July 2001 - openSUSE Security - openSUSE Mailing Lists

Firewall confusion
by John Bland 27 Jul '01

27 Jul '01

Hi, I'm having some bother setting up a firewall and although the problem is pure networking I just thought I'd check I'm not doing something stupid. We have a network here with a large number of proper unique ip addresses. This is both for servers and workstations which people like to log into etc from offsite. What I'd like to do is put in some 'seamless' firewalling, ie retain our unique ip addresses but firewall the connection to them to only allow secure connections and log the traffic. To do this I'm putting in a linux box with two NICs between our incoming connection and the primary hub. I'm aware that using non-routables would be easier and more secure but that would mean a complete overhaul of our setup and messing about with proxies. The problem is that this means the two NICs on the firewall are on the same subnet. There appears to be some problem with routing in this setup. I've not tried to do anything fancy just set up eth0 and eth1 as normal. Any comments? I'd really rather avoid a wholescale move to 192.168.x.x if possible. Cheers, JB -- John Bland M.Phys (Hons) AMInstP / \ PhD Student & Sys Admin Email: j.bland at cmp.liv.ac.uk / \ Condensed Matter Group http://ringtail.cmp.liv.ac.uk/ / \ Liverpool University "Hey, I wonder how much meat you get on a womble?" -- Eddie

5 7

SuSEfirewall
by Eric Swenson 27 Jul '01

27 Jul '01

None of the examples configuring SuSEfirewall appear to really address my configuration, which leads me to believe: a) I'm doing something stupid, or b) the examples should be updated to include a similar config. I'm running SuSE 7.2 on a machine with a single ethernet interface to my LAN where I have a DSL Router (Cayman 3220-H) providing access to the internet. I wish to protect this machine from internet-based attacks while allowing inbound http and smtp access. However, I also want machines on the LAN to have greater access (i.e. access to Samba services, telnet, ftp, etc.). What I've done is configured one interface (the external, untrusted interface -- name my ethernet LAN eth0). And I've allowed http, smtp, and domain access using FW_SERVICES_EXTERNAL_TCP="www smtp domain" FW_SERVICES_EXTERNAL_UDP="domain" And, in order to allow local machines on my LAN to access other services, I've explictly listed those machines and services under FW_SERVICES_TRUSTED_ACL My LAN is configured with a netmask of 255.255.255.248 (which corresponds to the number of static IP addresses allocated to me by my DSL provider). Assuming I want all machines on the LAN to have the same access to the Linux server, and that my net's address is aaa.bbb.ccc.ddd, should I use: FW_SERVICES_TRUSTED_ACL=aaa.bbb.ccc.ddd/29,tcp,xxx etc. or list each host,prototol,port explictly, or should I list aaa.bbb.ccc.ddd/29 under FW_TRUSTED_NETS? What is the "right" way to consider all the machines on the LAN as trusted but also have my external DSL gateway/router on that same LAN? And should I treat the ip address that corresponds to the Router specially, since it appears to be directly accessible from the internet and lies within my LAN address range? Thanks much. -- Eric

1 0

Filtering streaming radio over Internet
by RoMaN SoFt / LLFB!! 27 Jul '01

27 Jul '01

Hi. Have you got any tips for filtering all type of radio streaming which spends more and more bandwitdh?? (for example, shoutcast/realserver radio) The problem is that many radio streaming servers are located on port 80, so I cannot differentiate between legal www traffic and shoutcast/other streaming server traffic (at the ip layer). So I cannot use iptables/ipchains. But I also have a squid server set as transparent proxy (so all port-80 traffic is forwarded through squid). Here we are at app layer, so the filtering I'm looking for should be possible. Any ideas about how to implement this filtering? Anyone who has made this kind of filtering? Is there any http header which differentiates www traffic and streaming traffic? Thanks in advance. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman(a)madrid.com http://pagina.de/romansoft ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Forwarding NFS connection
by mschneider＠datencenter-deutschland.de 27 Jul '01

27 Jul '01

Hello list! I want to access a nfs-filer (SuSE 7.2, kernel nfs) with an internal IP (172.x.x.x) through a firewall using ipchains and having a connection to the internet. Is it possible to forward/masq the nfs connection with ipchains and what are the necessary rules? Ciao, Martin Schneider

1 0

Can't receive messages
by Philippe Allart 27 Jul '01

27 Jul '01

Hi, I've tried to use SuSEFirewall to configure a server with SMTP, POP and a Web server. I've activated masquerading to allow the users on the local network to access Internet. I had to desactivate FW_PROTECT_FROM_INTERNAL to allows certain feature, for example traceroute. What is the good way? The mail server works well from local user to local user and from local user to external user. But entering mails are systematically rejected. I've copied below the Firewall and senmail config file of SuSEFirewall. aaa.bbb.ccc.130 is the public IP adress of the firewall. Below, you can see also the log of the firewall. How to find a relation between this messages, and the output of ipchains -L? Thank for your help, regards, Philippe. --- FW_DEV_WORLD="" FW_DEV_INT="eth0 ppp0" FW_MASQUERADE="yes" FW_PROTECT_FROM_INTERNAL="no" FW_ROUTE="yes" FW_SERVICES_EXTERNAL_TCP="25 80" FW_SERVICES_EXTERNAL_UDP="25 80" FW_SERVICES_INTERNAL_TCP="25 53 80 110 3128" FW_SERVICES_INTERNAL_UDP="53" FW_SERVICE_DNS="yes" FW_STOP_KEEP_ROUTING_STATE="yes" SENDMAIL_TYPE="yes" SENDMAIL_SMARTHOST="" SENDMAIL_LOCALHOST="localhost this.server.ua" SENDMAIL_RELAY="" SENDMAIL_ARGS="-bd -q30m -om" SENDMAIL_EXPENSIVE="no" SENDMAIL_EXPENSIVE="no" SENDMAIL_NOCANONIFY="no" SENDMAIL_NODNS="no" SENDMAIL_DIALUP="no" SENDMAIL_GENERICS_DOMAIN="" MASQUERADE_DOMAINS="" Jul 13 16:50:30 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 202.58.118.7:1329 aaa.bbb.ccc.130:25 L=60 S=0x00 I=3205 F=0x4000 T=41 SYN (#7) Jul 13 16:50:30 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 202.58.118.7:1329 aaa.bbb.ccc.130:25 L=60 S=0x00 I=3205 F=0x4000 T=41 SYN (#7) Jul 13 16:50:46 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 193.41.48.5:1426 aaa.bbb.ccc.130:25 L=44 S=0x00 I=7215 F=0x4000 T=61 SYN (#7) Jul 13 16:50:49 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 193.41.48.5:1426 aaa.bbb.ccc.130:25 L=44 S=0x00 I=7338 F=0x4000 T=61 SYN (#7) Jul 13 16:50:55 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 193.41.48.5:1426 aaa.bbb.ccc.130:25 L=44 S=0x00 I=7580 F=0x4000 T=61 SYN (#7) Jul 13 16:51:07 citydesign kernel: Packet log: rulchain REJECT ppp0 PROTO=6 193.41.48.5:1426 aaa.bbb.ccc.130:25 L=44 S=0x00 I=8061 F=0x4000 T=61 SYN (#7)

2 3

SuSEfirewall2 v1.6 available
by marc＠suse.de 26 Jul '01

26 Jul '01

Hi folks! v1.6 is now available ... anyone with < v1.5 should update from www.suse.de/~marc Important changes since v1.3 - fully SuSE compliant, FW_SERVICE_SQUID support, fix of first DNS lookup hang and some misconfiguration checking. For anyone who installed the v1.3 RPM version: you must copy the ip-up script from /usr/share/doc/packages/SuSEfirewall2 tp /etc/ppp ... v1.6 26.07.01 GAMMA * Added error checking for FW_MASQ_NETS because I got too many reports of users who told me that the filter rules blocked sites without a reason just because they set 192.168.0.0/8 instead of 192.168.0.0/24 This wastes too much of my time ... * Added an additional EXAMPLE with an ipsec setup, also wrote an FAQ section about that. v1.5 21.07.01 GAMMA * Fixed a typo in firewall.rc.config which resulted in an error for logging. thanks to Lutz.Jaenicke(a)aet.TU-Cottbus.DE v1.4 21.07.01 GAMMA * Added FW_SERVICE_SQUID to support special squid UDP ports (where one of them is dynamic ...) * Fixed a long, long bug which resulted in timeouts for the first DNS lookup which triggered autodialing * Changed firewall.rc.config format to be yast compliant --- the following fixes were done by Kurt for the v1.3 rpm release: * rcfirewall2 points now to SuSEfirewall_setup * Many, many spelling fixes! Greets, Marc -- E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

1 0

SuSEfirewall2 - where can I get it?
by suse-mails＠holycows.de 26 Jul '01

26 Jul '01

Hi! I'm searching for an URL where I can download SuSEfirewall2. Everybody is talking about it, but I haven't found it yet at www.suse.de . Thanx for your help! Ralf

2 1

Re: [suse-security] IPTABLES question - Webserver - DOS protection
by Michal Ludvig 25 Jul '01

25 Jul '01

On Wed, 25 Jul 2001, Steven Thompson wrote: > Q2. And how do you protect the web server from a DOS with IPTABLES (an > example would be great). Hi, for this purpose I use more-less following rules: iptables -A INPUT -p tcp --dport 80 -m limit --limit 50/s -j ACCEPT iptables -A INPUT -p tcp --dport 80 -m limit --limit 2/m -j LOG \ --log-prefix "DoS attempt: " iptables -A INPUT -p tcp --dport 80 -j DROP I've extracted these from my more complex ruleset, which also includes protection against "ICMP echo flood" and others. It protects a webserver with > 400.000 hits per day and seems to work quite well. Of course you may need to adjust the --limit 50/s to reflect your needs. Michal Ludvig

1 0

Re: [suse-security] buffer overflow in telnetd
by dirk janssen 25 Jul '01

25 Jul '01

On Wed, 25 Jul 2001, Markus Gaugusch wrote: > > and it has a one time password system. > wie hast du das implementiert? > würde mich echt interessieren! > it is a simple script that is launched by the tcp wrappers. Nothing fancy and it only works if you have one user who logs in remotely (wrappers have of course no idea who is trying to log in). But for your average desktop system with one user, it should work. I looked into various S/key and OTP programs, but they all seem abandoned these days. Dirk

2 1

buffer overflow in telnetd
by Marco Ahrendt 25 Jul '01

25 Jul '01

Hi all, is any SuSE distribution (maybe older than 6.4?) affected by the vulnerability above? the cert advisory was released some days ago http://www.cert.org/advisories/CA-2001-21.html regards, Marco -- adconsys AG phone : +49-341-98-474-0 Karl-Liebknecht-Str. 19 fax : +49-341-98-474-59 04107 Leipzig/Germany url : http://www.adconsys.de/ gpg key: mail -s "get gpg key" marco.ahrendt(a)adconsys.de

6 6