June 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Harden-SuSE 3.4
by Bjoern Engels 12 Jun '01

12 Jun '01

Am Montag, 11. Juni 2001 17:26 schrieb Douglas J. Hunley: > I came into this late.. where can I get this script? thanks! Get it at http://www.suse.de/~marc/SuSE.html > Douglas J. Hunley (Linux User #174778) Bjoern

1 0

Post-attack advice
by Chris Quinn 12 Jun '01

12 Jun '01

Greetings: Last night my oldest (2.2.13) SuSE Linux box was attacked. Ironically, I was shelled in from another machine working on setting up a firewall script on this machine when the attack occurred. I noticed an un usual amount of network traffic and looked over the log files to discover that scanlogd was reporting repeated port scans from 10-15 foreign IPs. I have seen this sort of thing before and was not terribly concerned until text was printed to my terminal console. I then noticed that /etc/motd had been modified and became very concerned. Although a firewall was not running when the attack occurred, most services (except ssh, http, pop3, smtp and ftp) were disabled, tcp wrappers were configured, hosts.deny and hosts.allow were configured, etc. I have been pretty good about updating packages as security announcements were made. I looked at all recently modified files and ran tripwire but could find very little changes. I believe that a directory was created ("/usr/lol" I think) and /etc/motd was changed. Also, ports were open that I don't recall being open before: 6711 and 31965. I don't know what services use these ports. I am a Linux security novice and would appreciate feedback regarding 1) how this attack may have been accomplished and 2) what I should do to secure this box. I am working on configuring a firewall script but am afraid I might miss some security flaws created by the attackers. Any advice would be appreciated. Thanks. Chris Quinn

7 8

Re: [suse-security] Ethernet Gateway from 3Com
by jmars＠sears.com 11 Jun '01

11 Jun '01

I have used the Linksys 4-way with no problems. If you consider it works as a 4 way 10/100 mbit hub in addition to being a firewall it has been rather handy. It saves on space and I suspect power consumption. I set up the Lan with static IP addresses and left the DHCP client up on the WAN side. If you do not have a hub already I would definitely consider it. Rick Green <rtg(a)mich.com To: Markus Kohli <kohli(a)dplanet.ch> > cc: suse-security(a)suse.com Sent by: Subject: Re: [suse-security] Ethernet Gateway from 3Com rtg(a)aapsc.com 06/07/01 10:45 PM On Thu, 7 Jun 2001, Markus Kohli wrote: > Hi people! > > Maybe this is off-topic, but it's although very much security relates, so I > ask this anyway... > Does anybody of you have any experiences with the Ethernet Gateway 3C510 > from 3Com? > It has 4 RJ45 ports, a printer-server (windows) and so on... > They say, it has a firewall built-in, and it is easy to configure. > Would this be the solution to my problem of wanting to connect 3 pc's > (actually 2 desk and 1 lap) to a cable-modem? > An important point is, that the modem remembers the MAC-Adress of a network > device, it is connected to, so if I wanna change PC, I have to reset the > modem :( > > Any help would be greatly appreciated > > > kind regards > > Markus I'm not familiar with the 3Com product you mention, but I have successfully used the Linksys "Etherfast Instant Broadband" router/hub on two different cable systems. It supports DHCP or PPPoe on the WAN side, NAT, a DHCP server on the LAN side, and some minimal port forwarding capabilities. (No print server that I'm aware of...) Of the three installations I am aware, it has been rock-solid reliable. I've used the 4-port model, but I understand it's also available in one-port, eight-port, and 802.11b versions. I've also accomplished the same functionality (and more!) using a surplus 486-66, 16MB of RAM, two NICs, a single floppy drive, and a copy of freesco (www.freesco.org). For my own use, where surplus hardware is available and appearance isn't important, freesco was my choice. For a client who's paying for my time as well as the hardware, the Linksys at $129 was hard to beat. -- Rick Green "I have the heart of a little child, and the brain of a genius. ... and I keep them in a jar under my bed" -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

openssh-2.9
by Roman Drahtmueller 11 Jun '01

11 Jun '01

Hi together, openssh packages will show up on the ftp servers at the usual location (before 7.1 -> ftp.suse.de, after + including 7.1 -> ftp.suse.com). If you like, try them out. The packages contain a fix for the recently found problem that all files called "cookies" can be deleted, in addition to half a ton of more problems that have been corrected. As usual, the packages are gpg-signed. Something administrative: The list currently only operates with the address suse-security(a)suse.com, suse-security(a)suse.de does _NOT_ work. Mads M. Joergensen + Christopher Mahmood will have a look at this. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

5 6

Very strange mail
by Nash Hoogwater 11 Jun '01

11 Jun '01

Hi list, I got some very strange mail a few minutes ago and a week ago also. Maybe someone can help me with this. The mail doesn't contain a reply-adres, subject and almost no headers. The date is 1 january 1970 00:59:59. I have pasted the headers and text below. The text is also very strange as you can see. ------------------------------------------------- Content-Type: Status: R X-Status: N 1 3b13ce2000000001 2 3b13ce2000000002 ---------------------------------------------------- Someone??? Any idea??? Greetings, Nash

3 6

Harden-SuSE 3.4
by Bjoern Engels 11 Jun '01

11 Jun '01

Hi, I just installed 7.2 on my box (very good work, SuSE - as far I can say that after having seen it for 2 hours or so !) and I wanted to harden the box with Marc's script. Unfortunately, I'm having the following problems when executing the script: spock:/home/download/SuSEsec/harden_suse-3.4 # perl -w harden_suse-3.4.pl Bareword found where operator expected at harden_suse-3.4.pl line 284, near "m/IPPL || m/ARGUS" syntax error at harden_suse-3.4.pl line 284, near "m/IPPL || m/ARGUS" syntax error at harden_suse-3.4.pl line 287, near "} else" syntax error at harden_suse-3.4.pl line 291, near "} else" syntax error at harden_suse-3.4.pl line 299, near "}" Execution of harden_suse-3.4.pl aborted due to compilation errors. I'm not good in Perl, so does anybody of you have an idea ? Bjoern

2 2

RE: [suse-security] understanding packet filtering
by Reckhard, Tobias 11 Jun '01

11 Jun '01

Hi Togan, > I am trying to understand packet filtering and I am lost in what I am > reading. Quoting from page 217 of Building Internet firewalls on > allowing inbound and outbound SMTP and nothing else as the example. > > It says as follows > > Rule Direction Source Dest Proto Destport Action > ====================================================================== > A in Ext Int tcp 25 Permit > B out Int Ext tcp >1023 Permit > C out Int Ext tcp 25 Permit > D in Ext Int tcp >1023 Permit > E Either any any any any Deny > You need to understand the tables in the book first. As the enumeration following the tables above in the book, rules A and B apply when you have an internal mail server that accepts SMTP from external networks. Rule A says to permit inbound TCP packets from external sources to port 25 on internal destinations (or one destination in most cases). Rule B allows for the packets flying the other way within one TCP 'session'. You could attempt to apply further qualifiers to the rule outlines in B such as demanding the ACK bit or making it a stateful rule. Rules C and D are necessary when mail is transferred from internal hosts to external servers via SMTP. And rule E specifies to drop anything that isn't handled otherwise. Which combination of rules *you* need depends on your setup. Most private users and SOHO setups don't run an SMTP server that's available to the Internet, their email goes to their ISP, a server of his is specified in the domain's MX record. So they require only rules C and D, but not A and B. They might also use their ISP's SMTP server as a smart host and have their internal mail server be the only internal host sending mail. In a setup like that, 'internal' and 'external' in the rules above equate to 'internal mail server' and 'ISP's mail server' respectively. > Now based on the explanations I came out with this ipchains rule but I > am not sure if it it correct or not > > IPC=/sbin/ipchains > $IPC -P Deny -l > $IPC -A in -s Ext -d Int -p tcp --sport 1023: --dport 25 -j ACCEPT > $IPC -A out -s Int -d Ext -p tcp --sport 25 --dport 1023: -y -j ACCEPT > $IPC -A out -s Int -d Ext -p tcp --sport 1023: --dport 25 -j ACCEPT > $IPC -A in -s Ext -d Int -p tcp --sport 25 --dport 1023: -y -j ACCEPT > $IPC -b -s 0/0 -d 0/0 -j DENY > > Am I on the right track or completely away ? > You're moving in the right direction. Here are the mistakes you're making: * The default policy rule syntax is wrong, as has been pointed out already. It should be: ipchains -P input DENY ; ipchains -P output DENY ; ipchains -P forward DENY or a subset thereof. * The names of the built-in chains are input, output and forward, in and out don't exist. * To specify ports above 1023, use '1024:', not '1023:'. ipchains uses inclusive port ranges. * The last rule won't work, as it doesn't specify a chain. The kernel processes the chains for every packet that enters an interface (input), exits an interface (output) or is moved between interfaces (forward). Note also that the rules above will work when applied on the SMTP server or client respectively, *not* on a packet filter sitting between the internal and external networks, *unless* the default policies for input, output and forward are set to accept. In ipchains (or rather, the kernel code that is configured with ipchains), packets travel in the following manner: Network -> [INPUT] -> [FORWARD] -> [OUTPUT] -> Network | ^ +---> local process-----+ So, any packet entering the box traverses at least the input chain. If the packet needs to go to a different interface than the one it entered on, it goes through the forward chain. If a packet needs to go to the network, it goes through the output chain. So, for a packet filter sitting between two networks, you need to make sure your packets make it through all three chains. Note that this has been modified in the 2.4 kernel packet filtering code, which is configured with the iptables tool. Here, only packets bound to or coming from local processes traverse the input and output chains, while traffic routed by the system only go through the forward chain. This is all disregarding the NAT table, BTW. Hope to have helped a bit, sure to have confused... :-/ Tobias

2 1

SuSEfirewall(1) and SuSEfirewall2
by marc＠suse.de 11 Jun '01

11 Jun '01

Hi folks! I am happy to announce that SuSEfirewall2 is now ready for world-wide realiable beta/gamma testing! The code is much more secure than SuSEfirewall(1) because of the change in code and possibilies, and now with the newest 2.4 kernel version the firewall code seems finally to be reliable. So everyone: now is the best time to change from SuSEfirwall to SuSEfirewall2 for better security and faster rule chains. btw if you sometimes change between SuSEfirewall(1) and 2 because you use both, 2.2 and 2.4 kernels, just install SuSEfirewall-4.7 - and SuSEfirewall will start only in 2.2 mode and if in 2.4 mode SuSEfirewall2 is not configured to run. For harden_suse users: download v3.4 for use with SuSE 7.2. Changelog for SuSEfirewall2 1.0: v1.0 10.06.01 GAMMA -> believe it or not - v1.0 is ready to go and should work perfectly for everyone! :-) * Added the new ip-up script which supports SuSE-personalfirewall, SuSEfirewall(1) and SuSEfirewall2 * Added a patch by <martin.schulz(a)videotron.ca>, which fixes some error checking - thanks! * Added loading of a kernel module which is necessary for active ftp (thanks to christian.ernst(a)informatik.fh-hamburg.de) * Added support for devices with no broadcast address (e.g. ipsec stuff) * Autoprotecting mode supports ipv6 global bindings (:::1) now * Fixed a bug in the UDP autoprotecting mode support * Removed TOS stuff for ICMP - resulted in no ping packets being sent. Seems to be a kernel bug :-( netfilter still sucks ... * Updated the documentation * Added bootp config support for interfaces * Added a small README and a converted EXAMPLES file Changelog for SuSEfirewall 4.7: v4.7 .06.01 (gamma release) * added auto service detection for IPv6 services * added support for ipsec and other devices without a broadcast address * if running with a 2.4 kernel, the boot scripts check if SuSEfirewall2 is installed and won't run if detected. This provides you with optimal security and transparent SuSEfirewall* support! :-) Changelog for harden_suse: v3.4 10.06.01 (gamma release) * wont disable some special SuSE 7.2 stuff: CRYPTO_FILESYSTEMS IDLED, POWERTWEAKD, PPTPD, IJB, IPPL, ARGUS, etc. v3.3 06.05.01 (gamma release) * wont disable SNORT, ADSL, NESSUSD and many many other things now which either do not affect security or are security daemons * added LICENCE file (required by SuSE policy) * added special warning about tcp wrapper setup and it effects on sshd v3.2 07.04.01 (gamma release) * added MD5 passwords * changed the undo script creation, after running undo, the log and undo files are not deleted but renamed Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 2

RE: [suse-security] Getting apache to stop displaying banner on e rrors.
by Björn Engels 10 Jun '01

10 Jun '01

You should consider to also use this one: ServerTokens This directive controls whether Server response header field which is sent back to clients includes a description of the generic OS-type of the server as well as information about compiled-in modules. ServerTokens Prod[uctOnly] Server sends (e.g.): Server: Apache ServerTokens Min[imal] Server sends (e.g.): Server: Apache/1.3.0 ServerTokens OS Server sends (e.g.): Server: Apache/1.3.0 (Unix) ServerTokens Full (or not specified) Server sends (e.g.): Server: Apache/1.3.0 (Unix) PHP/3.0 MyMod/1.2 Bjoern

1 0

Re: [suse-security] Slow adsm backup with Suse-firewall
by Alexander Grujic 10 Jun '01

10 Jun '01

Am Donnerstag, 7. Juni 2001 09:27 schrieb Robert Davies: > I don't know what adsm backup is but I haven't noticed any respondes, I'll > make some general observations. adsm is a commercial multi-platform backup suite with server and client side. > > I have set up a firewall (susefirwall 4.3) between the internet and our > > internal network. One thing I have noticed is that the backups have > > slowed down by a factor of 10 ! > > With a non-trivial ipchains ruleset I still had an ftp throughput of > 10MByte/s on 100Mb/s network. Can you check your basic ftp throughput? ftp throughput is nominal ( 1-3 Mbyte/s ). Http seems ok too. Thats whats bugging me, it seems specific to the backup. The hardware should be more than up to the task, the computer used is a dual pentium 200Mhz system. The load on the system is never higher than 0.3. > Have your NICs managed to negotiate the network speed down from Fast to > Good ole' Ethernet? Anything new go into a non-switched 100Mb/s Fast > Ethernet network that could cause fallback to 10Mb/s? How could I check that ? (Sorry for this stuipid question ) > > adsm needs port 1500 and uses a tcp buffersize of 16k. One thing I > > noticed > > is > > > the both interfaces show many collisions. This is the output of ifconfig > > By my calculations your collision rate is insignificant (< 0.5%) 11896 * > 100 / 2487098, however to get meaningful results you need to make the > calculation : > > (Cf - Ci) * 100 / (Tf - Ti) <= r% > > Where Cf and Tf are the final collisions and transmissions, Ci and Ti are > initials, and r% is the acceptable collision rate. Note initials at > beginning of backup run, and finals at end. > > Your error rate seems somewhat high, but again as a percentage it is rather > low. One thing i have noticed is that the error rate grows faster (faster as in errors per transmitted packet not error per timeunit) during backup then during normal operation of the firewall. > If your tcp window size is not large, then you may be dependant on the > round trip times, Novell Netware was very prone to this problem in early > versions, whereas a modern TCP/IP implementation will perform fairly well > on a 'long' but 'broad' pipe. > > > the adsm backup machine is in the external network, connected via a > > 100Mbit > > > ethernet card and the machines that are backed up are in the DMZ, also > > connected via a 100Mbit ethernet card. > > This strikes me as being rather peculier, backup is mish critical, I've > often built 'server' backend networks linking machines in the DMZ specially > for backups, to do them to an 'external' network, rather than an internal > one seems strange. The backup of our departments computers are done by a central authority of our university. I have no influence on the location (neither physical or in adress space) of the backup machine :-(. > That said, how are you buffering your tape drive? Many drives slow > considerably if you cannot match their streaming rate, there is a command > 'buffer' in the non-x application series, which allows efficient buffering, > and with a high -p %, and a large size -s 16M, you can ensure the drive > will be driven at it's streaming rate. I have no information on the hardware used to backup the data, but will check on that. But before installation of the firewall the backup speed was approx. 2 Mbyte/s now it has slowed down to a few hundred kbytes/s. Thanks for the help, Alex.

1 0

understanding packet filtering
by Togan Muftuoglu 10 Jun '01

10 Jun '01

Hi, I am trying to understand packet filtering and I am lost in what I am reading. Quoting from page 217 of Building Internet firewalls on allowing inbound and outbound SMTP and nothing else as the example. It says as follows Rule Direction Source Dest Proto Destport Action ====================================================================== A in Ext Int tcp 25 Permit B out Int Ext tcp >1023 Permit C out Int Ext tcp 25 Permit D in Ext Int tcp >1023 Permit E Either any any any any Deny Now based on the explanations I came out with this ipchains rule but I am not sure if it it correct or not IPC=/sbin/ipchains $IPC -P Deny -l $IPC -A in -s Ext -d Int -p tcp --sport 1023: --dport 25 -j ACCEPT $IPC -A out -s Int -d Ext -p tcp --sport 25 --dport 1023: -y -j ACCEPT $IPC -A out -s Int -d Ext -p tcp --sport 1023: --dport 25 -j ACCEPT $IPC -A in -s Ext -d Int -p tcp --sport 25 --dport 1023: -y -j ACCEPT $IPC -b -s 0/0 -d 0/0 -j DENY Am I on the right track or completely away ? TIA -- Togan Muftuoglu

2 2

Getting apache to stop displaying banner on errors.
by JW 09 Jun '01

09 Jun '01

Hello, By default apache shows it's "name and number" on 404 pages (probably others too): Apache/1.3.14 Server at asdf.com Port 80 I'd like to get rid of that. What's the proper way to remove that? I'd like to have it just give the webmaster@ email address without divulging any info ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

6 5

IPv6 und Firewall-Probleme
by Nicolas Keller 09 Jun '01

09 Jun '01

Hallo! Ich hoffe, ich habe mit diesem Problem die richtige Mailingliste (und Sprache?) getroffen - wenn nicht, sorry! Ich habe seit vorgestern SuSE 7.2 installiert und einige Mühe gehabt, unter dem Kernel 2.4 einen Masquarading Server aufzusetzen. Mittlerweile läuft er zufriedenstellend - dank dem SuSEfirewall2 Skript. Trotz allem habe ich noch Probleme: Zuerst einmal die Ausgabe beim Starten von TDSL und der Firewall beim booten: ******************* dmesg ********************* eth1: NE2000 found at 0x340, using IRQ 5. PPP generic driver version 2.4.1 SuSE-FW-UNALLOWED-ROUTINGIN=eth0 OUT=ppp0 SRC=194.127.177.80 DST=212.227.126.138 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=32210 DF PROTO=TCP SPT=2256 DPT=110 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) IPv6 v0.8 for NET4.0 IPv6 over IPv4 tunneling driver Registered PPPoX v0.5 Registered PPPoE v0.6.5 Installing knfsd (copyright (C) 1996 okir(a)monad.swb.de). eth0: no IPv6 routers present eth1: no IPv6 routers present eth0: no IPv6 routers present eth1: no IPv6 routers present SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=194.25.2.129 \ DST=217.84.122.54 LEN=132 TOS=0x00 PREC=0x00 TTL=60 \ ID=6059 PROTO=UDP SPT=53 DPT=1028 LEN=112 SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=217.5.115.7 \ DST=217.84.122.54 LEN=132 TOS=0x00 PREC=0x00 TTL=56 \ ID=1892 PROTO=UDP SPT=53 DPT=1027 LEN=112 SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=64.245.54.152 DST=217.84.122.54 \ LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=46764 DF PROTO=TCP SPT=3718 \ DPT=41178 WINDOW=32120 RES=0x00 SYN URGP=0 \ OPT (020405B40402080A06D425BB0000000001030300) SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=64.245.54.123 DST=217.84.122.54 \ LEN=60 TOS=0x00 PREC=0x00 TTL=40 ID=45093 DF PROTO=TCP SPT=4397 \ DPT=41178 WINDOW=32120 RES=0x00 SYN URGP=0 \ OPT (020405B40402080A06E98CE30000000001030300) ******************* dmesg ********************* 1. Warum bekomme ich SuSE-FW-UNALLOWED-ROUTINGIN, SuSE-FW-UNALLOWED-TARGETIN und SuSE-FW-ACCEPTIN Meldungen? Stimmt da etwas nicht? SuSE-FW-ACCEPTIN kenne ich noch von der 1er Version des Firewall-Skripts, aber die zwei anderen Meldungen sagen mir leider nichts. 2. Wie bekomme ich die Meldungen wie "eth0: no IPv6 routers present" weg? Ist das überhaupt "schlimm"? 3. Ich bekomme keine Verbindung zu meinem Apache Server - anscheinend kann der Server den Namen nicht auflösen. Alle Namensauflösungen sind aber korrekt in der hosts Datei eingetragen und die search Variable ist auch gesetzt. (Da ich das schon ein paar mal gemacht habe und mir eigentlich sicher bin, dass es kein einfacher Konfig-Fehler ist tippe ich mal auf das ("eth0: no IPv6 routers present"?) Sorry für die vielen Fragen, aber trotz drei Jahre langer SuSE Erfahrung stehe ich da ziemlich im Regen. Vielleicht noch kurz eine Erklärung zum Szenario: Ich habe einen SuSE 7.2 Server mit zwei Netzwerkkarten (eine Realtek und eine NE2000 komp). eth0 geht ins interne Netz und eth1 zu meinem TDSL Modem. Ich habe bis auf das firewall2 Skript nur Pakete benutzt, die bei SuSE 7.2 dabei waren. Nebenbei läuft auf dem Server noch Apache und Squid (wobei man sich hier natürlich dann streiten kann, ob ich Squid brauche wenn ich Masquarading mache). Als Anhang gibt's noch meine rc.firewall2.conf. Schon mal dank an alle Helfer :) & ein schönes Wochenende! Nicolas Keller ******************* firewall2.rc.config ******************* FW_DEV_EXT="ppp0 eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="194.127.177.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_ALLOW_CLASS_ROUTING="no" #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config"

2 1

The new OpenSSH2
by StarTux 09 Jun '01

09 Jun '01

Hi, Just upgraded to the new OpenSSH 2.9 and encountered what I believe is a problem loading the SSH2 part. I get this when reloading the SSH daemon: Starting SSH daemonDisabling protocol version 2. Could not load host key I assume that is because under /etc/ssh/ I do not have ssh_host_key2 key, if this is the case, how do I generate one? Thanks, Matt -- "The only thing complex about Linux are the users themselves."

4 4

New OpenSSH2 fatal error
by Togan Muftuoglu 09 Jun '01

09 Jun '01

I have installed it via Yast on a machine when harden_suse was applied. when I issue the rcssh start comamnd all I am getting back is fatal: cannot bind any address Where do I check -- Togan Muftuoglu

1 0

administrativa
by Roman Drahtmueller 08 Jun '01

08 Jun '01

Hi together, our mailing list server has been rebuilt by Mads Martin Joergensen and Christopher Mahmood on new hardware. We are expecting more performance on our mailing lists as well as better scalability. The two guys have done a nice job at it. If there are any problems, feel free to report them to suse-security-owner(a)suse.de. As of a few minutes ago, the list address suse-security(a)suse.com was the only one that worked. The German list address (suse-security(a)suse.de) should work now for all, thanks to mmj. In addition to the technical news I wanted to ask the community to stronger adhere to the list purpose: If something is security-related, then feel free to ask, if it is not, then please let it be. There is no need to excuse oneself for posting to the list as long as the message fits the purpose of the list. It may be wise to simply ignore messages that do not target security in general or Linux security in particular. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Re: [suse-security] Ethernet Gateway from 3Com
by Bill Light 08 Jun '01

08 Jun '01

Before going to far......I would check out the following link, apparently 3Com is leaving that business..... that old 486 is looking pretty good..... I'd check out 3Com's own site, a press release entitled: "3Com Discontinues Consumer Cable and DSL Modems, Gives Guidance for Q4, FY01 Results" at: http://www.3com.com/corpinfo/en_US/pressbox/press_release.jsp?INFO_ID=20032… - Bill

1 0

diff between tircproxy and ip_masq_irc
by Togan Muftuoglu 08 Jun '01

08 Jun '01

Hi everyone, I am reading Building Internet Firewalls as my assigned homework by the list (OK studying and taking notes to create more questions for the gurus in this list)for irc they also suggest using "tircproxy". Appreantly this is not in the SuSE 7.1 (maybe I have overlooked). What I would like to know is what are the pros and cons of tircproxy compared to ip_masq_irc from the point of security and ease of configuring and stability TIA -- Togan Muftuoglu

1 0

test: ignore
by Christopher Mahmood 08 Jun '01

08 Jun '01

1 0

Cipe and ipchains
by Guido Tschakert 08 Jun '01

08 Jun '01

Hello List: I'am trying to set up a Router with cipe and packetfiltering. "Routing" should be done by using the forward-chain. One question is: where took the cipe-Deamon place? Beetween input- and forward-chain or beetween forward- and output-chain or behind the output-chain or before the input-chain. I believe ciped is beetween forward- and output-chain. but I wouldn't bet on it ;-) Or Do you think it's bad to use ipchains and ciped together on one machine? THX Guido -- ----------------- Guido Tschakert SRC GmbH, SysAd -----------------

1 0

RE: [suse-security] simple gateway
by Stefan_Walther＠gehag-dsk.de 08 Jun '01

08 Jun '01

> hi, > > I have quite a stupid question.... i set a suse 7.0 box as a gateway between a token ring network and a born-and-growing ethernet network.... it's > inside our lan and we're working with private adresses. One of the subnetwork is 192.168.0.x (the token > ring) and the ethernet subnetwork is 192.168.100.x... The gateway hosts 2 nics, one token ring and one ethernet. So far the gateway runs quit good, > but not good enough because i have internet adresses that are visible from a box before my gateway, and not > after my gateway.... > > I used ipchains in order to say "everything that comes and goes can cross", but actually, it does not.... what have I missed ? > > ip_forward is enabled > i added the token ring adress as gateway to the ethernet nic > and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ > > as it is inside our network, I don't want any filter to be active... i just want everything to pass through the gateway back and forth. > > I certainly have missed something important but what ?... > > TIA > Stephane > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com There is some other possibility you can try. We also have a router for tokenring and ethernet. if you dont want to add the route to your ethernet/tokenring (don't know where your internetrouter is connected to) you can have to enable ip-forwarding and add the following line to the ip-chains rules: ipchains -A forward -i <interface where you want to route> -s <sourcenet, where the packets come from> -j MASQ maybe you have to add this in both directions. we did it until we had to reconfigure the router where we add the direct routes. both is working fine, but if you use my suggestion you have problems by using any ftp-connection. the better possibility is given by Andreas Baetz. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

1 0

Re: [suse-security] simple gateway
by Andreas Bätz 08 Jun '01

08 Jun '01

On Thursday 07 June 2001 18:31, stephane parenton wrote: > So far the gateway runs quit good, but not good enough because i have > internet adresses that are visible from a box before my gateway, and not > after my gateway.... > > I used ipchains in order to say "everything that comes and goes can cross", > but actually, it does not.... what have I missed ? > > ip_forward is enabled > i added the token ring adress as gateway to the ethernet nic > and the ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j > MASQ If you don't want masquerading, you probably should do: "ipchains is -A forward -s 0.0.0.0/0.0.0.0 -d 0.0.0.0/0.0.0.0 -j ACCEPT" or just "ipchains -P forward ACCEPT" without any further rules > as it is inside our network, I don't want any filter to be active... i just > want everything to pass through the gateway back and forth. If you don't want any filter, you could also do echo 1 > /proc/sys/net/ipv4/ip_forward 2> /dev/null ipchains -P input ACCEPT ipchains -P output ACCEPT ipchains -P forward ACCEPT or completely go without any ipchains rules (forwarding needs to be turned on, though) Also you could check if the routing from and to your ethernet is known by all other routers in your net. (especially, in your case, your router to the internet) Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

Re: [suse-security] APOP - help
by Peter Nixon 08 Jun '01

08 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 08:51 PM 7/06/2001, you wrote: >Hi All > >I'm running SuSE 6.4 and I have installed the SuSE 7.0 POP.RPM on my SuSE >6.4 installation. > >I ran "popauth -init" to create the popauth.DB. > >When I try to download pop3 mail using Secure Password Authentication with >Outlook Express 5 as the mail client it fails with the following errors. > >popper[18243]: @warrior.bidorbuy.co.za: -ERR Too few arguments for the auth >command. >popper[18243]: @warrior.bidorbuy.co.za: -ERR POP EOF received > >Q. Do u still need to recompile popper or does it work straight away without >recompiling? SPA != APOP :-( >Q. Can you use "Secure Password Authentication" with POP3s (i.e. PoP3 with >SSL port 995) or > Can you only use one or the other, but not both? See above. >Q. Is the user name and password encrypted when using POP3 with SSLWRAP? Yes.. SSLwrap is very simple to setup in this manner, I have been meaning to add it to the FAQ, but have been too busy. Mail me if you need help with this.. -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBOyAnBQHHbFLfaSY8EQJq6gCg38mBtYVN9BQ0LrEgTIRQzdEZsdAAoKdN PfHwo6CxrnDPT0F+SF2D7noZ =QEjd -----END PGP SIGNATURE-----

1 0

security problem?
by jonathan 08 Jun '01

08 Jun '01

Tonight this popped up in the log file, could someone help me here. Is this someone trying to flood me or is it something else? Thanx! Jun 7 21:11:08 gumby kernel: NET: 1 messages suppressed. Jun 7 21:11:08 gumby kernel: neighbour table overflow Jun 7 21:11:12 gumby kernel: NET: 1 messages suppressed. Jun 7 21:11:12 gumby kernel: neighbour table overflow Jun 7 21:11:20 gumby kernel: NET: 2 messages suppressed. Jun 7 21:11:20 gumby kernel: neighbour table overflow

1 0

Question about security check message
by JW 07 Jun '01

07 Jun '01

Howdy, I was just reading my system mail and saw the following: The following devices were added: + ++ /var/lib/secchk/data/devices.new Mon May 28 01:44:41 2001 - crw--w---- root tty 4, 1 /dev/tty1 + crw-rw---- root tty 4, 1 /dev/tty1 What exactly is that? I've never seen anything like that before. What causes that, a direct login to the console? ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

2 1