July 2001 - openSUSE Security - openSUSE Mailing Lists

Rinetd
by Emanuele Parmigiani 11 Jul '01

11 Jul '01

Hi group, It's possible to start service rinetd with another user instead of root? Thanks Saluti e vive cordialità \\\\|//// ( (.) (.) ) ____000o-()-o000___________________ Emanuele Parmigiani CCNA CCDA Sycom S.r.l. ___________________________________ ooo0 0ooo

6 8

RE: [suse-security] extending my dmz
by Wilhelm Tesnaar 11 Jul '01

11 Jul '01

I think VPN is the way to go ???? OR a port redirector/tcpwrapper like TCP Proxy. Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: elfed lewis [mailto:e.lewis@meirion-dwyfor.ac.uk] Sent: Wednesday, July 11, 2001 11:54 AM To: suse-security(a)suse.com Subject: [suse-security] extending my dmz I work for a college with 3 sites, with wan links in between each, with 2 seperate networks per site, which means 6 networks over my wan. Im hoping to set up a DMZ over the summer, and putting my web server, dns and mail server in there. Thing is, i have another server on another site that i'd also like inside my DMZ. what i'd like to do is set up some sort of tunnel (i dont know if you can do this) from the external site to my DMZ. Sort of like this: box needs being in DMZ ---> tunnel box ---> WAN links ----> Box inside DMZ Then, any requests for the "box needs being in DMZ" can be directed to the "box inside DMZ", which then sends any data down over the tunnel directly to the "box needs being in DMZ". heres another diagram in case imnot being very clear: router ---------------------- wan router DMZ | | | box inside DMZ | ------------------ extsite1 extsite2 ext site3 ---- ---- ---- | Tunnel box | box needs being in DMZ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] ssh shells and ircd on a small lan
by nagilum＠chillout.org 11 Jul '01

11 Jul '01

Hi, maybe you should try portforwarding a port from the gateway to your machine 192.168.0.2. I recently made a small script for a similar purpose. I just extended my comments so you should know what to do with it. Put it in /etc/rc.d/ and chmod +x it and read the comments (at least). Good luck, Alexander. PS: Any comments appreciated. Quoting Dimitris Kontogiannopoulos <jim(a)infodomi.gr>: > > i don't think that is a good idea to give someone access to your > firewall > box if you have configure your firewall and routing table correct you > don't > have to give a user account to your firewall its so simple don't make > this > to yourself > > > Kontogiannopoulos Dimitris > jim(a)infodomi.gr > Junior Net Admin > > ----- Original Message ----- > From: "phil" <phil(a)osbtown.com> > To: <suse-security(a)suse.com> > Sent: Wednesday, July 11, 2001 12:12 AM > Subject: [suse-security] ssh shells and ircd on a small lan > > > > Greetings all, > > I been trying to give my friend a shell account > > (ssh) And I have ran into some confusion. > > > > The firewall box has ssh already on it, but it also has > portforwarding. So > > I am confused as to where I should give my friend a shell at. > > > > I also talk irc with my friend on a ircd which is located on > 192.168.0.2 , > > but I wondering if this is safe to let ircd be port forwarded through > > firewall box > > > > |---------------------------------- > > | modem (dialup)-- firewall box > > | | > > | redhat eth0 > > |---------------------------------- > > | > > |------------ |---------------- > > | hub | -- | (eth0) 192.168.0.1 (just a client mandrake) > > |------------ > > \ |---------------- > > | (eth0) 192.168.0.2 (irc, shell accounts suse > 7.2) > > > > > > at the moment the only way I know to get through the external > network is > > to ssh to the firewall box as root, then ssh again into 192.168.0.2 > box. > > > > I don't want my friend to know the root password on the firewall. > > I trust the guy, but he isn't very adept at linux and he might screw > > something up by accident. I want to avoid the accident. I also want > > to limit him to say 10MB and 10 process's (the cpu goes to 100% now > with > > no limits on the account) > > > > If I shut ssh off the firewall how can I turn on ssh through it to the > > shell accounts. Or is this the wrong way to do this? I am thinking > the > > shell might be better off located on the firewall. > > > > Should ircd be relocated to the firewall instead of where it is > > now (192.168.0.2) > > > > and finally... a bloob, I accidentally deleted my ircd startup from > the > > inetd.conf I tried YaST and manually editing it but the only way to > > start irc is manually now. Can someone show the line or lines in the > > inetd.conf that have the irc/ircd start up from inetd.conf There is > > not anything in the manual about this. > > > > it used to start when I boot, but no more...;o( > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > ======================================================================== # _ __ _ __ http://home.htwm.de/akuehn/ \n icq://69646724 # # / |/ /__ ____ _(_) /_ ____ _ nagilum(a)chillout.org \n +01776461165 # # / / _ `/ _ `/ / / // / ' \ Amiga (68k/PPC): AOS/NetBSD/Linux # # /_/|_/\_,_/\_, /_/_/\_,_/_/_/_/ Mac (PPC): MacOS9 / Linux / MacOS-X # # /___/ x86: Linux/FreeBSD/OpenBSD/QNX/Win98SE # ======================================================================== #!/bin/bash # simple portforwarding script by Alexander Kuehn, # BSD licence - use it, screw it, blame me # requires SuSE firewall installed, configured and working # the syntax is PORTFORWARD="[definition][ definition] ..." # where definition is "external_port:LAN_machine:LAN_machine_port" # for example put something like this in your /etc/rc.config # PORTFORWARD="5080:mymachine:80 5022:mymachine:80" # this would forward external port 5080 to mymachine port 80 # and external port 5022 to mymachine port 22 # be aware that you can not test this from your LAN, you have to check # this from a host outside of your LAN, e.g. ssh to some other host and # try a lynx http://<insertyourgateway>:5080/ or ssh -p 5022 <insertyourgateway> # once you know it's working add a "/etc/rc.d/forward restart" to # your /etc/ppp/ip-up.local (presuming you're using a dialup link), good luck! . /etc/rc.config . /etc/rc.config.d/firewall.rc.config # get ip of world interface LOCALIP=`ifconfig $FW_DEV_WORLD|grep "inet addr:"|cut -d ":" -f 2|cut -d " " -f 1` while [ -z $LOCALIP ] do # if the script is called too early the inerface might not # have an ip, therefore we will loop until it has one # this sleep will help to keep the machine breathing just in the case.. sleep 5 LOCALIP=`ifconfig $FW_DEV_WORLD|grep "inet addr:"|cut -d ":" -f 2|cut -d " " -f 1` done # The echo return value for success (defined in /etc/rc.config). return=$rc_done case "$1" in start) echo -n "Starting port fowarding:" for i in ${PORTFORWARD}; do LCPORT=`echo $i|cut -d: -f1` TOMACH=`echo $i|cut -d: -f2` TOPORT=`echo $i|cut -d: -f3` ipmasqadm portfw -a -P tcp -L $LOCALIP $LCPORT -R $TOMACH $TOPORT || return=$rc_failed done echo -e "$return" ;; stop) echo -n "Stopping port forwarding:" ipmasqadm portfw -f || return=$rc_failed ;; status) echo "Listing forwarded ports: " ipmasqadm portfw -l && echo OK || echo No process ;; reload) $0 stop && $0 start || return=$rc_failed ;; restart) $0 stop && $0 start || return=$rc_failed ;; *) echo "Usage: $0 {start|stop|status|restart|reload}" exit 1 ;; esac # Inform the caller not only verbosely and set an exit status. test "$return" = "$rc_done" || exit 1 exit 0

1 0

Re: [suse-security] Block port 6000
by Passreality 10 Jul '01

10 Jul '01

i have the same as you and still it listens ? /Chriss --- Kevin Ivory <Ivory(a)SerNet.de> wrote: > Passreality wrote: > > I have probs getting X to stop listening for > > connection on port 6000. I saw at the "SuSE > Security > > FAQ (unofficial)" that to get it to stoping > listening > > i should change /usr/X11R6/lib/X11/xdm/Xservers > but > > this dont work for 7.1, anyone know how to disable > it > > in 7.1 ? > > I do not want to block it using a firewall. > > I don't have the FAQ handy but watch for the correct > directory in /etc > Here is what mine looks like > > ivory1:~ > grep nolisten /etc/X11/xdm/Xservers > :0 local /usr/X11R6/bin/X :0 vt07 -nolisten tcp > > Remember that a restart of X is needed for the > change to > become effective. > > Kevin > -- > _ | Kevin Ivory | Tel: > +49-551-37000041 > |_ |\ | | Service Network GmbH | Fax: > +49-551-3700009 > ._|ER | \|ET | Bahnhofsallee 1b | > mailto:Ivory@SerNet.de > Service Network | 37081 Goettingen | http://www.SerNet.de/ __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

2 1

kernel 2.4.5 + ipchains 1.3.9-249 incompatible?
by brina30＠gmx.li 10 Jul '01

10 Jul '01

Hi all, I have problems with my susefirewall. I'm using SuSE 7.1, kernel 2.4.5 and ipchains 1.3.9-249. In the bootlog I get the message 'ipchains protocol not available' and when I give the command 'ipchains -L' I get the message 'incompatible with this kernel. So I tried the original SuSEkernel, but there it is the same. On my RedHat-Maschine it works fine with kernel 2.4.4 and ipchains-1.3.10-7. I can't find this ipchains-version for SuSE and I would like to work with SuSE in the future. I would appreciate it very much, if somebody could give me a tip. Bye Brina -- brina30(a)gmx.li GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net GMX Tipp: Machen Sie Ihr Hobby zu Geld bei unserem Partner 1&1! http://profiseller.de/info/index.php3?ac=OM.PS.PS003K00596T0409a

4 4

FTP-Installation SuSE 7.2
by Stefan_Walther＠gehag-dsk.de 10 Jul '01

10 Jul '01

Hi folks, maybe it is a little bit out of topic but I don't know where to write this. I download the bootdisc and the module discs. after I made the discs I want to upgrade my 7.1 to 7.2 via ftp. I have a dsl-router with a firewall installed (iptables with masquerading). As I want to connect to the ftp-server of suse I get the message, that the server cannot connect to the ftp server. I tried to connect to other ftp servers, but I got the same message. It would be nice, if somebody can help me. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

2 1

firewall2 / caching proxy question
by Avi Schwartz 08 Jul '01

08 Jul '01

Hi, I am currently running SuSEFirewall2 on my machine and an trying to add the 'oops' caching proxy to my network. I would like to be able to use the transparent mode in which I don't have to set a proxy for all browsers. What I am trying to do is to redirect all requests with a destination port 80 to port 3128 of my gateway/fw machine. My outside world interface is ppp0 and my internal network interface is eth0. I need help in 1. the creation of the iptables rule. 2. figuring out where to put this rule in the context of the firewall2 settings. Thanks, Avi -- Avi Schwartz Get a Life, avi(a)CFFtechnologies.com Get Linux!

1 0

dropped support for Tekram scsi card ?
by Maarten van den Berg 08 Jul '01

08 Jul '01

[Sorry, I guess offtopic] Hi. I just bought SuSE 7.2 and compiled a kernel 2.4.6 from vanilla sources since that is not yet available as update. Apparently, they dropped the support for the scsi-card Tekram DC-315 (DC-390 is still there though). I tried several other drivers and a grep -i tekram ..../drivers/scsi/* but to no avail (card is not recognised). Is it really dropped out of 2.4.x, in 2.2.19 it is there, and works like a charm. Buying a newer card is quite a waste of resources, it only drives a 12/24 GB DATstreamer... ( In fact, I bought the card only yesterday...;-\ ) -- Maarten J H van den Berg van Boetzelaer van Bemmel, informatie- en netwerktechnologie http://vbvb.nl T 020-4233288 F 020-4233286 G 06-51994273

4 3

Missing SSL option in Kmail
by nix＠susesecurity.com 08 Jul '01

08 Jul '01

Hi guys. I have a question for SuSE here. I have downloaded all the KDE updates for SuSE 7.1 and installed them. (I only installed updates, not new packages) Now, Unfortunately Kmail does not seem to be significantly changed, (it still reports it version as Kmail 1.2 in the About Kmail dialog) yet is IS now missing it's SSL option for POP mail. Info about the package. # rpm -qf /opt/kde2/bin/kmail kdenetwork-2.1.1-82 So it does seem to have been updated, but the only change I can notice is the now missing SSL option, which I use on ALL my pop accounts, infact on several of them, I can no longer check mail :-( Can anyone tell me what I need to do to get SSL back? Cheers Nix (nix(a)susesecurity.com)

1 0

3 interface firewall
by Oyku Gencay 07 Jul '01

07 Jul '01

Hi, I've read netfilter howtos and mailing list archive but could not get around with it. The config is as follows all up and working. eth0: 1.2.3.4 netmask 255.255.255.192 (internet) eth1: 10.0.0.1 netmask 255.255.255.0 (so called dmz) eth2: 192.168.1.1 netmask 255.255.255.0 (internal) default gateway 1.2.3.3 (router. Up and working) Web Server 10.0.0.50 Another Web Server 10.0.0.60 Mail Server 10.0.0.70 What I would like to do is 1. to have internal PC's access internet. 2. To be able to nat 1.2.3.5 to 10.0.0.50, 1.2.3.6 to 10.0.0.60 and 1.2.3.6 to 10.0.0.70 Here are the iptables rules. # access to internet from internal (tested, working ok) iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A FORWARD -i eth2 -j ACCEPT iptables -t nat -A FORWARD -m state --state ESTABLIESHED, RELATED -j ACCEPT # NAT ?? iptables -t nat -A PREROUTING -d 1.2.3.5 -p tcp --dport 80 -j DNAT --to 10.0.0.50 iptables -t nat -A PREROUTING -d 1.2.3.6 -p tcp --dport 80 -j DNAT --to 10.0.0.60 iptables -t nat -A PREROUTING -d 1.2.3.7 -p tcp --dport 110 -j DNAT --to 10.0.0.70 iptables -t nat -A PREROUTING -d 1.2.3.7 -p tcp --dport 25 -j DNAT --to 10.0.0.70 Can anybody help me on logging & degugging, and why this is not working ?? Am I missing anything in the routing part??? Regards, TIA Oyku

3 3