June 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] iptables and squid
by Stefan_Walther＠gehag-dsk.de 25 Jun '01

25 Jun '01

DIRK WROTE: Helo Folks, I still got a problem to set iptables for my Proxy Squid. All other doing well, but I think with Squid I have an understanding problem. My Gateway has three nic`s. IF_WAN="ppp0" DSL IF_EXT="eth0" is extern were ppp0 talks pppoe for dsl. IF_DMZ="eth1" is DMZ IF_LAN="eth2" is LAN My conception is squid runs as an lokal service on this Gateway. So I have to write a rule with --dport 3128 for an INPUT way to and an OUTPUT way back on Interface eth2, because Squid is running as an lokal service. Squid himself has to leave that Gateway to the Internet on Interface $IF_WAN with --dport 80 to --sport 80 and comes back as it goes. The meens to write a rule with OUTPUT and INPUT on $IF_WAN. But it doesn`t work. I also think about a FORWARD rule but is my conception so wrong?? Dirk ---------------------------------------------------------------------------------------------------------------------------------- Hi Dirk, hi list, I think you have to change the sport from 80 to 1024:65535 because, requests an a http-server doesn't com from the same port where they want to go to. The same the other way around. You should alo enable forward rules. Maybe it works this way. Maybe you should try to enter the rules manually via an simple script. If you use dynamic IP at you dsl-connection try this configuration: <---SNIP--> # SYNFLOODING echo 1 > /proc/sys/net/ipv4/tcp_syncookies # Source Address Verification einschalten for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > f done # IP-Forwarding echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -X iptables -F iptables -t nat -F iptables -t nat -X iptables -A INPUT -p tcp --dport 3128 --sport 1024:65535 -j ACCEPT iptables -A OUTPUT -p tcp --sport 3128 --dport 1024:65535 -j ACCEPT ########################################################################## # NAT (MASQUERADING) ########################################################################## # Special variation of SNAT (SOURCE NAT) iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE iptables -A FORWARD -i $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $EXT -m state --state NEW -j ACCEPT ########################################################################## # DNS ########################################################################## echo "DNS" # send requests to you DNS in the Internet iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 53 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 53 --dport $UNPRI -j ACCEPT # HTTP iptables -A OUTPUT -o $EXT -p udp --sport 1024:65535 --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p udp --sport 80 --dport 1024:65535 -j ACCEPT iptables -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 80 -j ACCEPT iptables -A INPUT -i $EXT -p tcp --sport 80 --dport $UNPRI -j ACCEPT # look at your LOG, enable in /etc/syslog.conf the parameter "kern.* > /var/log/firewall" e.g. iptables -A INPUT -j LOG --log-prefix "input " iptables -A OUTPUT -j LOG --log-prefix "output " iptables -A FORWARD -j LOG --log-prefix "forward " <---SNIP--> this should work MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

3 2

Empress?
by James Ogley 25 Jun '01

25 Jun '01

/home/ogley> grep empress /etc/passwd Nothing... jogley:~ # grep empress /etc/shadow empress:*:8902:0:10000:::: What's going on here? Can I happily delete this user? -- James Ogley, Unix Systems Administrator, Pinnacle.Net james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 20 8731 3619 This email was created and sent with: Evolution 0.10 *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

RE: [suse-security] intrusion detector "tripwire"
by Spencer, Ed M. -ND 25 Jun '01

25 Jun '01

I've used Tripwire on other platforms (NT, HP-UX, Solaris, and AIX) and have found it to be wonderful for forensic analysis and enforcing change management policies. It lets you know what's been changed and provides a thorough mechanism to verify important files. I've been using the commercial product and while it's far easier to install and manage (with the management console) than the 'academic' version, it does what it's supposed to do and does it well. The hardest part of setting it up remains the policy files though. Defining exactly what you want monitored and what you don't is the most important (and difficult) part of the setup. If you're watching a single machine it's not that bad if you watch everything, it's bad when you're watching over 300 machines and you're flagged on /etc/shadow every time a user changes a password or you're flagged on every file on the server when your backup software runs and changes the 'c' time. If you filter down the noise you should find Tripwire easy to use and effective. BTW, version 2.4 commercial supports Linux as a client AND runs the management console on X. Ed Spencer MCSE/MCT/CNA/A+/Network+ Security Analyst - IS Security Renaissance Worldwide, Inc. - Walt Disney World This communication is confidential, intended only for the named recipient(s) above and may contain trade secrets or other information that is exempt from disclosure under applicable law. Any use, dissemination, distribution or copying of this communication by anyone other than the named recipient(s) is strictly prohibited. If you have received this communication in error, please immediately notify us by calling (407) 566-5195. The ideas, opinions, and information expressed within the above email are the express sole opinion of the author and are not the opinion of the Walt Disney World Corporation. Thank you. -----Original Message----- From: Jeric [mailto:jeric@mmcable.com] Sent: Sunday, June 24, 2001 12:37 PM To: suse-security(a)suse.com Subject: [suse-security] intrusion detector "tripwire" -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

1 0

hardsuse package ???
by Mansel Bell 25 Jun '01

25 Jun '01

All, I had recently moved to SuSE with the 7.1 distro and was going to harden my box via the hardsuse package, but a little investigation revealed that hardsuse hasn't been included in the SuSE distro since 7.0. I got the most recent version of the harden_suse.pl script (harden_suse-3.5.pl) from Marc's SuSE homepage (http://www.suse.de/~marc/) but was wondering why it is no longer included in the SuSE Professional distro. Is no longer going to be supported by SuSE? Is something else taking it's place (a SuSE version of Bastille Linux)? For anyone with experience using both hardsuse and Bastille Linux, which do you prefer? Thanks... -Mansel

3 2

intrusion detector "tripwire"
by Jeric 25 Jun '01

25 Jun '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 First off, I just wanted to say hello to everyone, since this is my first posting here at SuSE. I was reading an article in "linux journal" about an intrusion detection called "tripwire" (http://sourceforge.net/projects/tripwire). it sounds really great on paper, but i was wonder if anyone uses this program, and if so, are there any issues with it on a SuSE system, or in general (i.e. is it fairly reliable, stable, easy to setup)? Thanks in advance -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA+AwUBOzYXHKhXhGbhej/EEQJtfwCY3uNrJ+kkmZ/JkJh5tN9xAB4BZwCZAUIw aE24LymxeXsP0ILZV2tIA7E= =bNx5 -----END PGP SIGNATURE-----

3 2

Re: [suse-security] intrusion detector "tripwire"
by Thomas Lamy 24 Jun '01

24 Jun '01

> Von: Jeric [mailto:jeric@mmcable.com] > Gesendet: Sonntag, 24. Juni 2001 18:37 > An: suse-security(a)suse.com > Betreff: [suse-security] intrusion detector "tripwire" > > > First off, I just wanted to say hello to everyone, since this is my > first posting here at SuSE. > > I was reading an article in "linux journal" about an intrusion > detection called "tripwire" > (http://sourceforge.net/projects/tripwire). it sounds really great > on paper, but i was wonder if anyone uses this program, and if so, > are there any issues with it on a SuSE system, or in general (i.e. is > it fairly reliable, stable, easy to setup)? > > Thanks in advance > Hi, I used to use tripwire for all of my machines. It's relatively easy to install, configure and run. Some general hints (also for other checksum progs): - You have to keep it's database on a read-only medium, and have to renew it every time you update your system (because tripwired binaries are affected by every update if you configure it well). a write-protected floppy disk will do as long as you disable floppy booting (or you will be unable to remotely reboot your system ). - IMHO, do not put files like /etc/passwd and friends into the same database as your system binaries are, at least not on systems with user fluctuation. Use a different database or a different tool to monitor these. - Think about performance implications on the machines you run it. I had a pretty bad time with users bashing me because of poor web server performance. It was TW, checking all of my binaries (a big list including informix, where one binary has about 11 megs) every 30 minutes. You should also have a look at http://www.securityportal.com/lskb/10000000/kben10000026.html which is a good starting point and overview. Thomas

1 0

RE: [suse-security] Firewall questions
by Björn Engels 24 Jun '01

24 Jun '01

Original Message From: Dallam Wych Sent: 6/24/01 10:58 AM >First, should I use the firewall that came in the distro or is the >firewall2 >Alpha on Marcs page better? Hmm, in my opinion you should use the package that comes with the distro and try to understand the rules, then. If you got it, you could switch to FW2 and start beginning to undesrstand those rules. (It's much more complicated, but has lots of fine new possibilities ;) I guess you will want to rewrite those rules you find there, you can make things lots easier because the FW-Packages are built to cover lots of possible configurations... ) >Should I then use SuSE harden as well? Well, everybody should do it, independently from setting up a firewall ;) >Finally, >I would like to learn more about firewalls so that I don't have to ask >questions like this one :o). So what would be some good books to read on >the subject? I only can tell you the stuff I read, of course, maybe you wish to take a look at http://www2.little-idiot.de/firewall/ for example, at http://www.linuxfirewalls.org and at the book "Building Internet Firewalls", and you should read the manpages of ipchains and iptables, of course. HTH, good luck ;) Bjoern

1 0

ANN: new amavis-perl/amavisd RPMs for sendmail and postfix (SuSE Linux 7.2) available
by Rainer Link 24 Jun '01

24 Jun '01

Hi! During the weekend I've build some new RPMs for SuSE Linux 7.2. You can grab them from ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/postfix/ or ftp://ftp.suse.com/pub/people/link/amavis/SuSE/7.2/sendmail/ Please read the INSTALL.TXT on the ftp server or README.SuSE within the package carefully. Thanks. If your sendmail.cf file is not generated by SuSEconfig, please check /etc/mail/linux.mc to see, which m4 macros are needed to configure sendmail for use with amavis. Postfix users currently always have to configure postfix themselves, but this should not too difficult :-) The amavis-(sendmail|postfix) RPM is an updated version of amavis-perl-11, which fixes some minor issues. The amavisd-(sendmail|postfix) RPM is a recent CVS snapshot, as the official amavisd-snapshot-20010407 has some bugs, which have been already fixed in CVS. amavisd is in general faster than amavis-perl, as forking a child is faster than creating a new perl process for every mail. Feedback, is of course, very welcome. But please do not "spam" suse-security with amavis-related questions ;-) RPM-related issues should be reported to me directly and amavis questions in general should be asked in our amavis-user mailing list (see www.amavis.org). Thank you. best regards, Rainer Link -- Rainer Link | SuSE - The Linux Experts link(a)suse.de | Developer of A Mail Virus Scanner (amavis.org) www.suse.de | Founder OpenAntiVirus Project (www.openantivirus.org)

1 0

Amavis...
by StarTux 24 Jun '01

24 Jun '01

Do I need to do anything in particular to my firewall? (The nice SuSEfirewall2 :-)). amavis-milter: amavis-milter: connect[19459]: inet_pton failed I have RTFM already....By the way if you RTFM you will find out that amavis does indeed support Postfix, Qmail and Exim, but you need to configure/install it yourself. More information at www.amavis.org Thanks for the package! Matt -- "The only thing complex about Linux are the users themselves."

3 3

Firewall questions
by Dallam Wych 24 Jun '01

24 Jun '01

Hi All, I am using SuSE 7.1. Having finally gotten online, I need to learn about using SuSE firewalls. This is new to me so I have the following questions. First, should I use the firewall that came in the distro or is the firewall2 Alpha on Marcs page better? Should I then use SuSE harden as well? Finally, I would like to learn more about firewalls so that I don't have to ask questions like this one :o). So what would be some good books to read on the subject? Thanks, Dallam _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

1 0