June 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 and connect from internal net to extern interface
by Christoph Kiehl 20 Jun '01

20 Jun '01

Hi, topic got a bit long ;). I'm running SuSEfirewall2 version 1.0 and have the problem that i can not reach services on the firewall through the external interface(ppp0). This is not a real problem, except that I run oracle on this machine an it seems like the oracle listener binds the connection to the external ip. This leads the firewall to filter any following packages and the connection times out :(. If anyone has a solution how to tell oracle to use only a specific interface, or how to tell SuSEfirewall to not filter packets from the internal net to the external interface - please let me know ;) Regards Christoph ps: I know it's not a good idea to run oracle on a firewall but it's only for testing purposes

1 0

POP Issue
by Scott Lindstrom 20 Jun '01

20 Jun '01

Hello all, I think I have an authentication problem with my Sparc version of SuSE 7.1 and I am hoping someone can help me with this. I have enabled pop3d in inetd.conf and done the killall -HUP inetd thing. hosts.allow: ALL:172.16.17.3 <-----this is my workstation from which I will be retrieving pop mail from this server <would popd or pop3d work instead?> hosts.deny ALL:ALL /etc/pam.d/pop #%PAM-1.0 auth required /lib/security/pam_unix.so account required /lib/security/pam_unix.so The pop server is not properly authenticating my pop retrieval commands: Here is /var/log/mail: Jun 20 08:13:58 gateway ipop3d[5975]: pop3 service init from 172.16.17.3 Jun 20 08:14:01 gateway ipop3d[5975]: Command stream end of file while reading lin e user=sdl host=riley.slindstrom.net [172.16.17.3] Here is /var/log/messages: Jun 20 08:16:22 gateway ipop3d[6010]: connect from 172.16.17.3 (172.16.17.3) Jun 20 08:16:22 gateway ipop3d[6010]: Login failure user=sdl host=riley.slindstrom .net [172.16.17.3] What am I missing? Do I need to add something to the /etc/pam.d/pop file? Your assistance is greatly appreciated! Thanks a lot! Scott

1 0

sendmail 8.10.x relaying
by Philipp Snizek 20 Jun '01

20 Jun '01

Hi list-users, is there a way how to make mail relaying username/password dependent and not host, domain or subnet dependent? Goal would be: 1. everybody can send mail to the MTA. 2. Only authenticated users with passwords can use the MTA for relaying mail from ANY host / domain / subnet etc. is there a way how to do it with sendmail? Thanx a lot. Philipp

3 2

strange SuSEfirewall configuration delivered in original distribu tion
by Bruenner, Joerg 20 Jun '01

20 Jun '01

Hi everybody, trying to setup the SuSEfirewall I discovered some strange content of the SuSEfirewall_init, -_setup and -_final scripts. I'm using 7.1 as distributed via CD, no patches are installed. Kernel: 2.4.0-4GB. The scripts contains at line 28ff a case statment, marked as comment. It contains at line 52 the return=$rc_done statement, marked as comment too. The firewall does not work with the original script. It worked fine if set the commented lines back in operation. What's the sense of the original comments??? Thanks a lot Joerg -- /*-------------------------------------------------------------------- Joerg Bruenner Commerzbank AG, ZIT D E-Commerce Hafenstrasse 51, D-60327 Frankfurt am Main Tel.: +49 (0)69 136 28289, Fax: +49 (0)69 136 28252 eMail: joerg.bruenner(a)commerzbank.com --------------------------------------------------------------------*/

1 0

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

Hi List, I'm not quite sure, if this means anything, but perhaps somebody could explain to me, what was happening, Tanks in advance. This is, what the log says : sshd[17874]: connect from 61.139.252.156 sshd[17874]: log: Connection from 61.139.252.156 port 2953 sshd[17874]: log: Could not reverse map address 61.139.252.156. sshd[17874]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:2983<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.51 ports 22, 80, 443, 1024, 1080, 1313, 1352, 1433, 1494, ..., ???p?uxy, TTL 39 @11:26:00 sshd[17875]: connect from 61.139.252.156 sshd[17875]: log: Connection from 61.139.252.156 port 3099 sshd[17875]: log: Could not reverse map address 61.139.252.156. sshd[17875]: fatal: Did not receive ident string. kernel: lockd: connect from unprivileged port: 61.139.252.156:3129<4>lockd: accept failed (err 11)! kernel: lockd: accept failed (err 11)! scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, 1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 sshd[226]: log: Generating new 768 bit RSA key. sshd[226]: log: RSA key generation complete.

2 1

Re: [suse-security] Fetchmail
by Christian Laursen 20 Jun '01

20 Jun '01

Roman Drahtmueller <draht(a)suse.de> writes: > > Hi, > > > > the new version of fetchmail on the SUSE-Server do not work with > > multidrop !!!! > > Very informative, thank you. > > As long as this bug report is not followed by just a little bit more > information, I have to consider it non-existent. I can confirm, that the upgraded version has problems. I will try to make a useful bugreport when I get home from work. -- Best regards Christian Laursen

2 1

ipv 4 and ipv 6
by Joop Boonen 20 Jun '01

20 Jun '01

Dear all, Does someone have some experiance with the use of ipv4 and ipv6 as in. ipv4 on the internet and ipv6 on you internal network? If so which program dit you use for the translation? How can you handle the dns requests as the internet doesn't use ipv6 etc? Regards, Joop Boonen.

1 0

Fetchmail
by Rainer Buesching 20 Jun '01

20 Jun '01

Hi, the new version of fetchmail on the SUSE-Server do not work with multidrop !!!! Thanks Rainer Buesching

3 2

What does this mean ?
by Andreas Meinerzhagen 20 Jun '01

20 Jun '01

>>From: Andreas Meinerzhagen >> >>I'm not quite sure, if this means anything, but perhaps somebody could >>explain to me, what was happening, >> >>This is, what the log says : >[...] >>scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >>1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 >You have been portscanned by 61.139.252.156. I guessed so, but wasn't sure. Now, as I find no further Entry from this guy, it looks, as we would be safe for now. Thanks to all those fine skripts like harden_suse, etc. Thanks to the List, Andreas

1 0

RE: [suse-security] What does this mean ?
by Björn Engels 20 Jun '01

20 Jun '01

>From: Andreas Meinerzhagen > >I'm not quite sure, if this means anything, but perhaps somebody could >explain to me, what was happening, > >This is, what the log says : [...] >scanlogd: 61.139.252.156 to 131.220.220.53 ports 22, 80, 1024, 1080, >1313, 1352, 1433, 1494, 1498, 1524, ..., ???p?uxy @11:26:11 You have been portscanned by 61.139.252.156. Bjoern Engels

1 0