July 2001 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Sendmail issues on firewall
by Wilhelm Tesnaar 17 Jul '01

17 Jul '01

Hey BRILLIANT !!!!!!!!!! Let see if that works ;-) L8r Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: semat [mailto:semat@wawa.eahd.or.ug] Sent: Tuesday, July 17, 2001 11:35 AM To: Wilhelm Tesnaar Cc: 'Mark Tinka'; 'suse-security(a)suse.com' Subject: RE: [suse-security] Sendmail issues on firewall Actually sendmail on 7.1 seems to have been compiled with tcpwrappers support. I had this problem too. You can fix this by editing /etc/hosts.allow to have sendmail: ALL : ALLOW This should fix your problem. On Mon, 16 Jul 2001, Wilhelm Tesnaar wrote: > Actually, I have tried that and I have RELAY setup for everything. > I even try adding the netork 0. and give it the option of relaying with no > avail.... > > > Any other Ideas ? > > Regards > Willie Tesnaar > > Change your way of thinking, it might ease the process of self discovery ! > (Willie Tesnaar 06/06/2001) > > > -----Original Message----- > From: Mark Tinka [mailto:aknit44@yahoo.co.uk] > Sent: Monday, July 16, 2001 9:22 AM > To: Wilhelm Tesnaar; 'suse-security(a)suse.com' > Subject: Re: [suse-security] Sendmail issues on firewall > > > have a look at your /etc/mail/access file and ensure u > have not setup any REJECT or DISCARD rules... if there > certain domains from which you specifically recieve > mail, then add them to your list in that file, > otherwise, to receive mail, the file should only have > the IP addresses of allowed hosts on your subnet to > use your mail server to send e-mail... receiving > e-mail on the other hand.. should be auto... better > yet.. paste a copy of your access file.. > > whenever u make a change to this file.. don't forget > to re-build the db out of it.. > > regards.. AKNIT > > > --- Wilhelm Tesnaar <TesnaarW(a)filpro.co.za> wrote: > > Hi All > > > > I am having some serious problems with sendmail > > acting as a Mail gateway on > > my firewall. > > I have a default installation of it on suse 7.1. > > I have modified the relay-domains and also > > domaintable (You know, where you > > tell it to route incoming domain mail to.) > > I can send out fine. When I have mail sent to me, it > > gives a 5.0.0 550 > > access denied error. > > Could someone give me a few ideas why this would > > happen ? > > > > Could reverse DNS entries have any effect ? > > > > Regards > > Willie Tesnaar > > > > Change your way of thinking, it might ease the > > process of self discovery ! > > (Willie Tesnaar 06/06/2001) > > > > > > -----Original Message----- > > From: marc(a)suse.de [mailto:marc@suse.de] > > Sent: Saturday, July 14, 2001 2:10 PM > > To: suse-security(a)suse.com > > Subject: [suse-security] SuSEfirewall2 v1.3 > > (security fix update) > > > > > > Hi folks, > > > > After a very long testing time version 1.3 is now > > available, and the first > > official rpm will be availabel as well during next > > week! > > > > you can find the newest version at > > www.suse.de/~marc/suse or wait for the > > official rpm release. > > > > For everyone using older versions: you should update > > if you are using the > > FW_AUTOPROTECT_GLOBAL_SERVICES feature, because I > > made a mistake which would > > not block access to autoprotect ports from external > > - and this might result > > in a security problem > > > > v1.3 14.07.01 FINAL -> FIRST OFFICIAL RELEASE > > * Fixed a bug in autoprotecting ports to externals > > (thanks to > > sielaff(a)chem.tu-berlin.de and > > D.Markwardt(a)tu-bs.de) > > * Added special log message if internals try to > > access the external > > IPs of the firewall > > * Added missing /sbin/rcSuSEfirewall2 link (thanks > > to > > wolfgang.hoefler(a)hwo.at) > > > > > > Greets, > > Marc > > -- > > E@mail: marc(a)suse.de Function: Security Research > > and Advisory > > PGP: "lynx -source > > http://www.suse.de/~marc/marc.pgp | pgp -fka" > > Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 > > D4 87 B5 63 6C > > Private: http://www.suse.de/~marc SuSE: > > http://www.suse.de/security > > > > -- > > To unsubscribe, e-mail: > > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > > suse-security-help(a)suse.com > > > > -- > > To unsubscribe, e-mail: > > suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: > > suse-security-help(a)suse.com > > > > ____________________________________________________________ > Do You Yahoo!? > Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk > or your free @yahoo.ie address at http://mail.yahoo.ie > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

RE: [suse-security] Sendmail issues on firewall
by Wilhelm Tesnaar 17 Jul '01

17 Jul '01

Actually, I have tried that and I have RELAY setup for everything. I even try adding the netork 0. and give it the option of relaying with no avail.... Any other Ideas ? Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: Mark Tinka [mailto:aknit44@yahoo.co.uk] Sent: Monday, July 16, 2001 9:22 AM To: Wilhelm Tesnaar; 'suse-security(a)suse.com' Subject: Re: [suse-security] Sendmail issues on firewall have a look at your /etc/mail/access file and ensure u have not setup any REJECT or DISCARD rules... if there certain domains from which you specifically recieve mail, then add them to your list in that file, otherwise, to receive mail, the file should only have the IP addresses of allowed hosts on your subnet to use your mail server to send e-mail... receiving e-mail on the other hand.. should be auto... better yet.. paste a copy of your access file.. whenever u make a change to this file.. don't forget to re-build the db out of it.. regards.. AKNIT --- Wilhelm Tesnaar <TesnaarW(a)filpro.co.za> wrote: > Hi All > > I am having some serious problems with sendmail > acting as a Mail gateway on > my firewall. > I have a default installation of it on suse 7.1. > I have modified the relay-domains and also > domaintable (You know, where you > tell it to route incoming domain mail to.) > I can send out fine. When I have mail sent to me, it > gives a 5.0.0 550 > access denied error. > Could someone give me a few ideas why this would > happen ? > > Could reverse DNS entries have any effect ? > > Regards > Willie Tesnaar > > Change your way of thinking, it might ease the > process of self discovery ! > (Willie Tesnaar 06/06/2001) > > > -----Original Message----- > From: marc(a)suse.de [mailto:marc@suse.de] > Sent: Saturday, July 14, 2001 2:10 PM > To: suse-security(a)suse.com > Subject: [suse-security] SuSEfirewall2 v1.3 > (security fix update) > > > Hi folks, > > After a very long testing time version 1.3 is now > available, and the first > official rpm will be availabel as well during next > week! > > you can find the newest version at > www.suse.de/~marc/suse or wait for the > official rpm release. > > For everyone using older versions: you should update > if you are using the > FW_AUTOPROTECT_GLOBAL_SERVICES feature, because I > made a mistake which would > not block access to autoprotect ports from external > - and this might result > in a security problem > > v1.3 14.07.01 FINAL -> FIRST OFFICIAL RELEASE > * Fixed a bug in autoprotecting ports to externals > (thanks to > sielaff(a)chem.tu-berlin.de and > D.Markwardt(a)tu-bs.de) > * Added special log message if internals try to > access the external > IPs of the firewall > * Added missing /sbin/rcSuSEfirewall2 link (thanks > to > wolfgang.hoefler(a)hwo.at) > > > Greets, > Marc > -- > E@mail: marc(a)suse.de Function: Security Research > and Advisory > PGP: "lynx -source > http://www.suse.de/~marc/marc.pgp | pgp -fka" > Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 > D4 87 B5 63 6C > Private: http://www.suse.de/~marc SuSE: > http://www.suse.de/security > > -- > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > > -- > To unsubscribe, e-mail: > suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > ____________________________________________________________ Do You Yahoo!? Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk or your free @yahoo.ie address at http://mail.yahoo.ie

2 1

SuSEfirewall config with pptpd help
by Daniel Nilsson 17 Jul '01

17 Jul '01

Hi All, I have a question regarding the configuration of a SuSEfirewall running pptpd (VPN server). This is our current configuration: -------------- --public static IP()-| SuSe Linux |-eth1(192.168.1.1/24)--| -------------- | ---------- | Switch | ---------- -------------- | | | | Solaris A |-eth0(192.168.1.2/24)-----| | | -------------- | | -------------- | | | Solaris B |-eth0(192.168.1.3/24)--------| | -------------- | ----------------- | | DHCP machines |-eth0(192.168.1.X/24)-----------| ----------------- The SuSE Linux machine is running the firewall software (SuSEfirewall) as well as working as a masq server for the internal machines behind the firewall. I'd like to be able to handle incoming requests to the firewall from Windows client (or Linux clients running pptp). The key is to provide access to Solaris machine A but I'd like to be able to see all machines on the 192.168.1.0 subnet. I have the pptpd package working and I have the correct prots open on the firewall to handle VPN connection. My question is though how to assign IP addresses on the ppp connections that are setup when a VPN connection is active ? Should both ends be part of 192.168.1.0 or something else ? Second question is how to enable forwarding of the packets on the pppX device to the internal network ? I can get traffic through if I enable all ports in the firewall for TCP_FORWARD and UDP_FORWARD but I don't understand how to distuinquish between packets from the ppp0 device that should be forwarded to eth1 compared to packets from eth0 from the same address (in this case 192.168.3.1) that I definately don't want forwarded inside the firewall. Any help appreciated. Thanks Daniel Nilsson

1 0

Re: [suse-security] Re: Newbie firewall installation question
by Florian Kirchmeir 16 Jul '01

16 Jul '01

Hi Carl! Well, yes, I guess that would in deed be a very secure solution, but not very easy to administrate. Having a read-only root partition requires quite some work, although there are probably some good HOWTOs out there, describing the nesseccary steps. Another problem is that your read-write area doesn't survive a reboot, so stuff like logfiles (well, you can log to another machine) or squid caches (if you have that) are lost. In short: certainly doable, but IMHO not worth the hassel. Regards, Florian Kirchmeir Carl Albert Schreiber wrote: > Hi Florian & all the others, > > additionally to what you said, wouldn't it be a good solution > to have: > one harddisk (or 2 raid..?) 'writeprotected' with alle the Linux- > and the Firewall Stuff and > another harddisk or just a old fashion Ram-Disk for all the > folders, where the system and/or the programs and services are > going to write and to strore in (probably bad english, sorry) > With a cron this writeable disk has to be taken care of reguarly, > which should be no problem. > > Would such a system be a problem or would it be may be saver than > the normal way? > I'm asking because from my viewpoint it is save and I think it > should be the 'default structure', no? > > Carl

2 2

Re: [suse-security] temp directories /home/tmp /tmp several questions.
by Nick LeRoy 16 Jul '01

16 Jul '01

Phil.. > Note: I am not talking about /home/usr/tmp but /tmp and I am thinking it > would need to be 1.0G right? As far as the above relating to /tmp: It's a good idea to have a separate /tmp because any user can write to /tmp. If /tmp is part of the root file system, it's very easy for a non-privilged user to fill up your root file system, which is a bad thing (tm). /tmp does not need to be 1G or anything near that. Depending on my uses, I usually give /tmp ~50m - 100m. It *should* be cleaned out regularly. -Nick -- Get your free email from www.linuxmail.org Powered by Outblaze

1 0

Re: [suse-security] Suse firewall script question
by Stefan_Walther＠gehag-dsk.de 16 Jul '01

16 Jul '01

Hi, two things you have to check: 1st: what is your kernelversion. In kernel 2.2.x you have to check in network options the point ICMP-Masquerading. 2nd: you have to enable IP-FORWARDING in /proc/sys/net/ipv4/ip_forward. If there is a 1 in ip_forward your ping goes from the internal interface to the external interface with the IP of your internal interface of your local computer. the internet cannot do anything with this IP, because these private IP's aren't routeable. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 "maillist" <maillist@inv An: <suse-security(a)suse.com> enit.de> Kopie: Thema: AW: [suse-security] Suse firewall script question 16.07.2001 11:35 Hi It is right that fw_allow_ping_fw=yes means that the firewall is pingable from the internet. But if the 3 options set to yes the ping should go through the firewall(dokumentation of the firewall script) What do you mean with masq the ping? How can I masq an icmp echo??? Regards Björn Berger

1 0

RE: [suse-security] Suse firewall script question
by Andreas Marbet 16 Jul '01

16 Jul '01

If you use private addresses for your internal lan, then I think you have to masquerade these addresses. In your case, ping reaches the outside, but the reply never arrives because it is not routable. Andreas ----- Original Message ----- From: "maillist" <maillist(a)invenit.de> It is right that fw_allow_ping_fw=yes means that the firewall is pingable from the internet. But if the 3 options set to yes the ping should go through the firewall(dokumentation of the firewall script) What do you mean with masq the ping? How can I masq an icmp echo??? -----Ursprüngliche Nachricht----- Von: Stefan_Walther(a)gehag-dsk.de [mailto:Stefan_Walther@gehag-dsk.de] Gesendet: Montag, 16. Juli 2001 11:20 An: maillist Cc: suse-security(a)suse.com Betreff: Re: [suse-security] Suse firewall script question Hi, I think fw_allow_ping_fw means, that you can ping the firewall. The same I think is only meant for the firewall. I think you have to masq your pings, if you want to ping through your firewall to the internet. --- Hello I´m trying to set up a linux firewall box with 3 network devices. The first points to the internet gateway, the second to the DMZ(192.168.1.x) and the third to the internal network(192.168.2.x). I´m using Suse 7.0 and have installed the firewall script and squid proxy server. The squid runs fine html,ftp works. In the firewall script I have disabled routing and masquerading. Now I want to ping the internet from my internal network. But no request gets an answer.

1 0

SuSEfirewall2 and Squid
by Alex Liesch 16 Jul '01

16 Jul '01

Hi! I just installed SuSE 7.2 with the latest SuSEfirewall2 (1.3). Here's the problem: Everytime after a 'SuSEfirewall2 start' (e.g. boot) I have to restart Squid, because Squid does not respons, but is still alive. I tried squid and squid-beta shipped with SuSE. Any ideas? Do you need more informations? Alex. -- Alexander Liesch http://www.alexliesch.de/alex/ Lichtwiesenweg 9 Phone: +49 (0)6151 154715 64287 Darmstadt Fax/UMS: +49 (0)1212 5 10309699 Germany GnuPG/PGP-Key: 0xBC985C75

2 1

AW: [suse-security] Suse firewall script question
by maillist 16 Jul '01

16 Jul '01

Hi It is right that fw_allow_ping_fw=yes means that the firewall is pingable from the internet. But if the 3 options set to yes the ping should go through the firewall(dokumentation of the firewall script) What do you mean with masq the ping? How can I masq an icmp echo??? Regards Björn Berger -----Ursprüngliche Nachricht----- Von: Stefan_Walther(a)gehag-dsk.de [mailto:Stefan_Walther@gehag-dsk.de] Gesendet: Montag, 16. Juli 2001 11:20 An: maillist Cc: suse-security(a)suse.com Betreff: Re: [suse-security] Suse firewall script question Hi, I think fw_allow_ping_fw means, that you can ping the firewall. The same I think is only meant for the firewall. I think you have to masq your pings, if you want to ping through your firewall to the internet. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 "maillist" <maillist@inv An: <suse-security(a)suse.com> enit.de> Kopie: Thema: [suse-security] Suse firewall script question 16.07.2001 11:24 Hello I´m trying to set up a linux firewall box with 3 network devices. The first points to the internet gateway, the second to the DMZ(192.168.1.x) and the third to the internal network(192.168.2.x). I´m using Suse 7.0 and have installed the firewall script and squid proxy server. The squid runs fine html,ftp works. In the firewall script I have disabled routing and masquerading. Now I want to ping the internet from my internal network. But no request gets an answer. I have set the following options to yes fw_allow_ping_fw = yes fw_allow_incoming_highports_udp=yes fw_allow_fw_traceroute=yes Referencing to the technical dokumentation these 3 options set to yes allows the icmp ping to pass the firewall. But it didn´t work :-( Has anyone an idea? Thx for any help Regards Björn Berger -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] Suse firewall script question
by Stefan_Walther＠gehag-dsk.de 16 Jul '01

16 Jul '01

Hi, I think fw_allow_ping_fw means, that you can ping the firewall. The same I think is only meant for the firewall. I think you have to masq your pings, if you want to ping through your firewall to the internet. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 "maillist" <maillist@inv An: <suse-security(a)suse.com> enit.de> Kopie: Thema: [suse-security] Suse firewall script question 16.07.2001 11:24 Hello I´m trying to set up a linux firewall box with 3 network devices. The first points to the internet gateway, the second to the DMZ(192.168.1.x) and the third to the internal network(192.168.2.x). I´m using Suse 7.0 and have installed the firewall script and squid proxy server. The squid runs fine html,ftp works. In the firewall script I have disabled routing and masquerading. Now I want to ping the internet from my internal network. But no request gets an answer. I have set the following options to yes fw_allow_ping_fw = yes fw_allow_incoming_highports_udp=yes fw_allow_fw_traceroute=yes Referencing to the technical dokumentation these 3 options set to yes allows the icmp ping to pass the firewall. But it didn´t work :-( Has anyone an idea? Thx for any help Regards Björn Berger -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0