June 2001 - openSUSE Security - openSUSE Mailing Lists

failure notice
by t0m 22 Jun '01

22 Jun '01

Hello, I'm not sure if I understand exactly what you need. If you have something like is on a small scheme... / INTERNET -- box_1 --+-- box_2 \ ... and on the box_1 you want to have open ports 2020 and 2021 through the which all packets you want to forward to the box_2 where is open ftp on 21 port you need to: open both ports 2020 and 2021 on box_1 forward both to 127.0.0.1 to port e.g. 10001 and 10002 after forward from 127.0.0.1:1000{1,2} to the box_2:21 Do I understand you problem good? regards, tom > Hello, > > I'm trying to set up some port forwarding for ftp. I would like to be [snip]

1 0

AW: [suse-security] Ipsec + firewall
by Schulz, Wolfgang 22 Jun '01

22 Jun '01

Thanks for your help! One more question regarding our configuration: I forgot to mention that we have in the internal nets private addresses which are masqueraded at the firewall. Due to different reasons we need the the masquerading (no way to use proxies). Is there any way to use masquerading and ipsec on the same gateway (firewall)? If this is not possible with ipsec - is this maybe possible with cipe (I only know the name till now). Thanks Wolfgang > -----Ursprüngliche Nachricht----- > Von: Tobias Gewinner [mailto:gewinner@tmt.de] > Gesendet: Dienstag, 19. Juni 2001 23:24 > An: Schulz, Wolfgang > Cc: suse-security(a)suse.com > Betreff: Re: [suse-security] Ipsec + firewall > > > On Tue, Jun 19, 2001 at 05:55:09PM +0200, Schulz, Wolfgang wrote: > > Hi list! > > > > As soon as we start the firewall script (Version 4.1) ipsec > doesn't work > > anymore. > > I remember having the same problem in the past. AFAIK the > firewalls must > accept incoming requests from the outside on port 500/UDP. Also the > firewall doesn't know the net behind his partner, so any input from > these IPs to the internal net is denied. > > I remember that I set the following ipchains rules (or something like > that) manually on both machines: > > On firewall A this (may have) looked like > > ipchains -I forward -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I input -b -s [local net B] -d [local net A] -j ACCEPT > ipchains -I output -b -s [local net B] -d [local net A] -j ACCEPT > > and on firewall B you must swap the networks, of course ;-) > > After that it worked fine for me. I think you can set these rules > in /etc/rc.config.de/firewall-custom.rc.config > > Greetings! > -- > ----------------------------------------------------------------- > Tobias Gewinner <gewinner(a)tmt.de> > Fachinformatiker i.A. TMT InterNETworks GmbH > Phone: +49921560716-0 Maxstrasse 4 > Fax: +49921560716-18 D-95444 Bayreuth > ----------------------------------------------------------------- >

4 4

RE: Re[2]: Re: [suse-security] FTP over SSH
by Reckhard, Tobias 21 Jun '01

21 Jun '01

> For tunneling a FTP connection via SSH, please have a look at > > http://www.ccp14.ac.uk/ccp14admin/security/secure_tunnelling_ftp.htm > I am under the impression that the solutions provided at the above link do indeed work as I suggested, i.e. the control connection is tunneled via SSH, but the data connection occurs outside of that tunnel, as is indicated by the link to 'SSH Tunneling via ProFTPD' on the page above. Note also that they have active and passive FTP mixed up in the quoted post titles 'Something to keep in mind'. HTH Tobias

6 9

RE: Re: [suse-security] FTP over SSH
by Vitaly Shishakov 21 Jun '01

21 Jun '01

scp is quite familiar to me, but in my case it used to hang up suddenly, especially accessing via dialup from windows putty or cygwin-ported openssh clients. so i need something else. What i want to figure out, is that how should i make it in the way, i saw once in one company. They used usual SSH port forwarding (using Secure CRT client for Windows) to access their web-server via ftp. (so, they just pointed their browsers to localhost:localport). Unfortunately, i do not remember, if they did it in active or passive mode, and i cant contact their former admins to figure out how they did it. sftp is a command line tool, and the solution described above should work with most FTP clients, (like Windows Commander in Windows) bobv(a)cs.rhul.ac.uk, shift(a)cmpd2.phys.msu.su wrote: > >Vitaly, >scp is good if you know exactly what files you want to copy. If you prefer >an interactive line-mode ftp-style mode of working then you can use sftp. >Both server and client are included in the 7.2 openssh package, but some >earlier versions only included the server. >Bob > On Wed, 20 Jun 2001, Vitaly Shishakov wrote: >> Dear all, >> >> How can arrange an FTP_over_SSH solution on my server. >> what server toolswould i need for that? >> >============================================================== >Bob Vickers R.Vickers(a)cs.rhul.ac.uk >Dept of Computer Science, Royal Holloway, University of London >WWW: http://www.cs.rhul.ac.uk/home/bobv >Phone: +44 1784 443691

2 1

FTP over SSH
by Vitaly Shishakov 21 Jun '01

21 Jun '01

Dear all, How can arrange an FTP_over_SSH solution on my server. what server toolswould i need for that? Thanks for help, Vitaly.

6 7

Re: [suse-security] Fetchmail
by Roman Drahtmueller 21 Jun '01

21 Jun '01

> From: Robert Davies <Rob_Davies(a)NTLWorld.Com> > To: Roman Drahtmueller <draht(a)suse.de>, > Rainer Buesching <rainer.buesching(a)autohaus-pickel.de> > Cc: suse-security(a)suse.com > Date: Wed, 20 Jun 2001 15:28:45 +0100 > Subject: Re: [suse-security] Fetchmail [...] > Is there a reason not to go with latest 5.8.x of fetchmail? I'd been > considering it anyway, and some of it allows things like NTLM support which > would be good for folk forced to connect to M$ Exchange. There is: Compatibility. We will try to avoid new versions in applications like this. People tend to have large setups, and whole companies depend on the mail delivery by fetchmail. If a small feature is changed, then the whole construction falls apart. There are many packages that are handled this way here at SuSE. Other packages get update to the newest version (such as crypto stuff, and software with too many changes, or where versioning is important). I can understand why people may not like this, but we don't make an operating system just to play with, you should be able to _work_ with it. If you want to have a bleeding-edge operating system then upgrade to the latest SuSE-release, or recompile the source rpm from the newer distribution on your older dist. > > Rob > > PS. I suspect my use of case has prevented me from sending to the list. > Changed hostname part, though I'm going to try to resubscribe at some point. You should do so... Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - -

1 0

RE: Re: [suse-security] FTP over SSH
by Reckhard, Tobias 21 Jun '01

21 Jun '01

> What i want to figure out, is that how should i make it in the way, i saw > once in > one company. > > They used usual SSH port forwarding (using Secure CRT client for Windows) > to > access their web-server via ftp. (so, they just pointed their browsers to > localhost:localport). Unfortunately, i do not remember, if they did it in > active > or passive mode, and i cant contact their former admins to figure out how > they did > it. sftp is a command line tool, and the solution described above should > work > with most FTP clients, (like Windows Commander in Windows) > I don't see how FTP can work with SSH's port forwarding, as you need to know the destination port beforehand in order to have sshd listen on that port. FTP's data connection setup always involves a dynamically assigned destination port, there's no difference between active and passive FTP there. The direction of the connection setup is different between the two, but the destination port is always dynamic and thus you'll have a hard time anticipating it. However, I suppose it is very possible to tunnel the FTP control connection via SSH and still have data transfer work, albeit *in the clear* outside of the tunnel. SSH does not parse the control connection in any way, so any PORT commands across it will arrive just fine and the data connection will be established outside of the SSH tunnel. This is what I expect happened at the shop you mention. But all of this is completely unproven and I haven't looked in any SSH documentation while writing this, so it's only a hunch. Cheers, Tobias

2 1

Ip Chains.
by Wilhelm Tesnaar 20 Jun '01

20 Jun '01

Hi all, I have a problem with ipchains and the Suse-firewall script. I have more than one IP bound (Through IP Aliasing) to my external interface. However if I run the Script, All traffic passes through for say eth0, but for any of the other "Virtual interfaces", it doesn't allow any traffic through. What would the rule look like for Passing SMTP from the net through to the firewall using an interface called eth0:1 ipaddress 10.0.0.63 and internal net int of 192.168.0.254 Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: Schulz, Wolfgang [mailto:W.Schulz@ove.at] Sent: Tuesday, June 19, 2001 5:55 PM To: SUSE (E-Mail) Subject: [suse-security] Ipsec + firewall Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria -------------------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

6 11

Re: [suse-security] Fetchmail
by Christian Laursen 20 Jun '01

20 Jun '01

Christian Laursen <xi(a)borderworlds.dk> writes: > Roman Drahtmueller <draht(a)suse.de> writes: > > > > Hi, > > > > > > the new version of fetchmail on the SUSE-Server do not work with > > > multidrop !!!! > > > > Very informative, thank you. > > > > As long as this bug report is not followed by just a little bit more > > information, I have to consider it non-existent. > > I can confirm, that the upgraded version has problems. > > I will try to make a useful bugreport when I get home from work. I tracked it down to my pop3 server not supporting the AUTH command. After I fixed that everything works perfectly again. -- Med venlig hilsen Christian Laursen

1 0

Re: [suse-security] FTP over SSH
by Andreas Rittershofer 20 Jun '01

20 Jun '01

> > What solution do you recommend when there are Windows-Clients and > > users with low skills? > > Andreas, > > My favorite is WinSCP. You can find the home page via google. THIS ONE is really good, thanks for this tip!! mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

1 0

SuSEfirewall2 and connect from internal net to extern interface
by Christoph Kiehl 20 Jun '01

20 Jun '01

Hi, topic got a bit long ;). I'm running SuSEfirewall2 version 1.0 and have the problem that i can not reach services on the firewall through the external interface(ppp0). This is not a real problem, except that I run oracle on this machine an it seems like the oracle listener binds the connection to the external ip. This leads the firewall to filter any following packages and the connection times out :(. If anyone has a solution how to tell oracle to use only a specific interface, or how to tell SuSEfirewall to not filter packets from the internal net to the external interface - please let me know ;) Regards Christoph ps: I know it's not a good idea to run oracle on a firewall but it's only for testing purposes

1 0

POP Issue
by Scott Lindstrom 20 Jun '01

20 Jun '01

Hello all, I think I have an authentication problem with my Sparc version of SuSE 7.1 and I am hoping someone can help me with this. I have enabled pop3d in inetd.conf and done the killall -HUP inetd thing. hosts.allow: ALL:172.16.17.3 <-----this is my workstation from which I will be retrieving pop mail from this server <would popd or pop3d work instead?> hosts.deny ALL:ALL /etc/pam.d/pop #%PAM-1.0 auth required /lib/security/pam_unix.so account required /lib/security/pam_unix.so The pop server is not properly authenticating my pop retrieval commands: Here is /var/log/mail: Jun 20 08:13:58 gateway ipop3d[5975]: pop3 service init from 172.16.17.3 Jun 20 08:14:01 gateway ipop3d[5975]: Command stream end of file while reading lin e user=sdl host=riley.slindstrom.net [172.16.17.3] Here is /var/log/messages: Jun 20 08:16:22 gateway ipop3d[6010]: connect from 172.16.17.3 (172.16.17.3) Jun 20 08:16:22 gateway ipop3d[6010]: Login failure user=sdl host=riley.slindstrom .net [172.16.17.3] What am I missing? Do I need to add something to the /etc/pam.d/pop file? Your assistance is greatly appreciated! Thanks a lot! Scott

1 0

sendmail 8.10.x relaying
by Philipp Snizek 20 Jun '01

20 Jun '01

Hi list-users, is there a way how to make mail relaying username/password dependent and not host, domain or subnet dependent? Goal would be: 1. everybody can send mail to the MTA. 2. Only authenticated users with passwords can use the MTA for relaying mail from ANY host / domain / subnet etc. is there a way how to do it with sendmail? Thanx a lot. Philipp

3 2

strange SuSEfirewall configuration delivered in original distribu tion
by Bruenner, Joerg 20 Jun '01

20 Jun '01

Hi everybody, trying to setup the SuSEfirewall I discovered some strange content of the SuSEfirewall_init, -_setup and -_final scripts. I'm using 7.1 as distributed via CD, no patches are installed. Kernel: 2.4.0-4GB. The scripts contains at line 28ff a case statment, marked as comment. It contains at line 52 the return=$rc_done statement, marked as comment too. The firewall does not work with the original script. It worked fine if set the commented lines back in operation. What's the sense of the original comments??? Thanks a lot Joerg -- /*-------------------------------------------------------------------- Joerg Bruenner Commerzbank AG, ZIT D E-Commerce Hafenstrasse 51, D-60327 Frankfurt am Main Tel.: +49 (0)69 136 28289, Fax: +49 (0)69 136 28252 eMail: joerg.bruenner(a)commerzbank.com --------------------------------------------------------------------*/

1 0

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

Hi List, I'm not quite sure, if this means anything, but perhaps somebody could explain to me, what was happening, Tanks in advance. This is, what the log says : sshd[17874]: connect from 61.139.252.156 sshd[17874]: log: Connection from 61.139.252.156 port 2953 sshd[17874]: log: Could not reverse map address 61.139.252.156. sshd[17874]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:2983<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.51 ports 22, 80, 443, 1024, 1080, 1313, 1352, 1433, 1494, ..., ???p?uxy, TTL 39 @11:26:00 sshd[17875]: connect from 61.139.252.156 sshd[17875]: log: Connection from 61.139.252.156 port 3099 sshd[17875]: log: Could not reverse map address 61.139.252.156. sshd[17875]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:3129<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, 1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 sshd[226]: log: Generating new 768 bit RSA key. sshd[226]: log: RSA key generation complete.

2 1

Re: [suse-security] Fetchmail
by Christian Laursen 20 Jun '01

20 Jun '01

Roman Drahtmueller <draht(a)suse.de> writes: > > Hi, > > > > the new version of fetchmail on the SUSE-Server do not work with > > multidrop !!!! > > Very informative, thank you. > > As long as this bug report is not followed by just a little bit more > information, I have to consider it non-existent. I can confirm, that the upgraded version has problems. I will try to make a useful bugreport when I get home from work. -- Best regards Christian Laursen

2 1

ipv 4 and ipv 6
by Joop Boonen 20 Jun '01

20 Jun '01

Dear all, Does someone have some experiance with the use of ipv4 and ipv6 as in. ipv4 on the internet and ipv6 on you internal network? If so which program dit you use for the translation? How can you handle the dns requests as the internet doesn't use ipv6 etc? Regards, Joop Boonen.

1 0

Fetchmail
by Rainer Buesching 20 Jun '01

20 Jun '01

Hi, the new version of fetchmail on the SUSE-Server do not work with multidrop !!!! Thanks Rainer Buesching

3 2

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

>>From: Andreas Meinerzhagen >> >>I'm not quite sure, if this means anything, but perhaps somebody could >>explain to me, what was happening, >> >>This is, what the log says : >[...] >>scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >>1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 >You have been portscanned by 61.139.252.156. I guessed so, but wasn't sure. Now, as I find no further Entry from this guy, it looks, as we would be safe for now. Thanks to all those fine skripts like harden_suse, etc. Thanks to the List, Andreas

1 0

RE: [suse-security] What does this mean ?
by Björn Engels 20 Jun '01

20 Jun '01

>From: Andreas Meinerzhagen > >I'm not quite sure, if this means anything, but perhaps somebody could >explain to me, what was happening, > >This is, what the log says : [...] >scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 You have been portscanned by 61.139.252.156. Bjoern Engels

1 0

Is this config vulnerable?
by ryanm3＠eircom.net 20 Jun '01

20 Jun '01

I am running the following services on my SuSE 6.4 box: Port Service version comments 21 in.ftpd 6.4/OpenBSD/Linux-ftpd-0.16 2 users allowed access strong passwords enforced 25 sendmail 8.9.3 53 named BIND 8.2.3-REL 80 httpd Apache 1.3.12 PHP/3.0.15, mod_perl/1.21 110 rinetd 0.61 POP3 requests redirected to another machine 443 https Apache 1.3.12 According to an nmap port scan, all other ports up to port 1024 are in state filtered. Anything from port 1024 up is closed. My question is whether this box is vulnerable in its current state and if so, what should I be doing to secure it? Tnx, MR

8 14

Snort
by Sp0oKeR 19 Jun '01

19 Jun '01

Can somebody tell, if I can drop packet with snort? Ou I just log and alert? If I can, how I do this? Thanks ... regards! -- #=============================# # Rodrigo Ribeiro Montoro # # Network Services Center # # rodrigo(a)nscenter.com.br # # Sao Paulo - SP - Brazil # #=============================#

5 5

RE: [suse-security] Ipsec + firewall
by Stefan_Walther＠gehag-dsk.de 19 Jun '01

19 Jun '01

Hi I don't know the correct ports but, you can resolve the ports if you lock in your firewalllog and in /etc/services MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 "Schulz, Wolfgang" An: "SUSE (E-Mail)" <suse-security(a)suse.de> <W.Schulz@ove Kopie: .at> Thema: [suse-security] Ipsec + firewall 19.06.01 17:55 Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria -------------------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Ipsec + firewall
by Schulz, Wolfgang 19 Jun '01

19 Jun '01

Hi list! We are using in an test environment on 2 "firewall PC's" with SuSE 7.0 + ipsec. The configuration looks as follows: Local net A --- firewall 1 --- untrusted net --- firewall 2 --- local net B As soon as we start the firewall script (Version 4.1) ipsec doesn't work anymore. Does anyone have already experience which ports I have to open in the firewall script so that ipsec is working? Thanks for your help Wolfgang --------------------------------------------------------------------- Dr. Wolfgang Schulz Tel.Nr.: +43-1-3180566-12 ALDIS Fax: +43-1-3180566-9 Kahlenberger Str. 2b Mobil: +43-676-3566438 A-1190 Wien Email: w.schulz(a)ove.at Austria --------------------------------------------------------------------

2 1

Apache + mod_ssl
by Robert Szentmihalyi 19 Jun '01

19 Jun '01

Hi, could someone please point me in the right direction on how to set up Apache with SSL using Apache 1.3.19 / mod_ssl (SuSE rpms) on SuSE Linux 7.1? Do I have to compile from the sources? Kind regards, Robert Szentmihalyi

2 1