June 2001 - openSUSE Security - openSUSE Mailing Lists

LinuxTag
by Roman Drahtmueller 27 Jun '01

27 Jun '01

Hi together, who will be at the LinuxTag in Stuttgart from July 5th to July 8th? It may be a nice idea to have lunch together on Saturday, for those who will be there. A good time to talk about stuff, impulses, ideas or just simple questions. I'll be there. Who else? Roman.

4 4

RE: [suse-security] iptables?
by Reckhard, Tobias 27 Jun '01

27 Jun '01

> > You need to load the appropriate kernel module, iptable_nat. > > Shouldn't the kernel daemon take care of this? > I don't know, but it doesn't appear to. It didn't in the ipchains days either, you had to load the masquerading modules explicitly as well. Since iptables is set up with a script, it's hardly much of a problem to load the modules from that. Tobias

1 0

RE: [suse-security] iptables?
by Reckhard, Tobias 27 Jun '01

27 Jun '01

> Doesn't precompiled SuSE 2.4 kernel support iptables? When I run the > command > iptables -t nat ....... I get "can't initialize table nat iptables who? > (do > you need insmod?)... > You need to load the appropriate kernel module, iptable_nat. HTH Tobias

2 1

iptables?
by Oyku Gencay 27 Jun '01

27 Jun '01

Hi, Doesn't precompiled SuSE 2.4 kernel support iptables? When I run the command iptables -t nat ....... I get "can't initialize table nat iptables who? (do you need insmod?)... The iptables coming with 7.1 is 1.1.2 TIA Oyku

1 0

squid and SuSEfirewall2
by Joss Winn 26 Jun '01

26 Jun '01

Hello, I was hoping to work this out on my own but it's been hours and I've gotten nowhere. I just upgraded from a previous version of Marc's firewall2 to the latest one. With the previous firewall2, everything was fine and I was using squid and junkbuster together with the firewall. I am on a 56k dialup and use squid to speed up my own web browsing. I offer no external services at all. I have tried to figure out why this updated firewall isn't working for me, but I really don't understand it. The symptoms are: When I first boot up and dial up to browse the web, I can browse freely using squid and junkbuster. However, the second time I dial up and any time after that, I cannot go anywhere. The browser just keeps looking until it has timed out. I wonder if this has anything to do with the DNS lookup, although I really don't know how to check this. ANY help and advice would be much appreciated. Any settings in the YAST or the firewall config file would be great. Thank you Joss -- http://www.josswinn.org

2 2

Re: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 26 Jun '01

26 Jun '01

DIRK WROTE: Helo Stefan,helo Steffen, helo folks! Well, referable that outgoing port from Squid, I be mistaken. His dport is just 80. But that is not my problem. Masquerading and DNS intern and extern pop,imap,http as mail GUI, all this things working o.k. Only that thing with squid on my collapsed Firewall is my evil. Here my rules exactly: IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN servber01_eth0="IP-WAN" servber01_eth2="IP-LAN" ANY="0/0" #LAN goes way to Proxy $IPTABLES -A INPUT -i $IF_LAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $LAN --sport $p_high -d $servber01_eth2 --dport squid -j ACCEPT #Proxy goes back LAN $IPTABLES -A OUPUT -o $IF_LAN -p tcp -m state --state ESTABLISED,RELATED -s $servber01_eth2 --sport squid -d $LAN --dport $p_high -j ACCEPT #Proxy goes way to Internet $IPTABLES -A OUPUT -o $IF_WAN -p tcp -m state --state NEW,ESTABLISED,RELATED -s $servber01_eth0 --sport $p_high -d $ANY --dport http -j ACCEPT #Internet goes wayback to Proxy $IPTABLES -A INPUT -i $IF_WAN -p tcp -m state --state ESTABLISED,RELATED -s $ANY --sport http -d $servber01_eth0 --dport $p_high -j ACCEPT Maybe you can find that trouble. Squid is an lokal service on my collapsed Firewall. So I don`t need FORWARD rules. Transparent Proxy is not good for that one. Thanks a lot and best regards Dirk Hi Dirk, hi folks, as I set up a firewall, I read the iptables-howtos and I think the states NEW, RELATED and ESTABLISHED is more effectable if you use some NAT. I think you need special INPUT and OUTPUT rules at your firewall. We had the same problem as we used bindutil for nameserverquestions at the firewall. We tried to use only states but this doesn't work. At this point I think you have to use simple INPUT and OUTPUT rules. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

2 1

amavis-sendmail
by Björn Engels 26 Jun '01

26 Jun '01

Hi, I just installed amavis-sendmail on a 7.2 box and I'm trying to configure it for my system. If I configure it as as being described in the mail root gets after installing and start amavis and sendmail from /etc/init.d, mails including a virus signature are being mailed normally. After reading /usr/share/doc/packages/amavis-sendmail/* I tried to modify Mlocal in /etc/sendmail.cf with the result that sendmail can't find /usr/sbin/scanmails. I tried to substitute scanmails with /usr/bin/amavis and /usr/bin/amavis-milter with the following result in /var/log/mail: sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 1 or sendmail[6161]: f5JFA9206161: f5JFA9306161: return to sender: unknown mailer error 255 Any hints ? Thanks in advance Bjoern

6 15

Listing of "common" ports used for attacks?
by Geordon VanTassle 26 Jun '01

26 Jun '01

Does anyone know where I can find a listing of ports that are commonly (known) as far as attack attempts? I know that /etc/services.ini is where I can find what I'm supposed to have LOCALLY, but I'm looking for "more" information. I hope that makes sense to someone other than me... Any suggestions would be appreciated. Thanks, Geordon

5 5

Little problem with /bin/telnet (fwd)
by Fox 26 Jun '01

26 Jun '01

<please,excuse me for my poor english> Hi, i've found a bug in /bin/telnet that arrives with suse 7.1 and 7. I dont know if this bug has been already reported, but others distributions seems to be vulnerables too. Let me give you an example: --- bash-2.04$ DISPLAY=`perl -e 'print "a"x1200'` bash-2.04$ telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Segmentation fault bash-2.04$ --- Telnet gives me seg fault when it checks the enviroment $DISPLAY. Bye.

2 1

RE: [suse-security] Little problem with /bin/telnet (fwd)
by Björn Engels 26 Jun '01

26 Jun '01

Fox wrote on 6/27/01 4:17 AM >Telnet gives me seg fault when it checks the enviroment $DISPLAY. I am using 7.2 and I had to increase the number of chars, the rest is pretty similar: bj@spock:~ > DISPLAY=`perl -e'print "a"x12000'` bj@spock:~ > telnet localhost Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Speicherzugriffsfehler Bjoern

1 0