July 2001 - openSUSE Security - openSUSE Mailing Lists

Pam
by Andreas Wahlert 31 Jul '01

31 Jul '01

Hai list, knows anybody a good implementation guide for pam? regards from germany Andreas Wahlert

2 1

RE: [suse-security] ip_conntrack_ftp
by Andreas Wahlert 31 Jul '01

31 Jul '01

Hai List, i'm realy scared about this words. I remember: the reason was a big hole in the Linux Kernel, known since April. "Red Hat" has strongly recommend to apply a patch to their Kernels! I think, so many as possible linux users should know about this bug and there is no secure solution for the SuSE Kernel! friendly Regards Andreas Wahlert > > Get the latest kernel from Hubert's directory at > > ftp://ftp.suse.com/pub/people/mantel/next/. This is the _innofficial_ > > place for the latest when it comes to the SuSE kernels. The RPMs should > > install cleanly on a 7.1 or a 7.2 system. If something fails with these > > kernels, be it in source or in rpm form, it's nothing but bad luck. > > > > Since more problems are expected with the 2.4 series kernel, there will be > > no official kernel update. Instead, it is advised to use a 2.2.19 kernel > > when security considerations play a major role. > > Where is the recommended place for discussion of these kernels and where > should problems be reported? It seems unlikely most such material would > be appropriate for this list. I agree... It seems like that there are not too many people willing to discuss such detailed and specialized matter in a mailing list that is bound to a distribution/a vendor. After all, all relevant mailing lists that deal with kernels, networking and discrete subsystems are not distribution-specialized, and sometimes I tend to believe that the discussions on distributor-hosted mailing lists are somewhat emotional and less rational. I'm very please to see that this is rarely the case with suse-security. Anyway, I think you could meet people with the same questions and fitting answers at suse-linux-e(a)suse.com. The volume is not too high on this list. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> "Caution: Cape does not | SuSE GmbH - Security enable user to fly." | Nürnberg, Germany (Batman Costume warning label) | - - -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] kernel 2.4: ipchains and ip_masq_ftp
by Stefan_Walther＠gehag-dsk.de 31 Jul '01

31 Jul '01

Hi, yeh you're right. But I think you should switch to iptables, if you want to use kernel 2.4.x. Maybe you should use a 2.2.19 if you want to be able to use ipchains and ip_masq_ftp. By the way the ftp-connections with iptables and ip_conntrak_ftp works much better and faster. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi, what can I do, when I want to run my old ipchains-configuration file on an 2.4 kernel I can load the ipchains-Module but there is no ip_masq_ftp Module any longer. INTERNOLIX AG Kai Elsner Network-Administrator elsner(a)internolix.com

2 1

ip_conntrack_ftp
by Andreas Wahlert 31 Jul '01

31 Jul '01

Hai @ all, what's about the ip_conntrack_ftp BUG in iptables?? The Patch at netfilter.samba.org dosn't work witch 2.4.4 SuSE Kernel (SuSE 7.2)! How can i secure my Linux - Box against this attack?? friendly regards from germany Andreas Wahlert

4 4

DNS/Bind setup
by Stefan Eissing 31 Jul '01

31 Jul '01

Since there are some real experts here and BIND is currently a topic, I have a question relating my setup: I have a firewall/router with two interfaces (well more router than firewall actually). Internal network runs on a 192.168.x.x network. The BIND daemon only listens on the internal interface, serving some internal zones and forwards all external lookups to a range of known servers. It seems to me that my BIND is therefore unreachable for outside queries and that I do not have a security issue with it. On the other hand, that sounds to good to be true. So, if I'm wrong I'd be glad for any helpful comments on what I have missed and where possible security holes in this setup (BIND related) are. best regards, Stefan

2 1

kernel 2.4: ipchains and ip_masq_ftp
by Elsner, Kai 31 Jul '01

31 Jul '01

Hi, what can I do, when I want to run my old ipchains-configuration file on an 2.4 kernel ? I can load the ipchains-Module but there is no ip_masq_ftp Module any longer. INTERNOLIX AG Kai Elsner Network-Administrator elsner(a)internolix.com

1 0

CGI-BIN security
by telco soltn 31 Jul '01

31 Jul '01

Hello List, I tried to secure my cgi-bin directory with .htaccess but got internal server errors when tried to access it. set apache to AllowOveride All on the cgi-bin directory although I had no problems when setting .htaccess with ~user directories. I'm on a SuSE 7.1 running 2.4.7 kernel with httpd ver Apache/1.3.19 (SuSE/Linux) Is there any other way to work around this or another means of securing my CGI-BIN with password security when accessing it with a web browser? thanks. -- dc __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/

3 2

AW: [suse-security] DNS: BIND vs djbdns
by Peer Stefan 31 Jul '01

31 Jul '01

Hi, I'm running 2 BIND-servers (SuSE 7.0/BIND9.1.3 and SuSE 7.2/BIND8.2.4), all BINDs are compiled from the original sources and I never encountered strange crashes. Perhaps you should update to the latest available sources, which contain several bugfixes. regards, Stefan --- Schoenwaelder Oliver wrote: > >Hi, > >I had some reliability problems, too. I installed bind8-8.2.3-REL at our >SuSE 7.0 from the original sources and bind crashed at least once a day. >I never got a reason for this. But after installing the SuSE update rpm for >8.2.3 it never crashed again. >I don't know what the differences are and I don't care... >So I you are running a SuSE system try to install their package. > >Hth, > >Oliver

1 0

best method to block ip block
by Togan Muftuoglu 31 Jul '01

31 Jul '01

Hi, I want to block all kinds of protocol requests coming from an isp's dialup users since I had enough Superscan pings, icmp +++ath0 attacks the nmap other sorts of tools to scan my ip and also not to forget to mention the back office and other trojan client to server, server to client traffic hitting my firewall. Although these requests are denied at the firewall is there a better way of stopping this. The ip block I want to filter is as follows xxx.156.130.1 to xxx.156.191.255 -- Togan Muftuoglu

4 3

Re: [suse-security] SuSEfirewall config with pptpd help
by Daniel Nilsson 30 Jul '01

30 Jul '01

Hi Ian, I have been able to get the VPN server running. I'm concerned though that I had to open up to much in my firewall config to make this possible. I don't have access to the firewall config file right now but what I did is that I added all the possible ppp adapters to FW_DEV_INT and then I added a forwarding rule for all ports with source and destination of 192.168.1.0/24 like this: FW_FORWARD_TCP="192.168.1.0/24,192.168.1.0/24,1:65535" # Beware to use this! FW_FORWARD_UDP="192.168.1.0/24,192.168.1.0/24,1:65535" # Beware to use this! FW_FORWARD_IP="192.168.1.0/24,192.168.1.0/24,1" # Beware to use this! What I don't understand though is how to limit the destination of these packages to be one of the ppp adapters and not my FW_DEV_WORLD adapter. Maybe packages from 192.168.1.0/24 will be denied from FW_DEV_WORLD, but I have no way of testing that. I'm also not sure if the FORWARD rule overrides the INPUT rule or not, that if , if packets entered FW_DEV_WORLD from a source of 192.168.1.0/24 will they be forwarded to the internal network even though they are not open in: FW_SERVICES_EXTERNAL_TCP="" # Common: smtp domain FW_SERVICES_EXTERNAL_UDP="" # Common: domain I clerly need to spend some more time understanding these rules. If anyone on the list has some information on how to properly setup incoming VPN connections to a pptpd running on the firewall that would be very helpful... Thanks Daniel Nilsson Ian F. Silver wrote: >Dear Daniel, > >I saw your post to the SuSE-Security mailing list where you were asking >about setting up a VPN/PTPTP connection from the outside world to your >192.168.1.0/24 masqueraded address machines on the internal side of >the SuSEfirewall you've set up. > >I've got an almost _identical_ setup to yours, and am exploring the exact >same options as you, though I don't think I'm quite as far along as you >are (I haven't set up PPTPD yet, I'm still in the exploration/information >seeking phase). > >I was seriously thinking of switching firewall packages over to Astaro's >offering due to all the features it has, but since I've been happy with >the SuSEfirewall package to date, I'd like to stick with it if possible. > >Have you had any luck so far with your configuration of a VPN with >SuSEfirewall? If so, would you be willing to share your configs (minus >any sensitive info/passwords of course!) to give me a leg up in getting >farther along this path? If I can come up with any insights, of course >I'll be willing to share them in return. :-) > >Sincerely, >Ian F. Silver >

1 0