July 2001 - openSUSE Security - openSUSE Mailing Lists

Newbie firewall installation question
by De Loe, Maurits 16 Jul '01

16 Jul '01

Dear all, At home I've an old P120 that I want to setup as a firewall-only machine. As I want to install as little as possible what's the best "quick" solution. Under Yast Select "Minimum" and after that Network and Security packages? Furthermore I was thinking to partition my disk with a app. 12MB /boot 128 /swap (there's about 90 ram) and the rest app. 1G / Is that a "correct and smart setup for a dedicated firewall. Would LVM be an option? (Would think not but...) Any help would be appriciated. (Tried smoothwall before but Zyxel modem doesn't want to work whith chat, does with wvdial. Thank, Maurits

4 3

suse firewall vs checkpoint/sonic
by stephane parenton 16 Jul '01

16 Jul '01

Hi, I'm working with Suse for a short while, and I was questionning myself about security. Has anybody tried to compare the SuSE FW solution with the sonicwall pro or the checkpoint FW1 ? Does the SuSE FW solution can manage the bandwidth within the product or does the bw be managed from outside ?... what about statistics, loggs and so on ? Thanks in advance for your infos... Stephane

1 0

Sendmail issues on firewall
by Wilhelm Tesnaar 16 Jul '01

16 Jul '01

Hi All I am having some serious problems with sendmail acting as a Mail gateway on my firewall. I have a default installation of it on suse 7.1. I have modified the relay-domains and also domaintable (You know, where you tell it to route incoming domain mail to.) I can send out fine. When I have mail sent to me, it gives a 5.0.0 550 access denied error. Could someone give me a few ideas why this would happen ? Could reverse DNS entries have any effect ? Regards Willie Tesnaar Change your way of thinking, it might ease the process of self discovery ! (Willie Tesnaar 06/06/2001) -----Original Message----- From: marc(a)suse.de [mailto:marc@suse.de] Sent: Saturday, July 14, 2001 2:10 PM To: suse-security(a)suse.com Subject: [suse-security] SuSEfirewall2 v1.3 (security fix update) Hi folks, After a very long testing time version 1.3 is now available, and the first official rpm will be availabel as well during next week! you can find the newest version at www.suse.de/~marc/suse or wait for the official rpm release. For everyone using older versions: you should update if you are using the FW_AUTOPROTECT_GLOBAL_SERVICES feature, because I made a mistake which would not block access to autoprotect ports from external - and this might result in a security problem v1.3 14.07.01 FINAL -> FIRST OFFICIAL RELEASE * Fixed a bug in autoprotecting ports to externals (thanks to sielaff(a)chem.tu-berlin.de and D.Markwardt(a)tu-bs.de) * Added special log message if internals try to access the external IPs of the firewall * Added missing /sbin/rcSuSEfirewall2 link (thanks to wolfgang.hoefler(a)hwo.at) Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 v1.3 (security fix update)
by marc＠suse.de 14 Jul '01

14 Jul '01

Hi folks, After a very long testing time version 1.3 is now available, and the first official rpm will be availabel as well during next week! you can find the newest version at www.suse.de/~marc/suse or wait for the official rpm release. For everyone using older versions: you should update if you are using the FW_AUTOPROTECT_GLOBAL_SERVICES feature, because I made a mistake which would not block access to autoprotect ports from external - and this might result in a security problem v1.3 14.07.01 FINAL -> FIRST OFFICIAL RELEASE * Fixed a bug in autoprotecting ports to externals (thanks to sielaff(a)chem.tu-berlin.de and D.Markwardt(a)tu-bs.de) * Added special log message if internals try to access the external IPs of the firewall * Added missing /sbin/rcSuSEfirewall2 link (thanks to wolfgang.hoefler(a)hwo.at) Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

Scanlogd fails at start
by Paco 14 Jul '01

14 Jul '01

Hi, when SuSE 7.1 starts, i get the followin message: Starting service scanlogdnids_init: no suitable device found startproc: exit status of /usr/sbin/scanlogd: 1 failed Anyone can help me? Thanks

2 1

Susefirewall2 (v1.2): DNS handling
by Jörg Mayer 13 Jul '01

13 Jul '01

Hello, I've just installed FW-2. The transition from FW-1 to FW-2 was trivial, maybe too trivial: Some of the rules should be obsolete by now, specially the rules for DNS: Why is "connection" tracking for UDP not used? Ciao Jörg -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

2 1

KLIPS on IPSec won't start up properly
by Mark Tinka 13 Jul '01

13 Jul '01

i have just installed IPSec, on SuSE and when i start the daemon, i get this error message:ipsec_setup: WARNING: ipsec0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = `1', should be 0) ipsec_setup: WARNING: eth0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/eth0/rp_filter = `1', should be 0) i have had a look at these files for the ipsec0 and eth0 interfaces, but changing the metric is not possible when they interface is up.. and writing the file isn't possible when the interface is down... any ideas would be appreciated.. thanks.. AKNIT ____________________________________________________________ Do You Yahoo!? Get your free @yahoo.co.uk address at http://mail.yahoo.co.uk or your free @yahoo.ie address at http://mail.yahoo.ie

2 2

RE: [suse-security] scans to port 111
by Volker Kuhlmann 13 Jul '01

13 Jul '01

> There are numerous vulnerabilities in rpc services and demons, such as > snmpXmid, rpc.statd and wu-ftpd, buffer overflows in various services, and so > on. Look at Cert's collection of the current cracker/kiddie activity on > http://www.cert.org/current/current_activity.html#scans . And keep your system > free of rpc. Let's say I have a home network of 3 computers, which share disks with NFS. What's the risk if all NFS-related ports are blocked on the firewall to the outside? There doesn't seem to be much of an alternative to NFS, or is it unreasonable to assume the internal net is trustworthy? Volker

5 4

scans to port 111
by OKDesign oHG Security Webmaster 12 Jul '01

12 Jul '01

Hi folks, our servers keep logging system-scans on port 111 for some months now. Obviously some people try to find systems accepting connections on port 111 (sunrpc). Besides of the traffix generated by this (okay, one scan means very little traffic, but up to 10 scans per day, and this every day on every IP we accept sums up to enough traffic to be concerned) and besides of the fact that our servers are no playground for script-kiddies *sigh*, my question is: Do I have to be alarmed ? And what can I do against it ? I already run portsentry, but our /etc/hosts.deny keeps growing day by day. Whats up with this port 111 ? I know the normal pubscans and proxy-scans, but these are done on port 20,21 and 1080, not on 111... I'm a little confused now, because these scans grow. It began with 2-5 scans per week and now we log (as I already said) up to 10 scans per day. Can someone please explain what's going on there and if there is a way to stop it ? Thanks in advance. --- -------------------------------------------- Stephan M. Ott // OKDesign oHG ............. Internet-Providing und Netzwerkmanagement .. smo(a)okdesign.de ..... http://www.okdesign.de fon. +49 961 3814139 .. fax. +49 961 3814140 in dringenden faellen: mobil. 0171-7858064 . --------------------------------------------

3 2

re:[suse-security] scans to port 111
by Ray Rice 12 Jul '01

12 Jul '01

Unless you block the port at your external router you will not be able to stop the scans. It also sounds like the world knows yours network addresses. If you used Network Address Translation (NAT) you could keep your internal address from making there way out for discovery. Can you enforce NAT on your network?

1 0