewalls so that I don't have to ask >questions like this one :o). So what would be some good books to read on >the subject? I only can tell you the stuff I read, of course, maybe you wish to take a look at http://www2.little-idiot.de/firewall/ for example, at http://www.linuxfirewalls.org and at the book "Building Internet Firewalls", and you should read the manpages of ipchains and iptables, of course. HTH, good luck ;) Bjoern

1 0

ANN: new amavis-perl/amavisd RPMs for sendmail and postfix (SuSE Linux 7.2) available
by Rainer Link 24 Jun '01

24 Jun '01

Hi! During the weekend I've build some new RPMs for SuSE Linux 7.2. You can grab them from ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/postfix/ or ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/sendmail/ Please read the INSTALL.TXT on the ftp server or README.SuSE within the package carefully. Thanks. If your sendmail.cf file is not generated by SuSEconfig, please check /etc/mail/linux.mc to see, which m4 macros are needed to configure sendmail for use with amavis. Postfix users currently always have to configure postfix themselves, but this should not too difficult :-) The amavis-(sendmail|postfix) RPM is an updated version of amavis-perl-11, which fixes some minor issues. The amavisd-(sendmail|postfix) RPM is a recent CVS snapshot, as the official amavisd-snapshot-20010407 has some bugs, which have been already fixed in CVS. amavisd is in general faster than amavis-perl, as forking a child is faster than creating a new perl process for every mail. Feedback, is of course, very welcome. But please do not "spam" suse-security with amavis-related questions ;-) RPM-related issues should be reported to me directly and amavis questions in general should be asked in our amavis-user mailing list (see www.amavis.org). Thank you. best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

Amavis...
by StarTux 24 Jun '01

24 Jun '01

Do I need to do anything in particular to my firewall? (The nice SuSEfirewall2 :-)). amavis-milter: amavis-milter: connect[19459]: inet_pton failed I have RTFM already....By the way if you RTFM you will find out that amavis does indeed support Postfix, Qmail and Exim, but you need to configure/install it yourself. More information at www.amavis.org Thanks for the package! Matt -- "The only thing complex about Linux are the users themselves."

3 3

Firewall questions
by Dallam Wych 24 Jun '01

24 Jun '01

Hi All, I am using SuSE 7.1. Having finally gotten online, I need to learn about using SuSE firewalls. This is new to me so I have the following questions. First, should I use the firewall that came in the distro or is the firewall2 Alpha on Marcs page better? Should I then use SuSE harden as well? Finally, I would like to learn more about firewalls so that I don't have to ask questions like this one :o). So what would be some good books to read on the subject? Thanks, Dallam _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

1 0

iptables and squid
by Dirk Ertl 23 Jun '01

23 Jun '01

Helo Folks, I still got a problem to set iptables for my Proxy Squid. All other doing well, but I think with Squid I have an understanding problem. My Gateway has three nic`s. IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN My conception is squid runs as an lokal service on this Gateway. So I have to write a rule with --dport 3128 for an INPUT way to and an OUTPUT way back on Interface eth2, because Squid is running as an lokal service. Squid himself has to leave that Gateway to the Internet on Interface $IF_WAN with --dport 80 to --sport 80 and comes back as it goes. The meens to write a rule with OUTPUT and INPUT on $IF_WAN. But it doesn`t work. I also think about a FORWARD rule but is my conception so wrong?? Dirk

1 0

RE: [suse-security] open ports, once again...
by McCaffity, Ray 23 Jun '01

23 Jun '01

32785, are you running NFS? is nfsd running? Ray -----Original Message----- From: Markus Kohli [mailto:kohli@dplanet.ch] Sent: Friday, June 22, 2001 10:12 AM To: suse-security(a)suse.com Subject: [suse-security] open ports, once again... Hi list! Once again boggling your mind with an open-ports-question: nmap -ap shows the following ports listening: tcp 0 0 *:8007 *:* LISTEN - tcp 0 0 *:6000 *:* LISTEN - tcp 0 0 *:http-alt *:* LISTEN - tcp 0 0 *:32785 *:* LISTEN 1214/kdeinit: kxmlr tcp 0 0 *:ssh *:* LISTEN - tcp 0 0 *:ipp *:* LISTEN - -- I know what ssh is, what http is, and that 6000 is the X-WindowSystem port. But what about the others? Especially 32785? Btw, just updated my system to 7.2, and those ports weren't there, I think. Plus, nmap -sT reveals an http-proxy open. How do I close that one? Don't need it, I guess.. Thanks a lot markus __________________________________________________________________________ The computer revolution is over. The computers won. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

FW: [suse-security] Amavis...
by McCaffity, Ray 22 Jun '01

22 Jun '01

unsubscribe -----Original Message----- From: Rainer Link [mailto:link@suse.de] Sent: Friday, June 22, 2001 2:42 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Amavis... On Fri, 22 Jun 2001, StarTux wrote: > Do I need to do anything in particular to my firewall? (The nice > SuSEfirewall2 :-)). > amavis-milter: amavis-milter: connect[19459]: inet_pton failed Hum, amavis-milter communicates via unix domain sockets. Does it work if SuSEfirewall2 is stopped? > I have RTFM already....By the way if you RTFM you will find out that > amavis does indeed support Postfix, Qmail and Exim, but you need to > configure/install it yourself. More information at www.amavis.org Well, I know ;-) Did I say anything else? As we do not ship qmail and exim RPMs, I won't create RPMs of amavis for qmail/exim in the near future. There is an amavis RPM for postfix, but it was build for our SuSE eMail Server II (it works with the old version, too). > Thanks for the package! Thanks :-) best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

[suse-security] open ports, once again...
by Markus Kohli 22 Jun '01

22 Jun '01

Hi list! Once again boggling your mind with an open-ports-question: nmap -ap shows the following ports listening: tcp 0 0 *:8007 *:* LISTEN - tcp 0 0 *:6000 *:* LISTEN - tcp 0 0 *:http-alt *:* LISTEN - tcp 0 0 *:32785 *:* LISTEN 1214/kdeinit: kxmlr tcp 0 0 *:ssh *:* LISTEN - tcp 0 0 *:ipp *:* LISTEN - -- I know what ssh is, what http is, and that 6000 is the X-WindowSystem port. But what about the others? Especially 32785? Btw, just updated my system to 7.2, and those ports weren't there, I think. Plus, nmap -sT reveals an http-proxy open. How do I close that one? Don't need it, I guess.. Thanks a lot markus __________________________________________________________________________ The computer revolution is over. The computers won.

2 1

Not really security but deals with admin. Any help appreciated.
by Wade Chandler 22 Jun '01

22 Jun '01

Hello, I'm trying to set up some port forwarding for ftp. I would like to be able to forward port 2021 and 2020 as an ftp service to an internal machine on our network. I don't have any documentation on this. I know how ftp services work with a control connection and a data connection. I have the control connection working fine, but the data connection of course is not working. I am forwarding 2021 to port 21 on the internal machine, but I don't know how to get the server(internal) to use port 2020 for data even if I was forwarding from 2020 -> 2020. I know that I can't just forward an ftp data connection off of a non standard port to 20 and expect that to work right because of the ftp commands to change ports. This seems like one hell of a problem, and any help would be greatly appreciated. Thank you. Please let me know if I need to clarify the issue. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal.

3 3

RE: [suse-security] Not really security but deals with admin. Any help appreciated.
by Wade Chandler 22 Jun '01

22 Jun '01

Bjorn, Not really. The problem you are faced with in ftp is that there are two connections. There is a control connection which is a standard telnet type of connection, and then you have a data connection. This wouldn't be such a problem, but the data connection port can be changed by the server or the client depending on passive or active mode. So, forwarding one port number by itself is impossible for the data connection because of the dynamics it involves. Another group member wrote me about one of the packages called ftp-proxy. He said it looks like it will do the trick. I hope. For now I am just making samba mounts and creating links to them in user accounts as needed to a 2000 machine. Thanks for you time man. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal. -----Original Message----- From: Björn Engels [mailto:BEngels@lanworks.de] Sent: Thursday, June 21, 2001 6:49 PM To: Chandler, Wade - Consultant/Winston-Salem Subject: RE: [suse-security] Not really security but deals with admin. Any help appreciated. Hi It's too late for me now to think about that problem seriously, but could that have to do with passive / active mode ftp ? Bjoern -----Original Message----- From: Wade Chandler To: suse-security(a)suse.com Sent: 6/21/01 11:42 PM Subject: [suse-security] Not really security but deals with admin. Any help appreciated. Hello, I'm trying to set up some port forwarding for ftp. I would like to be able to forward port 2021 and 2020 as an ftp service to an internal machine on our network. I don't have any documentation on this. I know how ftp services work with a control connection and a data connection. I have the control connection working fine, but the data connection of course is not working. I am forwarding 2021 to port 21 on the internal machine, but I don't know how to get the server(internal) to use port 2020 for data even if I was forwarding from 2020 -> 2020. I know that I can't just forward an ftp data connection off of a non standard port to 20 and expect that to work right because of the ftp commands to change ports. This seems like one hell of a problem, and any help would be greatly appreciated. Thank you. Please let me know if I need to clarify the issue. Wade Chandler Lead Developer Metro IT Solutions Triad Division: Winston Salem, NC http://www.metrotriad.com http://www.metrois.com wade.chandler(a)metrois.com FAVORITE SITES: http://www.javasoft.com <-- Suns main java web site. http://www.ddj.com <-- Dr. Dobbs Journal. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] PGP keyserv
by jochen mader 22 Jun '01

22 Jun '01

> Why not just use the existing servers? It's for an intranet and a vpn where people should only be allowed to exchange mails internally without access to the internet.

1 0

no security alerts recently
by Bob Vickers 22 Jun '01

22 Jun '01

Hello, Is there something wrong with the security announcement system? If you look on the SuSE web site http://www.suse.de/en/support/security/index.html there have been no alerts since 3rd June, and I don't recall any e-mail alerts either. But if you look at the update area http://www.suse.de/en/support/download/updates/71_i386.html there have been 6 security updates in this period. At least one of these (samba) is a major hole. People should not be expected to subscribe to high-volume technical mailing lists to know about security updates, the security announcement list should be sufficient. Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

3 3

RE: [suse-security] Masquerading or proxy-ing? (general question)
by Reckhard, Tobias 22 Jun '01

22 Jun '01

> If you want to set up a (small) site, with one internet connection, an > internal LAN with windows machines/users, and a linux box to serve as > internet gateway, and you should provide e-mail, dns, and web surfing > (nothing more, not instant messaging, no streaming media downloads, no > fancy > stuff), what would be better to use on the (SuSE) linux box: firewalling + > masquerading, or firewalling + proxy-ing (e.g. squid). I am asking this > from > the security point of view (which setup is "more" secure?). In both cases > the linux box will run an e-mail server and a dns server. > That depends on which applications you trust more to be secure: the proxies or the applications on the user's hosts. I know what I prefer... Tobias

1 0

Masquerading or proxy-ing? (general question)
by Dragos Alexandru Jula 22 Jun '01

22 Jun '01

Hello, (excuse me if this was discussed before) I am writing because I have an (yet unresolved) argument with some computer friends: If you want to set up a (small) site, with one internet connection, an internal LAN with windows machines/users, and a linux box to serve as internet gateway, and you should provide e-mail, dns, and web surfing (nothing more, not instant messaging, no streaming media downloads, no fancy stuff), what would be better to use on the (SuSE) linux box: firewalling + masquerading, or firewalling + proxy-ing (e.g. squid). I am asking this from the security point of view (which setup is "more" secure?). In both cases the linux box will run an e-mail server and a dns server. Thank you in advance, Dragos Jula

1 0